99 articles · Healthcare · page 2 of 5
Articles
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
In May 2025 a nation-state intrusion hit ConnectWise, a maker of remote access software that sits two contracts away from most physician practices. Their IT services and business associate agreements are their only real controls, and most say too little.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of ransomware knocking Kettering Health offline in May 2025, criminals were phoning its patients for card payments. Talking to patients during an outage is a security control, and it has to be built before the attack.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe filed for Chapter 11, its privacy promises stopped being fine print and became a condition that courts, states and bidders had to put a price on. Anyone holding or sharing health-related data should write contracts with that ending in mind.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa warning read like a shopping list of the remote-access tools hospitals and clinics rely on every day. Stopping attacks like it means governing those tools at three moments: getting in, moving around and switching off defenses.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By dropping the Richardson Waiver, HHS stopped asking for public comment where the law did not require it. The lost warning fell unevenly: hardest on grant recipients, less on contractors and least on Medicare providers, whose own statute still requires comment.
Week of 24 February 2025
The House budget vote signaled Medicaid churn, a cost hospitals pay at the front desk
A narrow February 2025 House vote set Medicaid on the path to big changes. Beyond lost revenue, more frequent eligibility checks and work requirements would make it costlier to know who is covered, at the front desk, in enrollment help and in billing.
Week of 6 January 2025
Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs
FDA’s January 2025 draft on AI devices, read with its December change-control guidance, assumes the software keeps changing after a hospital buys it. Three kinds of change follow: pre-approved updates, updates needing fresh review, and shifts in the hospital itself.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS proposed turning HIPAA’s flexible security safeguards into firm requirements. Most were controls hospitals already had or paperwork they could build. One was different: being able to restore key systems within 72 hours, which needed clinical planning, tested capacity and real money.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, whether a Medicare patient could see a clinician by video still hinged on three separate authorities, CMS, Congress and the DEA, each with a clock running down in December. Virtual care needed to be run as a yearly cycle.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on ration across the country. Cheap essentials end up made in very few places because low prices reward scale, so hospitals should manage them by how critical they are to care, using four practical levers.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas settled with Pieces Technologies by treating an AI tool’s advertised error rate like any other sales claim. Hospital leaders can test such a number on three counts: what it counts, where it was measured, and whether it stays true.
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 explained its reasoning just as federal rules on clinical algorithm transparency were taking hold. A fluent explanation answers the clinician’s question, not the vendor’s or the regulator’s, so health systems still had to supply two other kinds of transparency themselves.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
After 2022, hospitals built script reviews to stop patient data leaking out through tracking tags. Polyfill.io exposed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it means checking the source, the content and the response.
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
Ransomware at Synnovis showed south-east London what consolidating pathology really costs. Pooling a region’s labs into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. No contract, budget or insurance policy carried the loss.
Week of 6 May 2024
Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
In a big health system, hospitals cover for each other with beds, staff and shared services. When ransomware knocked out Ascension’s shared platforms across its markets, that safety net failed everywhere at once, and help had to come from outside.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal with no second login check, about sixteen months after the deal closed. For health care buyers, inherited internet-facing doors belong in the deal terms, the first weeks after closing and the boardroom.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of why they wanted certain records. That moved paperwork onto requesters, but left hospitals with judgments no form could make, under a rule a court struck down in 2025.
Week of 4 March 2024
Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage
Two weeks into the Change Healthcare outage, the federal response was about money. For providers that were never hacked, survival came down to three questions: how long could they last, who would lend to them, and who would finally pay for the loss.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
Ransomware at the largest US claims clearinghouse left every connected hospital, practice and pharmacy with a hard call, fast. Pulling the plug was easy. Knowing what to unplug, and what proof to demand before plugging back in, took homework few had done.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and insurers that receive addiction treatment records handle them much like other health data. The treatment programs that create those records, and the legal teams that answer subpoenas, ended up carrying more obligation than before.