Insights · Looking Back

Data & AI

The Looking Back articles seen through data & ai, across every sector, in order.

46 articles

March 2020

  1. Week of 9 March 2020

    Interoperability rules sent patient data beyond HIPAA’s reach

    The ONC and CMS rules of March 9, 2020, prohibited information blocking and required standardized patient APIs. Together they moved patient data, at patients’ direction, into apps HIPAA does not cover, so health systems had to govern flows they could no longer refuse.

    • Healthcare
    • Data & AI
    • 5 min read

April 2020

  1. Week of 13 April 2020

    Why exposure notification apps rose or fell on the back office

    Apple and Google’s framework settled the privacy design of exposure notification for health agencies. Whether an app helped depended on what agencies controlled: test verification codes, the advice an alert triggered, and the effort put into adoption.

    • Government
    • Data & AI
    • 5 min read

May 2020

  1. Week of 18 May 2020

    Small-dollar loans, alternative data and the governance attached

    The May 2020 interagency principles invited banks and credit unions back into small-dollar lending and accepted new data and technology in underwriting. Using cash-flow data responsibly required three disciplines: consented data access, model risk management and fair lending controls for automated decisions.

    • Financial Services
    • Data & AI
    • 5 min read

June 2020

  1. Week of 8 June 2020

    When vendors set facial recognition policy before agencies did

    IBM, Amazon and Microsoft stepped back from selling facial recognition to police within days in June 2020. Agencies discovered that suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.

    • Government
    • Data & AI
    • 5 min read

July 2020

  1. Week of 6 July 2020

    Why hospital COVID reporting turned out to be infrastructure

    In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and report through a new HHS pathway. The switch showed that reporting depends on definitions, pipelines and governance, and that hospitals relying on manual counts paid for every change.

    • Healthcare
    • Data & AI
    • 5 min read

August 2020

  1. Week of 31 August 2020

    Blackbaud’s breach exposed patient data that fundraising never needed

    The Blackbaud ransomware incident reached health systems through their foundations. It showed that philanthropy databases held more patient information, for longer, than HIPAA’s fundraising permission required, and that minimization is the control that still works after the others fail.

    • Healthcare
    • Data & AI
    • 5 min read

October 2020

  1. Week of 5 October 2020

    Citi’s orders put data lineage on the safety and soundness agenda

    The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from and who answers for them.

    • Financial Services
    • Data & AI
    • 5 min read

  2. Week of 26 October 2020

    Price transparency files: mandated, massive and hard to read

    The Transparency in Coverage rule mandated publication of negotiated rates, not their usability. Whether the files were worth anything depended on volume, meaning and accountability, three engineering and governance problems the rule left to plans, employers and intermediaries.

    • Healthcare
    • Data & AI
    • 5 min read

November 2020

  1. Week of 9 November 2020

    Who may see the vaccination record: the negotiation behind the rollout

    The first strong COVID-19 vaccine result turned a scientific question into a logistics one. The hardest constraint for public agencies was data: matching people without a national identifier, agreeing who could see records, and onboarding hundreds of new sources in weeks.

    • Government
    • Data & AI
    • 5 min read

March 2021

  1. Week of 22 March 2021

    Each Archegos lender already held enough data to act

    Archegos is usually told as a story of positions hidden across many prime brokers. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.

    • Financial Services
    • Data & AI
    • 5 min read

April 2021

  1. Week of 12 April 2021

    Microsoft and Nuance: the recording is the asset to govern

    Microsoft’s April 2021 agreement to buy Nuance put ambient clinical documentation inside a large cloud platform. For health systems, the decisions that mattered concerned the encounter recording itself, the review workflow around the draft note, and the contract governing both.

    • Healthcare
    • Data & AI
    • 5 min read

May 2021

  1. Week of 31 May 2021

    After Van Buren, insider snooping is an access design problem

    The Supreme Court’s June 2021 Van Buren decision took most purpose-based insider misuse out of the federal computer crime law. For agencies holding sensitive records, deterrence now rests on three controls they own: access design, query monitoring and consequences.

