354 articles · page 6 of 18
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best predictor of which obligations would last was the instrument behind them: statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, a Medicare virtual visit still depended on CMS rulemaking, a congressional extension and a DEA rule. What had looked like a post-emergency transition was a standing condition, with all three clocks converging at year-end, best run as a yearly cycle.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s Section 1033 rule was sued the day it was issued. Banks could not wait out the litigation or comply blindly. The workable approach was to split the program into no-regret work, rule-specific work and work hinging on the contested terms.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no requirements. Because Part 500 already demands an annual compliance certification signed by the CEO and CISO, it turned four AI risks into evidence those signers must be able to produce.
Week of 7 October 2024
At American Water, containment was the part customers saw
The largest U.S. water utility kept water flowing after a cyberattack, but switching off its billing portal was the incident as the public experienced it. For utilities and agencies, the customer-facing response is four decisions, and most can be made in advance.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on allocation nationwide. Low-cost essentials concentrate supply because price pressure rewards scale, so health systems need to manage them by clinical criticality, through four levers that spend-based purchasing ignores.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Continuity plans for local agencies are written for the loss of a building or a system. Helene removed people, connectivity and decision authority across a whole region at once, and each of the three needs its own preparation with its own lead time.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas’s settlement with Pieces Technologies applied an old consumer protection statute to a generative AI error rate. Health system buyers can test any such number on three dimensions: what it counts, where it was measured, and how it stays true after updates.
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 narrated its reasoning just as federal rules on decision support transparency were taking hold. A fluent explanation answers a clinician’s question, not the vendor or the regulator’s, and health systems had to supply three different kinds of transparency themselves.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
The Council of Europe convention covers AI used by public authorities and by private actors acting on their behalf. That means an agency’s duties follow the service into its contractors, and the boundary of “on their behalf” is where governance gaps will open.
Week of 26 August 2024
Sea-Tac’s handwritten boarding passes were a staffing plan in disguise
When ransomware took down Port of Seattle systems, the airport kept moving on paper. “Revert to manual” is a promise about people: which work has a paper version, who does it, how long they can sustain it, and who re-keys it afterward.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
Once a single broker dataset linked names, addresses, birth dates and Social Security numbers, those facts could still find a customer’s record but could no longer prove who was asking. Enrollment, recovery and high-risk changes each needed a different fix.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards said what to migrate to. For banks, health systems and agencies, the order of migration is set by how long data must stay secret, which makes the retention schedule the first planning document.
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
On August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat in the pre-trade path, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could prove it had contained the attack on its systems. It could not yet prove what the stolen data held or whom it exposed. Each claim needs its own evidence, and borrowing from the first to answer the second costs trust.
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4’s account of hiring a North Korean IT worker showed a scheme built to pass four hand-offs, each owned by a different team. Controls work when one identity is carried from interview to offer, onboarding, device and daily work.
Week of 15 July 2024
Channel File 291 measured every recovery plan in hands per device
The faulty CrowdStrike update turned remotely managed Windows estates into a field-service job. Recovery speed came down to three constraints most plans never modeled: access to recovery secrets, people at keyboards, and the order of repair.
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
Patelco’s members met its ransomware attack as four questions: can I use my money, what happened to my data, how do I get back in, who pays. Each answer was largely fixed by design and policy choices made long before June 2024.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
Four Supreme Court decisions in five days ended deference on statutory meaning, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
Hospital script reviews were built after 2022 to stop patient data leaving through tracking tags. Polyfill.io showed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it takes checks on the source, the content and the response.