53 articles · 2024 · page 1 of 3
Articles
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers walked into Treasury workstations using a stolen key from a vendor’s cloud remote-support service, a key the agency never held. Remote support is powerful insider access by another name, and governing it takes four controls most organizations only partly have.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS proposed turning HIPAA’s flexible security safeguards into firm requirements. Most were controls hospitals already had or paperwork they could build. One was different: being able to restore key systems within 72 hours, which needed clinical planning, tested capacity and real money.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After hackers burrowed into U.S. phone networks, CISA urged targeted people to switch to encrypted messaging, just as regulators were fining brokers over unrecorded chats. The two demands meet on one answer: a firm-controlled channel that is encrypted, recorded and easy to use.
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
Attackers breached Rhode Island’s vendor-run benefits system, and the public held the state accountable while the vendor held the systems, logs and investigation. The fix is a contract that settles visibility, decisions, costs and exit before anything goes wrong.
Week of 2 December 2024
The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit
A federal plan to regulate many data brokers like credit bureaus was withdrawn within six months. The question it asked, where did this personal data come from and what may we do with it, now follows every AI program.
Week of 25 November 2024
Blue Yonder put process-running vendors at the top of the risk register
A ransomware attack on Blue Yonder left baristas and warehouse staff waiting on schedules and pay, and exposed a blind spot. Most vendor checks ask who holds your data. The better question is whose failure would stop your work.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The CFPB’s rule let federal examiners into the biggest payment apps, and it lasted under six months. With Synapse’s collapse still fresh, the more lasting exposure lay elsewhere: in the law apps already owed and in the banks holding their customers’ money.
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 deepfake alert read like a checklist for compliance teams. Its harder message was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new authority, incentives and ways to escalate.
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best guide to which obligations would last was not their topic but their legal form: a statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, whether a Medicare patient could see a clinician by video still hinged on three separate authorities, CMS, Congress and the DEA, each with a clock running down in December. Virtual care needed to be run as a yearly cycle.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s open banking rule was final and in court on the same day. Banks could neither wait out the lawsuit nor build blindly, so the smart move was sorting the work by how much each piece would be regretted if the rule fell.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no new rules. Because the CEO and security chief already sign a yearly compliance certification, though, it turned four AI risks into evidence those executives must be able to show.
Week of 7 October 2024
At American Water, containment was the part customers saw
After a cyberattack, America’s largest water utility kept the water flowing, but customers experienced the incident as a billing portal that went dark. For any utility or agency, what the public sees comes down to four decisions, and most can be made in advance.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on ration across the country. Cheap essentials end up made in very few places because low prices reward scale, so hospitals should manage them by how critical they are to care, using four practical levers.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Most continuity plans prepare for losing a building or a computer system. Hurricane Helene took away people, phone and internet service, and the officials who sign off on decisions, across a whole region at once. Each needs its own preparation, years ahead.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas settled with Pieces Technologies by treating an AI tool’s advertised error rate like any other sales claim. Hospital leaders can test such a number on three counts: what it counts, where it was measured, and whether it stays true.
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 explained its reasoning just as federal rules on clinical algorithm transparency were taking hold. A fluent explanation answers the clinician’s question, not the vendor’s or the regulator’s, so health systems still had to supply two other kinds of transparency themselves.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
Europe’s new AI treaty covers AI used by public authorities and by private companies acting on their behalf. So an agency’s duties follow the service into its contractors, and the fuzzy edge of “on their behalf” is where governance gaps will open.
Week of 26 August 2024
Sea-Tac’s handwritten boarding passes were a staffing plan in disguise
Ransomware knocked out Port of Seattle systems, and the airport kept moving on paper and goodwill. “Revert to manual” turns out to be a promise about people: which work has a paper version, who does it, for how long, and who re-keys it afterward.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
One broker’s leaked files tied names, addresses, birth dates and Social Security numbers together. Those facts could still find a customer’s record but no longer prove who was asking, and sign-up, account recovery and risky changes each needed their own fix.