98 articles
January 2020
March 2020
Week of 9 March 2020
Interoperability rules sent patient data beyond HIPAA’s reach
The ONC and CMS rules of March 9, 2020, prohibited information blocking and required standardized patient APIs. Together they moved patient data, at patients’ direction, into apps HIPAA does not cover, so health systems had to govern flows they could no longer refuse.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
CMS’s March 30, 2020, waivers let care move to new sites, new staff and video. Every claim and record still had to state where, by whom and how, and the systems that captured those facts had assumed the old answers.
April 2020
May 2020
June 2020
July 2020
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and report through a new HHS pathway. The switch showed that reporting depends on definitions, pipelines and governance, and that hospitals relying on manual counts paid for every change.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
OCR’s July 2020 settlement with Lifespan turned on an unencrypted laptop, a weak device inventory and missing agreements. It landed as health care’s administrative staff settled in at home, where HIPAA risk analyses written for hospital buildings had not followed them.
August 2020
September 2020
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
The Düsseldorf ransomware attack is remembered for a disputed death. Its lasting lesson for health systems is regional: cyber diversion moves clinical risk onto ambulances and neighboring hospitals that rarely plan for it, and rarely measure it.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
When Universal Health Services lost systems across its network in September 2020, the downtime binder mattered less than whether staff trained on electronic records could run a unit on paper for days, and then put it all back.
October 2020
November 2020
December 2020
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 proposal to speed up patient access to records stalled, but it named the three places access actually fails: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
The No Surprises Act was written as consumer protection. In practice it made the patient’s financial experience depend on four handoffs between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
January 2021
April 2021
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
When the Cures Act information blocking rules applied on April 5, 2021, health systems discovered that compliance was decided by portal settings and release-of-information queues. Three operational questions mattered: what gets released, when, and how a withholding decision is defended.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 agreement to buy Nuance put ambient clinical documentation inside a large cloud platform. For health systems, the decisions that mattered concerned the encounter recording itself, the review workflow around the draft note, and the contract governing both.
May 2021
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
Scripps Health spent most of May 2021 without its electronic health record after a ransomware attack. Downtime plans written for hours failed over weeks on three separate fronts: clinical continuity, revenue continuity and workforce endurance.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
The Conti attack on Ireland’s Health Service Executive is remembered for its national scale. Its later independent review showed the outcome was set during nearly eight weeks of undetected access, across three stages: entry, dwell and response.
July 2021
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 fee schedule proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a records problem: where the patient is, how the visit happens, and when they were last seen in person.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
CMS’s July 2021 proposal scaled price transparency penalties to hospital size, so the largest systems lost their cheapest option. Compliance then became a standing data product whose most attentive readers were payers, employers and competitors, not patients.
August 2021
September 2021
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
The FTC’s September 2021 policy statement said a health app that shares data without users’ authorization has suffered a breach. That moved breach prevention from the security team to three business decisions: what code ships, what partners receive, and what users agreed to.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
When a widely used root certificate expired on September 30, 2021, valid servers stayed up and old clients broke. For health systems, the exposure sat in device and integration trust stores that no team owned or inventoried.
November 2021
December 2021
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 agreement to buy Cerner gave health systems on that record a new owner with its own database, cloud and priorities. The decisions in front of them were about roadmap, hosting and contract terms, and the timing of each.
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written estimate before scheduled care. Hospitals had revenue cycle teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, did not.
January 2022
March 2022
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 fixed two clocks in statute and left coverage to a rulemaking that would take years. The decisions those clocks force, inside a hospital’s incident command, did not depend on the rule’s details.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
The March 2022 Okta disclosure showed that a subcontractor’s support engineer sat inside every customer’s trust boundary. For health systems running clinical access through one identity provider, the exposure was the two months before customers knew, and the logs they did not hold.
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
A Java flaw with a Log4Shell-style nickname arrived four months after Log4Shell, amid confusion over which bug was which. Its narrow exploit conditions made it a test of triage, and of whether tired hospital IT teams could avoid a second all-hands scramble.
