40 articles
January 2026
Week of 5 January 2026
FDA’s decision support revision handed hospitals a classification question
FDA’s January 6 guidance widened enforcement discretion for some decision support software and wellness wearables, but did not reinterpret the law or address AI directly. Health systems inherited the job of deciding where each tool sits, and keeping it there.
Week of 12 January 2026
Patient-directed AI: where HIPAA ends, a provider’s duties change shape
When consumer AI products invited patients to connect their medical records, HIPAA protection ended at the patient’s request. Providers could not block that flow, but they still owed patients a safe pathway, a clean record and accurate context.
Week of 19 January 2026
The easiest part of a card rate cap is cutting the rate
The proposed 10% cap on credit card interest had no legal mechanism, and January 20 passed without one. For issuers, the episode showed that the customer and compliance risk of any cap lies in the offsetting changes, not in the rate itself.
Week of 26 January 2026
A two-year telehealth runway is long enough to build on and too short to bet on
After one more lapse at the end of January, Congress extended Medicare telehealth flexibilities through 2027 and hospital at home through September 2030. Health systems could finally plan, but only by sorting services according to how long their legal footing lasts.
February 2026
Week of 2 February 2026
Vendors repriced in a day, contracts run for years: the buyer’s side of the software selloff
The February selloff was a bet on software vendors. Regulated buyers faced a different exposure: agreements priced per human seat, locked for years, closed to automated access and hard to leave. Each needed renegotiating before the next renewal.
Week of 9 February 2026
What a second CISA lapse in five months asked state and local security teams to own
The DHS funding lapse that began on February 14 was the second interruption to CISA’s proactive services in five months. For state and local agencies, the question moved from listing federal dependencies to deciding which work to absorb, buy or keep borrowing.
Week of 16 February 2026
Why Part 2’s compliance date reached hospitals that never ran a treatment program
On February 16, 2026, substance use disorder records came under HIPAA-style notice, breach and enforcement machinery run by HHS’s Office for Civil Rights. The obligations followed the records, so general hospitals, health plans and their business associates were in scope.
Week of 23 February 2026
What a supply chain label on a U.S. AI vendor asked of agencies and contractors
When the administration moved to exclude Anthropic, agencies and contractors could not wait for the courts. The workable response scoped three things: which instrument applied, whom and which contracts it reached, and which uses of the model it covered.
March 2026
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
The cyber warnings after the strikes on Iran named old techniques banks knew how to stop. The harder test was deciding, amid market stress and thin federal support, what to fix first, who could break a change freeze, and what to demand of providers.
Week of 9 March 2026
Stryker’s wipe made a supplier’s admin console a hospital supply risk
The attack on Stryker reportedly used the company’s own device-management tools to erase systems, with no ransom and no patient data at stake. It reached hospitals through orders and shipments, which most vendor risk reviews never examine.
Week of 16 March 2026
States could build Medicaid work requirements from the statute before the rule arrived
In spring 2026, states had nine months to implement Medicaid community engagement and no federal rule yet. The safe path was to build what the statute fixed, configure what the rule would decide, and contract for delivery capacity before it ran out.
Week of 23 March 2026
The tool that checked for supply-chain risk was the supply-chain risk
TeamPCP turned a trusted vulnerability scanner into a credential thief and used what it stole to poison an AI gateway library. Exposure depended on three things: which tools held keys, where keys were pooled, and how long stolen keys stayed valid.
Week of 30 March 2026
What payers’ first prior authorization numbers needed from providers to be useful
The prior authorization metrics payers posted by March 31, 2026 were rates without volumes, averaged across whole books of business. They became useful to a health system only when paired with its own counts, by payer and service.
April 2026
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
Few banks had access to the model officials warned them about. For most, faster AI-driven discovery would arrive as a surge of fixes from vendors and open-source maintainers, so the constraint was how fast they could absorb patches.
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first filing deadline without IRS Direct File showed that ending a public digital service carries obligations of its own: to returning users, to the states that integrated with it, and to the public record.
Week of 20 April 2026
DOJ’s accessibility delay moved one date and put the budget at risk
The one-year delay of the ADA Title II web rule left the standard, the underlying duty and residents’ experience where they were. Its sharpest effect was on budgets that had used April 2026 to justify the work.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
Spring 2026 research cut estimates of what it would take to break elliptic-curve cryptography. For agencies, that mattered less for encryption than for authentication, where certificates, smart cards and firmware keys take longest to replace.
May 2026
Week of 4 May 2026
Why a hospital’s accessibility deadline now sits in its vendor contracts
HHS gave hospitals and other funded providers another year to make websites and apps accessible under Section 504. Because most of what patients use online is built or run by vendors, the year is best spent on contracts.
