By Matt Fisher – The biggest recent news for HIPAA is the quiet reveal that updates to the Security Rule are now delayed until sometime in the middle of 2027. The update was made on an Office of Management and Budget webpage, which now shows expected final action as an undefined date in July 2027.
Read More
By Russell Teague – Healthcare is getting better at seeing its risk. The hard part is now what we do after the finding. During the first half of 2026, organizations have been identifying more risk than ever, but they are remediating less of it according to Fortified Health Security’s rolling risk assessment data.
By Freddie Sanchez – The recent Canvas data breach sent shockwaves through education, but it’s a situation all too familiar for those of us in healthcare. For years, our industry has consistently been a top target for bad actors, and that trend is unlikely to change anytime soon.
By Zac Amos – Automation has supported unprecedented operational efficiency in the healthcare industry. Yet, it has also brought a unique set of challenges. With the Health Insurance Portability and Accountability Act constantly evolving to address new technologies and the privacy concerns they raise, achieving absolute compliance can often feel like a moving target without the right guardrails.
By Zac Amos – Access control in healthcare facilities protects patient data and supports ongoing regulatory compliance. Even experienced teams can overlook critical gaps that expose systems and environments to unnecessary risk, especially as operations scale and integrate new technologies.
By Gilda D’Incerti – Healthcare cybersecurity has typically been viewed as a technical responsibility, with security teams focused on protecting networks, securing electronic health records, and responding to ransomware incidents. Now, that framing is no longer sufficient.
By David Lareau – Medicare Advantage oversight has entered a more data-driven phase, with regulators focusing closely on how diagnoses are identified, documented, and submitted for risk adjustment. At the center of that scrutiny is the practice of “suspecting,” which involves searching patients’ medical records to identify…
By Jackie Mattingly & Lance Alston – Rural hospitals are not trying to do something unique with cybersecurity. They are trying to keep care available in their communities. They are trying to protect patients. They are trying to meet rising expectations with limited staff, limited funding, and little room for operational disruption.
By Zac Amos – With cyberattacks in the healthcare industry becoming increasingly prevalent over the past few years, cybersecurity infrastructure has had to develop rapidly. Yet, traditional methods often focus exclusively on technical barriers such as firewalls and encryption. They overlook one of the health sector’s most underappreciated risks: human error.