354 articles · page 2 of 18
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds valuable customers, the screens that expose them, and the overrides that open doors. Each can be controlled without first catching the insider.
Week of 11 May 2026
Payer prior authorization APIs will only help the providers ready to call them
CMS requires payers to offer prior authorization APIs by January 2027. The benefit lands with health systems that have settled three things first: which system makes the call, whether the chart can answer, and who owns the request.
Week of 4 May 2026
Why a hospital’s accessibility deadline now sits in its vendor contracts
HHS gave hospitals and other funded providers another year to make websites and apps accessible under Section 504. Because most of what patients use online is built or run by vendors, the year is best spent on contracts.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
Spring 2026 research cut estimates of what it would take to break elliptic-curve cryptography. For agencies, that mattered less for encryption than for authentication, where certificates, smart cards and firmware keys take longest to replace.
Week of 20 April 2026
DOJ’s accessibility delay moved one date and put the budget at risk
The one-year delay of the ADA Title II web rule left the standard, the underlying duty and residents’ experience where they were. Its sharpest effect was on budgets that had used April 2026 to justify the work.
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first filing deadline without IRS Direct File showed that ending a public digital service carries obligations of its own: to returning users, to the states that integrated with it, and to the public record.
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
Few banks had access to the model officials warned them about. For most, faster AI-driven discovery would arrive as a surge of fixes from vendors and open-source maintainers, so the constraint was how fast they could absorb patches.
Week of 30 March 2026
What payers’ first prior authorization numbers needed from providers to be useful
The prior authorization metrics payers posted by March 31, 2026 were rates without volumes, averaged across whole books of business. They became useful to a health system only when paired with its own counts, by payer and service.
Week of 23 March 2026
The tool that checked for supply-chain risk was the supply-chain risk
TeamPCP turned a trusted vulnerability scanner into a credential thief and used what it stole to poison an AI gateway library. Exposure depended on three things: which tools held keys, where keys were pooled, and how long stolen keys stayed valid.
Week of 16 March 2026
States could build Medicaid work requirements from the statute before the rule arrived
In spring 2026, states had nine months to implement Medicaid community engagement and no federal rule yet. The safe path was to build what the statute fixed, configure what the rule would decide, and contract for delivery capacity before it ran out.
Week of 9 March 2026
Stryker’s wipe made a supplier’s admin console a hospital supply risk
The attack on Stryker reportedly used the company’s own device-management tools to erase systems, with no ransom and no patient data at stake. It reached hospitals through orders and shipments, which most vendor risk reviews never examine.
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
The cyber warnings after the strikes on Iran named old techniques banks knew how to stop. The harder test was deciding, amid market stress and thin federal support, what to fix first, who could break a change freeze, and what to demand of providers.
Week of 23 February 2026
What a supply chain label on a U.S. AI vendor asked of agencies and contractors
When the administration moved to exclude Anthropic, agencies and contractors could not wait for the courts. The workable response scoped three things: which instrument applied, whom and which contracts it reached, and which uses of the model it covered.
Week of 16 February 2026
Why Part 2’s compliance date reached hospitals that never ran a treatment program
On February 16, 2026, substance use disorder records came under HIPAA-style notice, breach and enforcement machinery run by HHS’s Office for Civil Rights. The obligations followed the records, so general hospitals, health plans and their business associates were in scope.
Week of 9 February 2026
What a second CISA lapse in five months asked state and local security teams to own
The DHS funding lapse that began on February 14 was the second interruption to CISA’s proactive services in five months. For state and local agencies, the question moved from listing federal dependencies to deciding which work to absorb, buy or keep borrowing.
Week of 2 February 2026
Vendors repriced in a day, contracts run for years: the buyer’s side of the software selloff
The February selloff was a bet on software vendors. Regulated buyers faced a different exposure: agreements priced per human seat, locked for years, closed to automated access and hard to leave. Each needed renegotiating before the next renewal.
Week of 26 January 2026
A two-year telehealth runway is long enough to build on and too short to bet on
After one more lapse at the end of January, Congress extended Medicare telehealth flexibilities through 2027 and hospital at home through September 2030. Health systems could finally plan, but only by sorting services according to how long their legal footing lasts.
Week of 19 January 2026
The easiest part of a card rate cap is cutting the rate
The proposed 10% cap on credit card interest had no legal mechanism, and January 20 passed without one. For issuers, the episode showed that the customer and compliance risk of any cap lies in the offsetting changes, not in the rate itself.
Week of 12 January 2026
Patient-directed AI: where HIPAA ends, a provider’s duties change shape
When consumer AI products invited patients to connect their medical records, HIPAA protection ended at the patient’s request. Providers could not block that flow, but they still owed patients a safe pathway, a clean record and accurate context.
Week of 5 January 2026
FDA’s decision support revision handed hospitals a classification question
FDA’s January 6 guidance widened enforcement discretion for some decision support software and wellness wearables, but did not reinterpret the law or address AI directly. Health systems inherited the job of deciding where each tool sits, and keeping it there.