46 articles · Data & AI · page 2 of 3
Articles
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance told agencies that AI affecting people’s rights or safety must meet minimum practices by a deadline or be switched off. The hardest cases were systems already running, many hidden inside vendor products.
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers walked into a sliver of 23andMe accounts and, through a feature that connects relatives, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change hands.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 AI Act vote made headlines for generative AI. For banks, health systems and agencies, the lasting point was simpler: duties depend on whether you build an AI system, use one, or build on a general-purpose model. Many do all three.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Yet it, and the state laws that followed, assumed a health system could find sensitive details in a record and keep them labeled. Few could.
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was small as breaches go, but it showed health systems that every staff conversation with an AI assistant is stored data held by a vendor. HIPAA’s familiar questions follow: what goes in, how long it stays, who sees it.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
Big banks restricted ChatGPT in 2023 over the headline worry of confidential data slipping out. Contracts fixed that within a year. The slower, harder limits came from duties to keep and supervise records and to explain decisions.
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
In 2022 the White House published five principles for fair, safe AI. They sounded new, but hospitals already practiced most of them under other names. Extending trusted clinical committees to algorithms worked better than building a separate AI bureaucracy.
Week of 18 July 2022
Necessary and proportionate: the ADPPA test that outlived the bill
A federal privacy bill cleared committee 53 to 2 and then stalled before a floor vote. Its central idea, collect only what you genuinely need, outlived it, and banks and hospitals were more exposed to that idea than their sector exemptions suggested.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went first to medical records, where HIPAA already set rules. The bigger exposure for health systems lay at their own digital edges, and in consumer data they never held but patients assumed was protected.
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal. For any single agency system, though, the real deadline comes sooner: how long its data must stay secret, plus how long fixing it will take, measured against when a code-breaking machine might exist.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
From late February 2022, sanctions on Russia arrived in fast waves, from several governments, against sprawling corporate groups. Checking names against lists caught the obvious cases. The real exposure hid in unnamed subsidiaries, changing dates and differing national rules: all data problems.
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 all the way to a $3.6 billion seizure in 2022, because the ledger never forgets. The decisive links sat at regulated firms, so banks need records of crypto-linked activity that still make sense years later.
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
In October 2021, FinCEN used banks’ suspicious activity reports to sketch the money trail behind ransomware. It worked only where filers had recorded details like wallet addresses clearly. That same choice decides how useful the data is inside the bank.
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
In June 2021 the Supreme Court narrowed who can sue over inaccurate credit file flags. Underneath was a matching failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
In June 2021 the Supreme Court decided that looking up records you are allowed to reach, for a bad reason, is generally not a federal computer crime. For agencies holding sensitive records, protection now rests on controls they own: access design, query monitoring and consequences.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 deal for Nuance put software that listens to doctor visits inside a giant cloud platform. For health systems, the decisions that mattered concerned the recording itself, who checks the draft note, and the contract governing both.
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of bets hidden across many banks. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. For public agencies the hardest constraint was data: matching people without a national ID, agreeing who could see records, and connecting hundreds of new sources in weeks.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
A 2020 rule forced health plans to publish the prices they negotiate, but not to make them usable. Whether the files were worth anything came down to three problems the rule left to plans, employers and intermediaries: sheer volume, unclear meaning and accountability.
Week of 5 October 2020
Citi’s orders put data lineage on the safety and soundness agenda
The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from, and who answers for them.