    • Government
    • Data & AI
    • 5 min read

June 2021

  1. Week of 21 June 2021

    TransUnion won Ramirez, and name-only matching still lost

    The Supreme Court’s June 2021 ruling narrowed who can sue over inaccurate credit file flags. The facts underneath were an entity resolution failure that banks and fintechs share, and the ruling changed none of the three things that govern it.

    • Financial Services
    • Data & AI
    • 5 min read

October 2021

  1. Week of 11 October 2021

    FinCEN’s ransomware analysis turned well-written SARs into threat intelligence

    FinCEN’s October 2021 trend analysis showed that suspicious activity reports can map a criminal economy, but only when filers record cyber indicators in usable form. That choice, made at the investigator’s desk, decides the data’s value inside the bank too.

    • Financial Services
    • Data & AI
    • 5 min read

February 2022

  1. Week of 7 February 2022

    Bitfinex’s six-year trace ran through records that banks keep

    Investigators followed bitcoin stolen in 2016 to a $3.6 billion seizure in 2022 because the ledger never forgets. The decisive links sat at regulated firms, so banks’ own records of crypto-linked activity need to be built to be read years later.

    • Financial Services
    • Data & AI
    • 5 min read

  2. Week of 28 February 2022

    Russia’s sanctions tested banks’ ownership data more than their name lists

    The sanctions on Russia from late February 2022 came in fast waves, from several governments, against sprawling corporate groups. Screening names against lists caught the obvious cases. Exposure sat in unnamed subsidiaries, effective dates and jurisdiction-specific rules, all of them data problems.

    • Financial Services
    • Data & AI
    • 5 min read

May 2022

  1. Week of 2 May 2022

    Quantum risk is dated by how long your data must stay secret

    NSM-10 set 2035 as a national goal, but for any given agency system the effective deadline is earlier: how long its data must stay confidential, plus how long migration will take, measured against when a capable machine might exist.

    • Government
    • Data & AI
    • 5 min read

June 2022

  1. Week of 20 June 2022

    Dobbs moved health privacy risk outside the medical record

    After the Supreme Court’s abortion decision, attention went to medical records, where HIPAA already set rules. The larger exposure for health systems sat at their own digital edges and in consumer data they never held but patients assumed was protected.

    • Healthcare
    • Data & AI
    • 5 min read

July 2022

  1. Week of 18 July 2022

    Necessary and proportionate: the ADPPA test that outlived the bill

    The federal privacy bill that cleared committee 53 to 2 never reached the floor. Its minimization test did outlast it, and banks and hospitals were more exposed to that test than their sector carve-outs suggested.

    • Cross-sector
    • Data & AI
    • 5 min read

October 2022

  1. Week of 3 October 2022

    Five principles, three committees: the AI blueprint inside a hospital

    The White House’s nonbinding AI blueprint read like new governance. For health systems, most of it described work existing clinical committees already knew how to do. Extending those committees to algorithms beat building a separate AI bureaucracy.

    • Healthcare
    • Data & AI
    • 5 min read

February 2023

  1. Week of 20 February 2023

    Banks blocked ChatGPT over leaks; recordkeeping set the longer limit

    When large banks restricted ChatGPT, the stated worry was confidential data leaving the firm. That problem yielded to contracts within a year. The obligations to keep and supervise records, and to explain decisions, set the slower pace of adoption.

    • Financial Services
    • Data & AI
    • 5 min read

March 2023

  1. Week of 20 March 2023

    A chatbot’s history sidebar is a records system with someone else’s retention policy

    OpenAI’s March 2023 bug was minor as breaches go. It showed health systems that staff conversations with AI assistants are stored data held by a vendor. HIPAA’s questions follow: what goes in, how long it stays, who sees it.

    • Healthcare
    • Data & AI
    • 5 min read

April 2023

  1. Week of 17 April 2023

    HIPAA’s reproductive health proposal asked records to know what they hold

    OCR’s April 2023 proposal turned on why information was requested, not what it was. Any version of it, and the state laws that followed, assumed a health system could find sensitive data in a record and keep it labeled. Few could.

