Insights · Looking Back
Regulation & Compliance
The Looking Back articles seen through regulation & compliance, across every sector, in order.
58 articles
January 2020
March 2020
Week of 2 March 2020
Why the FFIEC’s pandemic statement was an evidence checklist
The FFIEC’s March 6, 2020, statement restated pandemic expectations from the avian flu era. Its value lay in what examiners would later ask institutions to show: staged decisions, critical operations run with fewer people, and service providers coping with the same disruption.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
CMS’s March 30, 2020, waivers let care move to new sites, new staff and video. Every claim and record still had to state where, by whom and how, and the systems that captured those facts had assumed the old answers.
May 2020
June 2020
September 2020
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked how to define an effective AML program and leaked reports showed banks filing dutifully while flagged activity continued. The gap between volume, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and the firms that help them pay, which moved the decision from the crisis room into a governed, documented compliance process.
November 2020
December 2020
March 2021
April 2021
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
When the Cures Act information blocking rules applied on April 5, 2021, health systems discovered that compliance was decided by portal settings and release-of-information queues. Three operational questions mattered: what gets released, when, and how a withholding decision is defended.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted banks’, hospitals’ and agencies’ AI by business process, which put compliance ownership with process owners as much as data scientists.
May 2021
August 2021
September 2021
October 2021
January 2022
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
The FTC’s January 2022 warning tied Log4j remediation to its reasonable-security standard. Reasonableness is judged later, from records, so the decisive work was documenting the response while it happened, including what vendors said and when.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, compliance would be tested by state surveyors against a staff list that included contractors, students and practitioners. Most hospitals had no single list that reached past the payroll.
March 2022
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day incident clock. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and that text would become a standard others could test.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 fixed two clocks in statute and left coverage to a rulemaking that would take years. The decisions those clocks force, inside a hospital’s incident command, did not depend on the rule’s details.
April 2022
June 2022
August 2022
October 2022
November 2022
January 2023
March 2023
April 2023
May 2023
June 2023
July 2023
August 2023
November 2023
December 2023
January 2024
February 2024
April 2024
May 2024
July 2024
September 2024
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
The Council of Europe convention covers AI used by public authorities and by private actors acting on their behalf. That means an agency’s duties follow the service into its contractors, and the boundary of “on their behalf” is where governance gaps will open.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas’s settlement with Pieces Technologies applied an old consumer protection statute to a generative AI error rate. Health system buyers can test any such number on three dimensions: what it counts, where it was measured, and how it stays true after updates.
November 2024
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best predictor of which obligations would last was the instrument behind them: statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The larger-participant rule gave federal examiners access to big payment apps and lasted under six months. With Synapse’s collapse fresh, the more durable exposure sat elsewhere: in the law apps already owed and in the banks holding their customers’ funds.
December 2024
March 2025
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By rescinding the Richardson Waiver, HHS stopped offering notice and comment where the law did not require it. The loss of warning fell unevenly: heavily on grant recipients, moderately on contractors, and lightly on Medicare providers, whose statute still requires comment.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist in a senior officials’ chat made the headlines. For agencies at every level, the durable failure was a sanctioned channel that could not set content boundaries, verify participants and keep the record at the same time.
April 2025
June 2025
July 2025
September 2025
October 2025
November 2025
December 2025
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
When the amended Regulation S-P took effect for larger firms on December 3, 2025, notice became the default. Whether a firm could notify narrowly depended on evidence it had to keep before any incident.
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Indiana, Kentucky and Rhode Island brought comprehensive privacy laws into force on January 1, 2026. For banks and health systems, exposure turned on whether each statute exempted the organization or only its regulated data, and that answer keeps changing.
February 2026
July 2026
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 rulemaking deadline, but the law’s January 2027 backstop date did not move. Banks could not wait for final text to decide which role to play, and the funding question cut across every choice.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still contested. Providers bound by it now need their own record of decisions, documentation and appeals, because that record serves both daily operations and the policy fight.