357 articles · page 10 of 18
Articles
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
One patient’s health data can answer to different regulators as it moves from a hospital to a consumer product to an app. The FTC’s May 2023 proposal spelled out where those lines fall, and why sharing with advertisers can count as a breach.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency ended in May 2023, and telehealth’s pandemic flexibilities unwound on schedules set separately by Congress, the DEA, OCR and the states, each landing on a different workforce question: what clinicians may prescribe remotely, where they may practice, which tools they may use.
Week of 1 May 2023
First Republic’s white-glove service had no answer for an uninsured balance
First Republic’s clients stayed loyal until one question took over: was money above the insurance limit safe? In a confidence crisis, good service comes down to three things most banks lacked: seeing each client’s insured position, changing it fast and saying something specific.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no new rules. It simply said existing lending, employment, housing and consumer protection law already reached automated systems, which made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Yet it, and the state laws that followed, assumed a health system could find sensitive details in a record and keep them labeled. Few could.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
A junior IT specialist with a valid top secret clearance shared secrets on Discord. He had the access but no need for the material. Why any organization holding sensitive data should treat access, monitoring and supervision as three separate jobs.
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
With pandemic-era continuous coverage over, states had about a year to recheck Medicaid eligibility for tens of millions of people. Who kept coverage depended less on the rules than on data: renewing people automatically, reaching the rest and processing their replies.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred agencies from using tools that threatened US security or had been misused abroad, which meant the policy would stand or fall on the unglamorous work of agency lawyers, security staff and contracting officers.
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was small as breaches go, but it showed health systems that every staff conversation with an AI assistant is stored data held by a vendor. HIPAA’s familiar questions follow: what goes in, how long it stays, who sees it.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
As banks failed in March 2023, the SEC proposed three cybersecurity measures on a single day, to little notice. Each served a different audience: the regulator, the customer and the market. Only the one protecting customers became law.
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank’s failure looked to most people like a banking story. For the companies that kept their cash there, it was something more familiar: a critical supplier collapsing, taking cash, payments and the services built on them down at once.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case involved a company outside HIPAA, yet it reached every health organization with a website or app. What patients are told at sign-up is a promise, and the tracking tools behind the page must be built to keep it.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
Big banks restricted ChatGPT in 2023 over the headline worry of confidential data slipping out. Contracts fixed that within a year. The slower, harder limits came from duties to keep and supervise records and to explain decisions.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through file-transfer software most health systems saw as mere plumbing. In fact it is a store of sensitive data with its own exposure, retention and accountability, and it deserves the care given to any core system.
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs used a flaw fixed two years earlier, but the damage came from where it struck. Hit the software that runs all your servers, and one break-in can lock every machine, slip past most security tools and reach the backups too.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
Ransomware at ION’s cleared derivatives unit took the same back-office tool away from firms across the market on the same day. The risk sat with a specialist vendor few boards had heard of, and every firm has some.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s covert takedown of the Hive ransomware group spared many victims, hospitals among them, from paying. But it removed one criminal brand. The hired attackers, their methods and the hospital weaknesses they exploited were untouched, and each needed a different response.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
Europe’s DORA gave financial firms two years to get their technology houses in order, with no exemption for contracts already signed. The hardest part was rarely writing policies or running tests. It was the calendar for reopening agreements with technology providers.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s pilot-notice system failed in January 2023, and the easy story was an aging system. The trigger was routine database maintenance that damaged both the main copy and the backup. For agencies running old mission systems, procedure, people and recovery design come first.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
In January 2023, bank regulators warned about crypto. Most readers heard a verdict on whether banks could hold digital assets. The sharper warning concerned risk banks already carried through depositors, partners and customers, which most could not measure from their own data.