“The same threat actors we built defenses against in government were pivoting to small practices. And nobody had built the wall yet.”
Joseph A. Perrin is the Chief Technology Officer of Patient Protect and the architect behind the platform's security infrastructure. His career spans federal and government-adjacent technology environments where the operational cost of a security failure is not measured in fines, but in mission compromise.
He designed and built the security foundation that every Patient Protect module runs on: a zero-trust architecture with AES-256-GCM encryption, a session vault that isolates each authenticated session from the broader application state, TLS 1.3 for all transport, fail2ban intrusion response, SMS-based two-factor authentication, an Altcha proof-of-work challenge layer against automated abuse, and browser-fingerprinting defense against credential-stuffing and session-hijacking attacks. The same architectural patterns he applied to protect government-sensitive systems now protect the patient data of independent clinical practices.
His methodology contribution runs deeper than the infrastructure itself. Patient Protect's risk-analysis model, threat-modeling framework, and Business Associate contract-review process reflect the federal discipline he brings to environments where documentation-only compliance was never sufficient. The platform's AppSensor integration and continuous audit logging are direct extensions of how he thinks about security: assume compromise, verify continuously, preserve evidence.
He works on ongoing platform hardening, vulnerability response, and the continuous review of every new component that enters the Patient Protect data path — from third-party integrations to internal features that touch ePHI.
Selected publications
Authored guides
7 guides on Patient Protect.
The 12 sections every defensible HIPAA risk assessment must include, the NIST 800-30 methodology OCR expects, and the free template format independent practices can actually fill out and defend.
The 9 sections every HIPAA incident response plan must contain under §164.308(a)(6), the 72-hour decision flow, and the template practices actually use — written by independent providers, not by Fortune 500 CISOs.
OneDrive Business is HIPAA-eligible. The default settings are not. This is the 8-step tenant + sharing + DLP + audit configuration that takes a fresh Microsoft 365 deployment from eligible to actually compliant.
HIPAA does not name a firewall. It names the controls a firewall must enforce. Six options ranked for independent practices — SonicWall, Fortinet, Cisco Meraki, pfSense, Palo Alto, WatchGuard.
The six clauses in a Business Associate Agreement that determine whether the contract actually protects the practice or just satisfies the HIPAA box-check. What to read for before signing.
The eight encryption standards that satisfy HIPAA's technical safeguards and trigger the breach notification safe harbor. What each protects, where each applies, and what most practices get wrong.
The seven recurring failures that turn a risk analysis into the most-cited finding in OCR enforcement. What each gap looks like, and the corrective standard for each.
