52 articles · 2020 · page 1 of 3
Articles
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who really owns companies. The register was later cut back, the bank’s own duty to know its customers stayed, and a new whistleblower channel changed who could report weak programs.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
Written to protect patients from shock medical bills, the No Surprises Act made a patient’s financial experience depend on four handoffs of information between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The SolarWinds Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are harmless plumbing, and that federal sensors would spot a national-scale intrusion. Only the second was quick to fix.
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 plan to speed up patients’ access to their own records stalled. It still pinpointed where access breaks down: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule to fix.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for device makers. Instead it set rules for one very large customer, the federal government, pushed security duties onto its contractors, and exposed an old problem: you cannot secure devices you do not know you own.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition squeezed a huge handover of people and their system access, records and accounts, and programs already running. Each needs its own playbook, written by career staff long before any election.
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
In November 2020, regulators finally let hospitals give cybersecurity to the small physician practices around them, free of charge. A legal barrier fell overnight. Whether anyone was actually safer depended on budgets, staffing and who would run the tools year after year.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. For public agencies the hardest constraint was data: matching people without a national ID, agreeing who could see records, and connecting hundreds of new sources in weeks.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator devoted to privacy. Banks and health systems that assumed federal law exempted them learned that California exempts certain data, not whole institutions, and that everything else needs real operational plumbing.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
A 2020 rule forced health plans to publish the prices they negotiate, but not to make them usable. Whether the files were worth anything came down to three problems the rule left to plans, employers and intermediaries: sheer volume, unclear meaning and accountability.
Week of 19 October 2020
Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s case against Google opened a long fight over platform power. It offered regulated buyers no relief on their own dependence on vendors, which is settled in contracts, system design and tested exit plans, far faster than any court moves.
Week of 12 October 2020
Why one phone call beat Twitter’s login controls
No clever code, no exotic exploit. New York’s report on the Twitter hack traced it to a phone call and a fake login page. The people who verify callers and reset logins turned out to be a security control few had designed or measured.
Week of 5 October 2020
Citi’s orders put data lineage on the safety and soundness agenda
The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from, and who answers for them.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and to the firms that help them pay, which moved the decision out of the crisis room and into a governed, documented compliance process.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
Universal Health Services lost systems across its network in September 2020. The downtime binder mattered less than a human question: could staff trained on electronic records run a unit on paper for days, and then put it all back?
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked what an effective anti-money laundering program really is, and leaked reports showed banks filing dutifully while flagged money kept moving. The gap between filing, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
A ransomware attack in Düsseldorf is remembered for a disputed death. Its lasting message for health systems is regional: when one hospital closes its doors to ambulances, the risk moves onto crews and neighboring hospitals that rarely plan for it, or measure it.
Week of 31 August 2020
Blackbaud’s breach exposed patient data that fundraising never needed
The Blackbaud ransomware attack reached hospitals through their fundraising foundations. It revealed donor databases holding more patient information, for longer, than fundraising needed, and showed why keeping less data is the one safeguard that still works after the others fail.
Week of 24 August 2020
Low for long: the rate forecast hidden in bank technology budgets
The Fed signaled in August 2020 that rates would stay near zero for years. Many bank technology plans assumed the same without saying so: in deposit forecasts, in how digital channels were judged and in contract terms that later came due.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail slowdown was covered as an election story. For agencies that mail notices, payments and medicines, it revealed something less visible: a critical dependency with legal deadlines attached and nobody inside the agency watching it.