Week of 11 May 2026
Payer prior authorization APIs will only help the providers ready to call them
CMS requires payers to offer prior authorization APIs by January 2027. The benefit lands with health systems that have settled three things first: which system makes the call, whether the chart can answer, and who owns the request.
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds valuable customers, the screens that expose them, and the overrides that open doors. Each can be controlled without first catching the insider.
Week of 25 May 2026
Faster settlement, longer nights: what two years of T+1 tell Europe’s operations desks
The US move to one-day settlement held because firms automated trade-date matching and redesigned who works when. Europe and the UK move in October 2027, and the shift pattern and funding model will be harder to build than the software.
June 2026
Week of 1 June 2026
For a small adviser, Regulation S-P compliance is bought before the breach
When amended Regulation S-P reached smaller advisers and broker-dealers on June 3, 2026, most of them had no in-house incident team. For them, compliance is a set of purchases made in advance: response capacity, evidence and the means to notify.
Week of 8 June 2026
Why World Cup cyber risk sat in the city services residents use every day
Stadiums had federal, state and venue security teams. The exposure host-city agencies owned was in the services around them: resident and visitor channels, transit and traffic systems, 911 and dispatch, and vendors shared across jurisdictions.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed its cutoff for client authentication in public TLS certificates to March 2027, but certificate authorities kept their own earlier schedules. For any mutual TLS link, the deadline that counts is the one set by whoever issues the certificate.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have learned that conformance decays with every release, template change and vendor update. The durable answer is a running body of evidence across four parts of the service.
Week of 29 June 2026
July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week
The annual residency changeover is the largest identity event a US teaching hospital runs. Joiners, movers, leavers and the supervision record each fail differently, and each needs its own control and measure.
July 2026
Week of 6 July 2026
Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both
CMS’s June 2026 rule tied the medically frail exemption from Medicaid work requirements to the past year’s coded diagnoses plus evidence that the condition impairs work. Coding, certification workflows and data sharing now help decide who keeps coverage.
Week of 13 July 2026
Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate
A year after Fedwire moved to ISO 20022, the structured message reached most US banks intact. Its value did not, because data was lost at origination, inside banks’ own systems, or in screening and fraud tools never set up to use it.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 rulemaking deadline, but the law’s January 2027 backstop date did not move. Banks could not wait for final text to decide which role to play, and the funding question cut across every choice.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still contested. Providers bound by it now need their own record of decisions, documentation and appeals, because that record serves both daily operations and the policy fight.
August 2026
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU deferred high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on schedule. For banks, insurers, hospitals and agencies serving Europeans, the work sits in interface design, content pipelines and publishing sign-off.
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Signatures had moved up the post-quantum queue, but two years after NIST’s first standards the choice of signature scheme was still open. Organizations should sort signatures by how long they must stay verifiable, and design each tier for a second change.
Week of 17 August 2026
The dollar AI deals ended in a meter, and meters need ceilings
Six weeks before GSA’s nominal-price AI offers expired, agencies had no successor terms. Usage pricing was the likely replacement, which moves the hard decisions to budget execution: how to fund a meter, who runs it, and how to keep alternatives.
Week of 24 August 2026
Health systems inherit the patients that IAL2 proofing turns away
A year after NIST’s identity rewrite and CMS’s interoperability pledge, verified credentials were starting to open patient records across networks. Patients who cannot obtain one still depend on their health system, which needs designed routes for in-house proofing and vouching.
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
The OCC and FDIC limited matters requiring attention to material financial harm, a year after the FFIEC retired its common cyber assessment. Many cyber weaknesses will now reach banks as informal observations, so banks must set their own escalation rules.
September 2026
Week of 7 September 2026
Europe’s 24-hour vulnerability clock reports to regulators first and customers second
From September 11, 2026, the Cyber Resilience Act required manufacturers to warn EU authorities of exploited flaws within 24 hours. Customers were owed notice too, but on no fixed clock, so buyers still need their own intake.
Week of 14 September 2026
Hospital device data rights arrive one purchase order at a time
The EU Data Act’s access-by-design rule, live from September 12, 2026, reaches only equipment placed on the market from that date. For hospitals with decade-long replacement cycles, tenders carry the new right while the installed base runs on requests.
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
The first full-term 200-day TLS certificates expired on October 1, 2026, the first day of the federal fiscal year. Agencies that bought, staffed and scheduled certificates on an annual rhythm had to rebuild all three around renewals that no longer fit one.
Week of 28 September 2026
Paused, not repealed: what CMMC’s suspension left defense contractors paying for
With third-party CMMC certification suspended and no new schedule six weeks before the old November date, contractors faced a budgeting problem. Some security spending was still owed, some could wait, and some had simply changed price.