Customer & Citizen Experience
Insights seen through customer & citizen experience, across every sector.
43 articles · Customer & Citizen Experience · page 1 of 3
Articles
Week of 24 August 2026
Health systems inherit the patients that IAL2 proofing turns away
Verified digital credentials were starting to unlock patient records across networks. For most people that is a welcome shortcut. Patients who cannot get one still depend on their health system, which needs deliberate routes for checking identity in-house and through people who vouch.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have found that accessibility wears away with every release, new template and vendor update. What lasts is a steady, running record of evidence across four parts of the service.
Week of 4 May 2026
Why a hospital’s accessibility deadline now sits in its vendor contracts
Federal health regulators gave hospitals and other funded providers one more year to make their websites and apps usable by people with disabilities. Since vendors build most of what patients touch online, the smartest use of that year is the contract file.
Week of 20 April 2026
DOJ’s accessibility delay moved one date and put the budget at risk
The Justice Department pushed back its web accessibility deadline by a year, but the standard, the legal duty and residents’ experience stayed exactly where they were. The real risk was to budgets that had leaned on April 2026 to justify the work.
Week of 19 January 2026
The easiest part of a card rate cap is cutting the rate
A late-night post proposed capping credit card interest at 10%, but no legal mechanism existed and January 20 came and went. For card issuers, cutting a rate is the easy part; the risk lives in everything a bank changes to make up for it.
Week of 12 January 2026
Patient-directed AI: where HIPAA ends, a provider’s duties change shape
In January 2026, two major AI companies invited patients to connect their medical records. Nothing in the law changed, but providers’ duties changed shape: what they cannot block, what they still control, and what they owe patients who arrive with an AI’s answer.
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP food benefits within days. The systems that calculate, load and explain those benefits were built for paying in full or not at all, and paying less proved hardest.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
In July 2025, more than 60 organizations promised patients their medical records in the apps they choose. The data pipes mostly existed. Whether it works for a real patient depends on the registration desk: proving identity, matching records, and handling consent and proxies.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of ransomware knocking Kettering Health offline in May 2025, criminals were phoning its patients for card payments. Talking to patients during an outage is a security control, and it has to be built before the attack.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
The Iberian grid failed in April 2025 and bank systems largely held, yet customers still could not pay for groceries. Payment resilience lives at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The CFPB was told to stop work in February 2025, but consumer law stayed the same. What vanished were three outside nudges firms relied on: exam deadlines, published lessons from peers and federal follow-up on complaints. Each had to be rebuilt in-house.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, whether a Medicare patient could see a clinician by video still hinged on three separate authorities, CMS, Congress and the DEA, each with a clock running down in December. Virtual care needed to be run as a yearly cycle.
Week of 7 October 2024
At American Water, containment was the part customers saw
After a cyberattack, America’s largest water utility kept the water flowing, but customers experienced the incident as a billing portal that went dark. For any utility or agency, what the public sees comes down to four decisions, and most can be made in advance.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
One broker’s leaked files tied names, addresses, birth dates and Social Security numbers together. Those facts could still find a customer’s record but no longer prove who was asking, and sign-up, account recovery and risky changes each needed their own fix.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could show early that it had contained the attack on its systems. It could not yet show what the stolen data held or whose it was. Each claim needs its own evidence, and borrowing confidence from one to answer the other costs trust.
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
When ransomware took Patelco’s digital banking offline, members asked four simple questions: can I use my money, what happened to my data, how do I get back in, and who pays. Most of the answers had been decided years earlier.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
After 2022, hospitals built script reviews to stop patient data leaking out through tracking tags. Polyfill.io exposed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it means checking the source, the content and the response.
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never became law. Its most distinctive idea, letting individuals act directly through requests, automatic opt-out signals and lawsuits, is arriving anyway through the states, and that is where privacy programs are now judged.
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
On January 1, 2024, FinCEN opened beneficial ownership filing to tens of millions of small companies while the law faced a constitutional challenge. A public obligation at that scale has four design problems, and the last one, how it shrinks, is rarely planned.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came not from its clinical systems but from storage used to format patient emails. Outreach data looks harmless field by field, yet together it is protected health information and deserves the same care as the medical record.