April 2022
May 2022
June 2022
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
IE mode in Edge let hospitals keep legacy web applications running after the old browser’s retirement. The compatibility list it required was a ready-made inventory of legacy risk, best worked down by who could fix each site: the hospital, its vendors, or outside parties.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went to medical records, where HIPAA already set rules. The larger exposure for health systems sat at their own digital edges and in consumer data they never held but patients assumed was protected.
August 2022
October 2022
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
The White House’s nonbinding AI blueprint read like new governance. For health systems, most of it described work existing clinical committees already knew how to do. Extending those committees to algorithms beat building a separate AI bureaucracy.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
CommonSpirit’s ransomware attack hit hospitals in several states while others in the same system carried on. In merged health systems, the blast radius is set by shared identity, shared networks and who can order a precautionary shutdown for everyone.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it depended on suppliers saying their products were not affected, and few could get that statement quickly, in usable form, or at all.
November 2022
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
When federal agencies warned health care about Hive ransomware, the FBI had secretly held the group’s decryption keys for months. Victims who reported got them. Health systems should settle when to call, what to share and how reporting fits other clocks.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking technologies created no new rule. It exposed a governance gap: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls that applied to every other system touching patient data.
December 2022
January 2023
February 2023
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through a file-transfer product most health systems treated as plumbing. Managed file transfer is a data tier with its own exposure, retention and accountability, and it needs the discipline applied to any system of record.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case concerned a company outside HIPAA, but it reached every health organization with a digital front door. What patients are told when they sign up is a commitment, and the measurement tools behind the page must be built to keep it.
March 2023
April 2023
May 2023
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency’s end unwound telehealth flexibilities on separate schedules set by Congress, the DEA, OCR and the states. Each schedule governed a different workforce question: what clinicians may prescribe remotely, where they may practice from, and which tools they may use.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
The FTC had already said health apps outside HIPAA owe breach notice for unauthorized sharing. Its May 2023 proposal mattered for its definitions, which showed that one patient’s data can change regulators as it moves between a hospital, a consumer product and an app.
July 2023
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came from storage used to format patient emails, not from clinical systems. Outreach data looks harmless one field at a time, but together it is protected health information and needs EHR-grade ownership, inventory and minimization.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
The August 2023 attack on Prospect Medical Holdings hit an operator that was already financially stretched and mid-way through selling three Connecticut hospitals. For such operators, cyber resilience is a balance-sheet and deal term, priced by buyers, lenders and state approvers.
August 2023
October 2023
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers signed in to a sliver of 23andMe accounts and, through a relative-matching feature, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change with its holder.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers in Okta’s support system replayed session tokens from files customers had uploaded. For health systems, which send vendors logs and screenshots daily, each support artifact’s exposure depends on what it contains, what it is under HIPAA, and how long it stays usable.
November 2023
December 2023
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
HHS’s December 2023 concept paper set out a voluntary baseline, two regulatory routes to make it binding, and incentives that depended on legislation. Requirements could arrive by rulemaking. Money could not, and hospitals had to plan for that gap.
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
ONC’s December 2023 rule required certified health IT developers to disclose source attributes for the predictive tools they supply. For models a hospital built itself or bought from someone else, the EHR only had to hold the information, and the hospital had to produce it.
February 2024
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and payers that receive substance use disorder records treat them almost like other health data. The treatment programs that create them, and the legal teams that answer subpoenas, carried more obligation than before.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
When ransomware hit the largest US claims clearinghouse, every connected provider faced the same call. Cutting the connection was quick. Knowing what to cut, and what proof to demand before reconnecting, depended on preparation few had done.
March 2024
April 2024
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of purpose. That shifted paperwork onto requesters but left hospitals with judgments no form could make, under a rule a court vacated in 2025.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal without MFA, about sixteen months after the acquisition closed. Health care buyers should treat inherited internet-facing access as a closing condition, an interim-period control set and a board-level exception list.
May 2024
June 2024
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
The ransomware attack on Synnovis showed that consolidating a region’s pathology into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. Nobody’s contract, budget or insurance carried the loss.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
Hospital script reviews were built after 2022 to stop patient data leaving through tracking tags. Polyfill.io showed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it takes checks on the source, the content and the response.
