58 articles · Regulation & Compliance · page 3 of 3
Articles
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, the test became: could a hospital show a surveyor everyone who counted as staff, including contractors, students and practitioners it didn’t employ? Few had a single list that reached past the payroll.
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
In January 2022 the FTC told companies that leaving Log4j unfixed could break the law. Regulators judge “reasonable” security after the fact, from records, so the work that counted most was writing down the response as it happened.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
In October 2021 the FTC gave mortgage brokers, auto dealers, finance companies and tax preparers specific, bank-style security rules. The bigger shift was who answers for them: one named person, a written report to the board, and proof the program works.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
In September 2021 the FTC said a health app that shares users’ data without permission has suffered a breach. That moved breach prevention out of the security team and into three business decisions: what code ships, what partners receive, what users agreed to.
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
In August 2021, the Senate fought over who should count as a crypto “broker.” Banks and brokerages were clearly in. Their real problem was three kinds of data they did not have: what customers paid, where assets had been, and who sent them.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
Less than three weeks after Colonial Pipeline, regulators gave critical pipelines twelve hours to report a cyber incident, a named coordinator on call around the clock and thirty days to grade themselves. All three ideas spread across sectors, and each needs different preparation.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted the AI in banks, hospitals and agencies by business process, so compliance belonged to process owners as much as to data scientists.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
The federal ban on information blocking took effect on April 5, 2021, and health systems found that compliance was decided less by policy than by portal settings and records queues. Three questions mattered: what gets released, when, and how withholding is defended.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
In March 2021, five federal agencies asked banks and credit unions how they use AI. No new rule followed. But the questions mapped onto four tests existing rules already imposed, and those tests still frame how supervisors look at any model.
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who really owns companies. The register was later cut back, the bank’s own duty to know its customers stayed, and a new whistleblower channel changed who could report weak programs.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator devoted to privacy. Banks and health systems that assumed federal law exempted them learned that California exempts certain data, not whole institutions, and that everything else needs real operational plumbing.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and to the firms that help them pay, which moved the decision out of the crisis room and into a governed, documented compliance process.
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked what an effective anti-money laundering program really is, and leaked reports showed banks filing dutifully while flagged money kept moving. The gap between filing, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
On June 30, 2020, brokers became bound to act in their retail customers’ best interest. Writing the plain-language summary, Form CRS, was the manageable part. Proving each recommendation met the standard, and that conflicts were controlled, took data most firms never captured.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one big question for bank-fintech lending. Two harder ones remained: who is really the lender, and can the bank prove it is in charge?
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
On March 30, 2020, Medicare’s waivers let care move into tents, surgery centers, new hands and video screens. Every claim and medical record still had to say where, by whom and how, and the systems recording those facts assumed the old answers.
Week of 2 March 2020
Why the FFIEC’s pandemic statement was an evidence checklist
On March 6, 2020, bank regulators restated pandemic expectations dating from the avian flu era. The statement’s real value lay in what examiners would later ask to see: staged decisions, critical work done with fewer people, and suppliers coping with the same disruption.
Week of 27 January 2020
A 90-day declaration that ran for three years
The federal public health emergency declared on January 31, 2020, looked like a precaution. Then other powers, new laws and agency systems came to rest on it. Agencies needed to track what depended on it from day one, not when it ended.