52 articles · 2023 · page 2 of 3
Articles
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 downgrades confirmed that the spring’s bank stress would become a long earnings squeeze. Regional bank technology budgets now had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for thinner margins.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
Ransomware hit Prospect Medical Holdings in August 2023, striking an operator already short of money and midway through selling three Connecticut hospitals. For operators like that, cyber resilience becomes a balance-sheet and deal term, priced by buyers, lenders and state approvers.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
In July 2023 the SEC gave public companies four business days to disclose a material cyber incident, counted from when they decide it is material. So the decision itself needs governing: who makes it, what record it leaves, how it fits other deadlines.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining depended on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came not from its clinical systems but from storage used to format patient emails. Outreach data looks harmless field by field, yet together it is protected health information and deserves the same care as the medical record.
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s hiring-tool law made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder first step was finding every tool that scores candidates, deciding which were covered, and naming an owner for each.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
In one week, Colorado and Connecticut switched on their privacy laws and a California court paused new rules a day before enforcement. When deadlines move like that, the steadier approach is to build four lasting capabilities and map each new law onto them.
Week of 19 June 2023
Why a stolen DMV file weakened identity checks at agencies that were never breached
The MOVEit hack exposed the license records of most drivers in two states, and license numbers and issue dates stopped being secrets. Every agency that used them to check who residents were online inherited the breach, whether or not it ran MOVEit.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 AI Act vote made headlines for generative AI. For banks, health systems and agencies, the lasting point was simpler: duties depend on whether you build an AI system, use one, or build on a general-purpose model. Many do all three.
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through the payroll, pension and contractor firms that ran it for them. Those clients had nothing to patch. What mattered was how fast they found affected vendors, who notified whom, and how much data they had handed over.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The 2023 debt deal held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly: subscriptions and cloud bills grew on their own, modernization slipped by default, and technical staff thinned through attrition. Each needed its own control.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
In May 2023 officials described a state-backed intruder inside US infrastructure that used everyday admin tools and hijacked home routers instead of malware. Catching it meant knowing what normal looks like, owning the network edge, and planning to run without a trustworthy network.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
One patient’s health data can answer to different regulators as it moves from a hospital to a consumer product to an app. The FTC’s May 2023 proposal spelled out where those lines fall, and why sharing with advertisers can count as a breach.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency ended in May 2023, and telehealth’s pandemic flexibilities unwound on schedules set separately by Congress, the DEA, OCR and the states, each landing on a different workforce question: what clinicians may prescribe remotely, where they may practice, which tools they may use.
Week of 1 May 2023
First Republic’s white-glove service had no answer for an uninsured balance
First Republic’s clients stayed loyal until one question took over: was money above the insurance limit safe? In a confidence crisis, good service comes down to three things most banks lacked: seeing each client’s insured position, changing it fast and saying something specific.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no new rules. It simply said existing lending, employment, housing and consumer protection law already reached automated systems, which made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Yet it, and the state laws that followed, assumed a health system could find sensitive details in a record and keep them labeled. Few could.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
A junior IT specialist with a valid top secret clearance shared secrets on Discord. He had the access but no need for the material. Why any organization holding sensitive data should treat access, monitoring and supervision as three separate jobs.
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
With pandemic-era continuous coverage over, states had about a year to recheck Medicaid eligibility for tens of millions of people. Who kept coverage depended less on the rules than on data: renewing people automatically, reaching the rest and processing their replies.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred agencies from using tools that threatened US security or had been misused abroad, which meant the policy would stand or fall on the unglamorous work of agency lawyers, security staff and contracting officers.