The Evolution and Impact of NIST CSF 2.0
NIST, or the U.S. National Institute of Standards and Technology, is at the forefront of the evolving realm of cybersecurity. Their goal is to provide recommendations that can be used as guideposts for industry best practices and more efficient ways of working However, cybersecurity is notoriously difficult to build standards around because the threat landscape […]
Navigating New York’s Cybersecurity Regulations for Hospitals
Unwilling to wait for the federal government to implement its cybersecurity regulations in healthcare, New York decided to take matters into its own hands by adopting groundbreaking new legislation. On October 2nd the New York Department of Health announced new state cybersecurity requirements for hospitals, under Section 405.46 of Title 10. “New York state finalizing […]
Is “Sorry” Good Enough? Insights from UHG’s Change Healthcare Testimony
On Wednesday, May 1, Andrew Witty, CEO of United Health Group (UHG), appeared before two congressional committees to discuss the recent Change Healthcare Breach. Mr. Witty expressed deep regret for the significant disruption the incident caused throughout the healthcare sector. During his testimony, he provided insight into how the attack happened, evaluated United Health Group’s […]
Is Electronic Protected Health Information (ePHI) Getting Outside Your Healthcare Organization?
Under HIPAA regulations, health information or data that can be used to identify an individual patient is categorized as protected health information (PHI) and must undergo a wide range of practices explicitly designed to protect patient confidentiality. Covered entities must implement processes and controls to ensure confidentiality, integrity, and availability of physical PHI and electronic […]
How to Successfully Navigate HIPAA Cybersecurity Requirements
In a world where technology evolves faster than we can say “cybersecurity,” one might wonder if the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is still relevant. Surprisingly, it’s not just relevant; it’s an unsung guardian of our healthcare data. Compliance with HIPAA is essential for healthcare organizations to maintain data security and […]
Cybersecurity Awareness Month: Keeping Healthcare Healthy
As October ends, Cybersecurity Awareness Month reminds us of the crucial opportunity for individuals and organizations to deepen their understanding of cybersecurity and proactively secure their digital environments. In healthcare, where sensitive patient data and critical systems are persistently at risk, this focus is essential. The Importance of Cybersecurity in Healthcare Healthcare organizations are particularly […]
Congressional Scrutiny of Healthcare Cyber Risks
On April 16th, healthcare industry leaders gathered in Washington, DC to testify to the Energy and Commerce Health Subcommittee on the topic of “Examining Health Sector Cybersecurity in the Wake of the Change Healthcare Attack.” The insights these leaders shared around the sector-wide risks facing healthcare and the potential steps forward to address them were […]
Charting a Wellness Plan for Healthcare Cybersecurity
The journey to cybersecurity resilience in healthcare is not a solo endeavor. It requires coordination among several pivotal organizations. At the heart of this collaborative effort is the Health Sector Coordinating Council Cybersecurity Working Group (HSCC CWG), a team designated by the U.S. government as a critical infrastructure advisory council. The HSCC CWG exemplifies a […]
CISO Brief: Regulatory Update on the 2026 National Cybersecurity Strategy
The 2026 National Cybersecurity Strategy focuses on deterring geopolitical adversaries, protecting critical infrastructure, accelerating global technological leadership, modernizing federal systems and their private-sector partners, simplifying cyber regulations, and strengthening the cyber workforce. One of the more important signals for healthcare is that hospitals are increasingly being discussed alongside the energy grid, water utilities, and other critical […]
February 2026 CISO Brief: Privacy Deadlines, Clinical Impact, and Persistent Attack Paths
As healthcare organizations move closer to the February 16, 2026, compliance deadline for the updated 42 CFR Part 2 requirements, they are doing so in an environment defined by persistent ransomware activity, slow remediation of known exploited vulnerabilities, expanding clinical attack surfaces, and growing use of unmanaged technologies. This month’s Brief focuses on how these […]