An AI Policy Is Not an AI Control
In December 2024, an Ontario hospital reported a privacy breach to its provincial regulator. A former physician's AI scribe had joined a virtual hepatology
AI Regulatory Intelligence Tracker
A continuously updated tracker of U.S. and international AI laws and regulations affecting healthcare and regulated industries.
Healthcare Breaches Are Holding Steady In Count And Growing In Size
Thirty-three million people. One month. That is how many individuals had their health information exposed in the 77 large breaches reported to OCR in July:
Information Blocking Enforcement Is Moving: What Healthcare Leaders Should Know
For years, healthcare leaders could read about information blocking without seeing many public examples of its consequences. That position is getting harder to defend. In June,
Human Review Is a Control Only When You Can Prove It Worked
State laws put a physician in the loop on AI-assisted denials. A signature shows who signed, not who decided. Six measures give an examiner proof that the review was real.
Why I Support Mandatory Standards, Independent Audits, And $1.3 Billion For Healthcare Cybersecurity
A former colleague called me within hours of the Change Healthcare attack. His organization was down hard. I thought then what I think now: this was
Your Hospital's AI Is Paid To Find Sickness
Imagine a mechanic who finds nine problems with your car. You pay for nine repairs. Later you learn he earns a commission on every problem he
We're Building AI Governance For A Regulator That Hasn't Shown Up
Last week, ONC held a webinar on updates to its Security Risk Assessment Tool. It brought me back to a question I keep hearing from healthcare
The ONC Security Risk Assessment Tool Is Better Than It Used to Be. It's Still Not Good Enough.
Every year, I get some version of the same call. A practice manager or a compliance lead has just been told to run their annual security
The HIPAA Security Rule Deadline Moved to 2027. Your Liability Didn't.
On April 23, 2026, the HHS Office for Civil Rights announced four HIPAA settlements in a single day: Assured Imaging, Regional Women's Health Group,
The Patient Cost of a Healthcare Data Breach
Breach costs are usually measured in fines and notification letters. The real cost is measured in patients, and it does not show up on a compliance checklist.
OCR Stopped Grading Whether You Did the Homework. Now It Grades What You Did With the Answer.
On April 23, 2026, the HHS Office for Civil Rights settled four ransomware investigations in a single announcement: $1,165,000 in penalties, more than 427,