357 articles · page 16 of 18
Articles
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached government agencies through an aging file transfer appliance few senior officials could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern kept returning through other products for years.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
Retail brokers stopped customers buying GameStop on January 28, 2021, for reasons buried deep in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app work as one system, even though three different teams own them.
Week of 18 January 2021
Vaccine access hinged on open appointments nobody could see
Vaccine eligibility widened in January 2021 faster than states could show where doses were. Booking failed less because of web traffic than because of three ownership gaps: eligibility rules, appointments held in partners’ systems, and phone and community help treated as overflow.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
On paper, the banking agencies’ proposed incident notification rule was a simple deadline. The harder work came before the clock started: a named person deciding what counts as a material disruption, and vendor warnings that reach that person in time.
Week of 4 January 2021
Credit for security practice, payable only in arrears
Signed on January 5, 2021, a short HITECH amendment told regulators to go easier on breached organizations with recognized security practices. The catch: it takes a year of practice already running, so the credit is earned only before an incident, with everyday evidence.
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who really owns companies. The register was later cut back, the bank’s own duty to know its customers stayed, and a new whistleblower channel changed who could report weak programs.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
Written to protect patients from shock medical bills, the No Surprises Act made a patient’s financial experience depend on four handoffs of information between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The SolarWinds Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are harmless plumbing, and that federal sensors would spot a national-scale intrusion. Only the second was quick to fix.
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 plan to speed up patients’ access to their own records stalled. It still pinpointed where access breaks down: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule to fix.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for device makers. Instead it set rules for one very large customer, the federal government, pushed security duties onto its contractors, and exposed an old problem: you cannot secure devices you do not know you own.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition squeezed a huge handover of people and their system access, records and accounts, and programs already running. Each needs its own playbook, written by career staff long before any election.
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
In November 2020, regulators finally let hospitals give cybersecurity to the small physician practices around them, free of charge. A legal barrier fell overnight. Whether anyone was actually safer depended on budgets, staffing and who would run the tools year after year.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. For public agencies the hardest constraint was data: matching people without a national ID, agreeing who could see records, and connecting hundreds of new sources in weeks.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator devoted to privacy. Banks and health systems that assumed federal law exempted them learned that California exempts certain data, not whole institutions, and that everything else needs real operational plumbing.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
A 2020 rule forced health plans to publish the prices they negotiate, but not to make them usable. Whether the files were worth anything came down to three problems the rule left to plans, employers and intermediaries: sheer volume, unclear meaning and accountability.
Week of 19 October 2020
Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s case against Google opened a long fight over platform power. It offered regulated buyers no relief on their own dependence on vendors, which is settled in contracts, system design and tested exit plans, far faster than any court moves.
Week of 12 October 2020
Why one phone call beat Twitter’s login controls
No clever code, no exotic exploit. New York’s report on the Twitter hack traced it to a phone call and a fake login page. The people who verify callers and reset logins turned out to be a security control few had designed or measured.
Week of 5 October 2020
Citi’s orders put data lineage on the safety and soundness agenda
The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from, and who answers for them.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and to the firms that help them pay, which moved the decision out of the crisis room and into a governed, documented compliance process.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
Universal Health Services lost systems across its network in September 2020. The downtime binder mattered less than a human question: could staff trained on electronic records run a unit on paper for days, and then put it all back?