58 articles · Regulation & Compliance · page 2 of 3
Articles
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments promised customers breach notice within 30 days and required service providers to warn firms within 72 hours. For brokers and advisers whose client data lives mostly with vendors, that second clock decides how well the first one works.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of why they wanted certain records. That moved paperwork onto requesters, but left hospitals with judgments no form could make, under a rule a court struck down in 2025.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and insurers that receive addiction treatment records handle them much like other health data. The treatment programs that create those records, and the legal teams that answer subpoenas, ended up carrying more obligation than before.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s first standards, published in January 2024, turned the question of when a tech outage is serious enough to report into a calculation over clients, transactions, downtime, data and cost. Banks that couldn’t feed the numbers couldn’t classify in time.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
In December 2023, HHS sketched a cybersecurity baseline for hospitals, two ways to make it binding and incentives that needed Congress. Rules could arrive on the agency’s own timetable; the money could not. Hospitals had to plan for that gap.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
In November 2023 a ransomware gang reported its own victim, MeridianLink, to the SEC. The vendor’s bank and credit union customers then faced their own notification deadlines with little more than an attacker’s boast and a vendor statement to go on.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The SEC’s private fund adviser rules, adopted in August 2023, were struck down ten months later. Firms that sorted the work into what investors would demand, what existing law already required and what only the rule required wasted very little.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
In July 2023 the SEC gave public companies four business days to disclose a material cyber incident, counted from when they decide it is material. So the decision itself needs governing: who makes it, what record it leaves, how it fits other deadlines.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
In one week, Colorado and Connecticut switched on their privacy laws and a California court paused new rules a day before enforcement. When deadlines move like that, the steadier approach is to build four lasting capabilities and map each new law onto them.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
One patient’s health data can answer to different regulators as it moves from a hospital to a consumer product to an app. The FTC’s May 2023 proposal spelled out where those lines fall, and why sharing with advertisers can count as a breach.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no new rules. It simply said existing lending, employment, housing and consumer protection law already reached automated systems, which made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
As banks failed in March 2023, the SEC proposed three cybersecurity measures on a single day, to little notice. Each served a different audience: the regulator, the customer and the market. Only the one protecting customers became law.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
In January 2023, bank regulators warned about crypto. Most readers heard a verdict on whether banks could hold digital assets. The sharper warning concerned risk banks already carried through depositors, partners and customers, which most could not measure from their own data.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking code created no new rule. What it exposed was a gap in who was in charge: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls protecting every other system holding patient data.
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
An appeals court’s 2022 ruling that the consumer bureau’s funding was unconstitutional put a question mark over every CFPB rule for eighteen months. The sensible response was sorting: past orders, current rules and pending rules each carried a different kind of risk.
Week of 8 August 2022
Tornado Cash and the transfers nobody asked for
Treasury’s sanctions on Tornado Cash targeted software, not a person. Forbidden money could land in anyone’s wallet uninvited, the usual parties to screen did not exist, and the rule itself was soon under legal attack. Banks had to comply anyway.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking down ambitious rules. That turned a rule’s survival into something agencies and regulated organizations must estimate: in writing new rules, defending existing programs and deciding when to spend on compliance.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
The CFPB dusted off a rarely used power to supervise nonbanks whose conduct puts consumers at risk, and exam readiness stopped being a problem for later. Fintechs had to build it before they scaled, and their sponsor banks had to check it.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 set two deadlines in statute and left who is covered to a rulemaking that would take years. The decisions those deadlines force, inside a hospital’s incident command, never depended on the rule’s details.
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day clock on reporting cyber incidents. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and those words would become a standard others could test.