September 2024
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 narrated its reasoning just as federal rules on decision support transparency were taking hold. A fluent explanation answers a clinician’s question, not the vendor or the regulator’s, and health systems had to supply three different kinds of transparency themselves.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas’s settlement with Pieces Technologies applied an old consumer protection statute to a generative AI error rate. Health system buyers can test any such number on three dimensions: what it counts, where it was measured, and how it stays true after updates.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on allocation nationwide. Low-cost essentials concentrate supply because price pressure rewards scale, so health systems need to manage them by clinical criticality, through four levers that spend-based purchasing ignores.
October 2024
December 2024
January 2025
February 2025
March 2025
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By rescinding the Richardson Waiver, HHS stopped offering notice and comment where the law did not require it. The loss of warning fell unevenly: heavily on grant recipients, moderately on contractors, and lightly on Medicare providers, whose statute still requires comment.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa advisory read like a catalog of the remote-access and management products hospitals and clinics depend on. Defending against it means governing those tools at three points: entry, movement and evasion.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe entered Chapter 11, its privacy promises stopped being a disclosure and turned into a condition that courts, states and bidders had to price. Anyone holding or sharing health-adjacent data should write contracts with that ending in mind.
May 2025
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of Kettering Health’s May 2025 ransomware outage, criminals were phoning its patients for card payments. Outage communication is a security control, and it has to exist before the attack: surviving channels, ready answers, anti-impersonation rules and clear authority.
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
A nation-state intrusion at a remote access vendor in May 2025 sat two contracts away from most physician practices. Their services and business associate agreements are the only controls they hold, and most say too little about tools, access, notice and cost.
June 2025
July 2025
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
When the Justice Department’s grace period ended on July 8, 2025, health systems and life sciences firms faced a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
The July 2025 health tech ecosystem pledge promised patients their records in apps of their choice. The data pipes largely existed. What decides success is front-office work: proving who the patient is, matching the right records, and handling consent and proxies.
September 2025
October 2025
December 2025
January 2026
Week of 5 January 2026
FDA’s decision support revision handed hospitals a classification question
FDA’s January 6 guidance widened enforcement discretion for some decision support software and wellness wearables, but did not reinterpret the law or address AI directly. Health systems inherited the job of deciding where each tool sits, and keeping it there.
Week of 12 January 2026
Patient-directed AI: where HIPAA ends, a provider’s duties change shape
When consumer AI products invited patients to connect their medical records, HIPAA protection ended at the patient’s request. Providers could not block that flow, but they still owed patients a safe pathway, a clean record and accurate context.
Week of 26 January 2026
A two-year telehealth runway is long enough to build on and too short to bet on
After one more lapse at the end of January, Congress extended Medicare telehealth flexibilities through 2027 and hospital at home through September 2030. Health systems could finally plan, but only by sorting services according to how long their legal footing lasts.
February 2026
March 2026
Week of 9 March 2026
Stryker’s wipe made a supplier’s admin console a hospital supply risk
The attack on Stryker reportedly used the company’s own device-management tools to erase systems, with no ransom and no patient data at stake. It reached hospitals through orders and shipments, which most vendor risk reviews never examine.
Week of 30 March 2026
What payers’ first prior authorization numbers needed from providers to be useful
The prior authorization metrics payers posted by March 31, 2026 were rates without volumes, averaged across whole books of business. They became useful to a health system only when paired with its own counts, by payer and service.
May 2026
Week of 4 May 2026
Why a hospital’s accessibility deadline now sits in its vendor contracts
HHS gave hospitals and other funded providers another year to make websites and apps accessible under Section 504. Because most of what patients use online is built or run by vendors, the year is best spent on contracts.
Week of 11 May 2026
Payer prior authorization APIs will only help the providers ready to call them
CMS requires payers to offer prior authorization APIs by January 2027. The benefit lands with health systems that have settled three things first: which system makes the call, whether the chart can answer, and who owns the request.
June 2026
July 2026
Week of 6 July 2026
Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both
CMS’s June 2026 rule tied the medically frail exemption from Medicaid work requirements to the past year’s coded diagnoses plus evidence that the condition impairs work. Coding, certification workflows and data sharing now help decide who keeps coverage.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still contested. Providers bound by it now need their own record of decisions, documentation and appeals, because that record serves both daily operations and the policy fight.