    • Healthcare
    • Data & AI
    • 5 min read

June 2023

  1. Week of 12 June 2023

    Why the AI Act’s obligations follow your role, not your sector

    The European Parliament’s June 2023 position drew headlines for generative AI. Its durable feature for banks, health systems and agencies was structure: duties attach to whether an organization builds a system, deploys one, or builds on a general-purpose model, and many hold all three roles.

    • Cross-sector
    • Data & AI
    • 5 min read

October 2023

  1. Week of 2 October 2023

    Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure

    Attackers signed in to a sliver of 23andMe accounts and, through a relative-matching feature, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change with its holder.

    • Healthcare
    • Data & AI
    • 5 min read

  2. Week of 30 October 2023

    How OMB’s first AI memo reached AI systems agencies already ran

    Days after the October 2023 AI executive order, OMB’s draft guidance said rights- and safety-impacting AI must meet minimum practices by a deadline or be switched off. The hard cases were systems already in production, many of them inside vendor products.

    • Government
    • Data & AI
    • 5 min read

December 2023

  1. Week of 11 December 2023

    For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms

    ONC’s December 2023 rule required certified health IT developers to disclose source attributes for the predictive tools they supply. For models a hospital built itself or bought from someone else, the EHR only had to hold the information, and the hospital had to produce it.

    • Healthcare
    • Data & AI
    • 5 min read

March 2024

  1. Week of 11 March 2024

    Why the AI Act left bank credit models with the supervisor they already had

    The AI Act text adopted in March 2024 routed high-risk credit scoring through banking supervision and let existing governance satisfy some duties. For banks, the work was separating what model risk management already met from what it never covered.

    • Financial Services
    • Data & AI
    • 5 min read

  2. Week of 25 March 2024

    Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record

    The final OMB memo kept the draft’s comply-or-stop deadline and added something sharper. Every way out of it, whether a determination, a waiver or an extension, now needed a named signer, documented evidence and a public or OMB-reviewed record.

    • Government
    • Data & AI
    • 5 min read

May 2024

  1. Week of 20 May 2024

    How Windows Recall put a possible public record where no records officer could reach it

    Recall’s redesign answered the security objections by keeping screen snapshots local, sealed to the user and self-expiring. Those same three properties put the snapshots outside the search, hold and retention tools agencies use to meet public records and discovery duties.

    • Government
    • Data & AI
    • 5 min read

September 2024

  1. Week of 9 September 2024

    Why o1’s reasoning summaries added work for clinical AI committees

    OpenAI’s o1 narrated its reasoning just as federal rules on decision support transparency were taking hold. A fluent explanation answers a clinician’s question, not the vendor or the regulator’s, and health systems had to supply three different kinds of transparency themselves.

    • Healthcare
    • Data & AI
    • 5 min read

December 2024

  1. Week of 2 December 2024

    The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit

    The proposal to treat many data brokers as consumer reporting agencies was withdrawn within six months. Its underlying question, where personal data came from and what it may be used for, applies to data entering, leaving and being repurposed inside every AI program.

    • Cross-sector
    • Data & AI
    • 5 min read

January 2025

  1. Week of 6 January 2025

    Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs

    FDA’s January 2025 draft on AI-enabled devices, read with its December change-control guidance, assumed devices keep changing after purchase. Hospitals face three kinds of post-purchase change, pre-authorized updates, updates needing new review, and shifts in their own environment, and each needs a different control.

    • Healthcare
    • Data & AI
    • 5 min read

  2. Week of 20 January 2025

    Revoking the AI executive order could not revoke the AI inventory, because Congress had written it

    On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by legal footing: what rested only on the order, what rested on OMB memoranda awaiting revision, and what statute required regardless.

    • Government
    • Data & AI
    • 5 min read

March 2025

  1. Week of 17 March 2025

    23andMe’s bankruptcy turned a privacy policy into a term of sale

    Once 23andMe entered Chapter 11, its privacy promises stopped being a disclosure and turned into a condition that courts, states and bidders had to price. Anyone holding or sharing health-adjacent data should write contracts with that ending in mind.

