52 articles · 2021 · page 2 of 3
Articles
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
In August 2021, the Senate fought over who should count as a crypto “broker.” Banks and brokerages were clearly in. Their real problem was three kinds of data they did not have: what customers paid, where assets had been, and who sent them.
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted slick digital passes and the humble paper CDC card alike. That paper fallback carried the program through patchy records and untrained door staff, and it is the design choice any agency issuing digital credentials should copy first.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
In July 2021, the White House promised cybersecurity goals for the systems that run infrastructure. But voluntary goals need an owner, a budget and a reason to act. Most small water systems had none, and only local officials could supply them.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
In July 2021, CMS proposed tying hospital price transparency fines to bed count, so the biggest systems could no longer cheaply pay to keep their rates hidden. Compliance became a permanent data product, read most closely by payers, employers and competitors rather than patients.
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a record-keeping task: where the patient is, how the visit happens, and when they were last seen in person.
Week of 5 July 2021
Why community banks’ open banking experience sat with their core vendors
The July 2021 competition order nudged the CFPB toward a rule on sharing bank data. For community banks and credit unions, the customer’s experience of that sharing was already shaped elsewhere: by core and digital banking vendors, in three moments they only partly controlled.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the very tools their IT providers used to look after them. The clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
In June 2021 the Supreme Court narrowed who can sue over inaccurate credit file flags. Underneath was a matching failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it revealed something surprising: a “business day” is defined in three places, the payment rails, customer commitments and the workforce, usually owned by three different teams.
Week of 7 June 2021
Why Basel’s 1,250% risk weight pointed banks toward custody
In June 2021, global bank regulators proposed rules that made owning bitcoin outright ruinously expensive in capital. Read closely, they split the bank crypto question into three different businesses, holding, safeguarding and moving value, and priced out only one of them.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
In June 2021 the Supreme Court decided that looking up records you are allowed to reach, for a bad reason, is generally not a federal computer crime. For agencies holding sensitive records, protection now rests on controls they own: access design, query monitoring and consequences.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
Less than three weeks after Colonial Pipeline, regulators gave critical pipelines twelve hours to report a cyber incident, a named coordinator on call around the clock and thirty days to grade themselves. All three ideas spread across sectors, and each needs different preparation.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
Ireland’s health service is remembered for the morning its hospitals went to paper. The independent review told a less dramatic, more useful story: the outcome was settled during nearly eight unnoticed weeks, across three stages of entry, dwell and response.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order took zero trust, a phrase worn thin by marketing, and turned it into three plain demands any organization can test system by system: verified identity, retained evidence and accountable software.
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
After a ransomware attack, Scripps Health spent most of May 2021 without its electronic health record. Downtime plans written for hours failed over weeks on three separate fronts: keeping care safe, keeping revenue flowing and keeping staff going.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on the threat of publication. Good planning starts by asking which data would hurt whom if released: the workforce, the mission or the public.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted the AI in banks, hospitals and agencies by business process, so compliance belonged to process owners as much as to data scientists.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 deal for Nuance put software that listens to doctor visits inside a giant cloud platform. For health systems, the decisions that mattered concerned the recording itself, who checks the draft note, and the contract governing both.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
The federal ban on information blocking took effect on April 5, 2021, and health systems found that compliance was decided less by policy than by portal settings and records queues. Three questions mattered: what gets released, when, and how withholding is defended.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
In March 2021, five federal agencies asked banks and credit unions how they use AI. No new rule followed. But the questions mapped onto four tests existing rules already imposed, and those tests still frame how supervisors look at any model.