    • Healthcare
    • Data & AI
    • 5 min read

  2. Week of 31 March 2025

    Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer

    OMB’s April 2025 memos trimmed internal AI process but asked contracts to carry more of the load. Agencies that treated each stage of the contract as a governance control kept bargaining power that review boards alone could not provide.

    • Government
    • Data & AI
    • 5 min read

June 2025

  1. Week of 2 June 2025

    Once FDA read with AI, sponsors’ inconsistencies got cheaper to find

    FDA’s Elsa gave reviewers a fast tool for searching and comparing submissions. Sponsors needed three disciplines in response: dossiers a machine reader cannot trip over, an evidence trail that corrects misreadings quickly, and validation records for their own AI.

    • Healthcare
    • Data & AI
    • 5 min read

August 2025

  1. Week of 11 August 2025

    Secrets in a public docket: the court filing breach and where the sensitive tier ends

    The federal courts already had a separate path for their most sensitive documents when the 2025 CM/ECF breach widened. The trouble was the boundary. Agencies holding dangerous records inside general systems need a tier defined by consequence, not by label.

    • Government
    • Data & AI
    • 5 min read

September 2025

  1. Week of 15 September 2025

    Approval is easy, monitoring is hard: the Joint Commission’s AI guidance and the work after go-live

    The September 2025 Joint Commission and CHAI guidance read like a governance checklist. Most of its weight fell after go-live, on monitoring and event reporting that depend on vendor contract terms few hospitals had negotiated.

    • Healthcare
    • Data & AI
    • 5 min read

November 2025

  1. Week of 17 November 2025

    For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s

    The Commission’s proposal to delay high-risk AI obligations looked like relief for credit scoring. For consumer lenders, the binding constraints were the GDPR as the EU’s top court had read it and the Consumer Credit Directive’s November 2026 date.

    • Financial Services
    • Data & AI
    • 5 min read

December 2025

  1. Week of 8 December 2025

    Why the AI preemption order barely reached health care’s own AI rules

    The December 2025 executive order aimed federal pressure at broad state AI laws. Most of the AI rules health systems actually follow sit in licensing, insurance and privacy law, where preemption arguments are weakest, so the order’s main risk lay with vendors.

    • Healthcare
    • Data & AI
    • 5 min read

January 2026

  1. Week of 5 January 2026

    FDA’s decision support revision handed hospitals a classification question

    FDA’s January 6 guidance widened enforcement discretion for some decision support software and wellness wearables, but did not reinterpret the law or address AI directly. Health systems inherited the job of deciding where each tool sits, and keeping it there.

    • Healthcare
    • Data & AI
    • 5 min read

March 2026

  1. Week of 23 March 2026

    The tool that checked for supply-chain risk was the supply-chain risk

    TeamPCP turned a trusted vulnerability scanner into a credential thief and used what it stole to poison an AI gateway library. Exposure depended on three things: which tools held keys, where keys were pooled, and how long stolen keys stayed valid.

    • Cross-sector
    • Data & AI
    • 5 min read

July 2026

  1. Week of 6 July 2026

    Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both

    CMS’s June 2026 rule tied the medically frail exemption from Medicaid work requirements to the past year’s coded diagnoses plus evidence that the condition impairs work. Coding, certification workflows and data sharing now help decide who keeps coverage.

    • Healthcare
    • Data & AI
    • 5 min read

  2. Week of 13 July 2026

    Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate

    A year after Fedwire moved to ISO 20022, the structured message reached most US banks intact. Its value did not, because data was lost at origination, inside banks’ own systems, or in screening and fraud tools never set up to use it.

    • Financial Services
    • Data & AI
    • 5 min read

September 2026

  1. Week of 14 September 2026

    Hospital device data rights arrive one purchase order at a time

    The EU Data Act’s access-by-design rule, live from September 12, 2026, reaches only equipment placed on the market from that date. For hospitals with decade-long replacement cycles, tenders carry the new right while the installed base runs on requests.

    • Healthcare
    • Data & AI
    • 5 min read