By Mark Ferrari – Healthcare has gotten very good at producing third-party risk scores. We have platforms, dashboards, questionnaires, and assessments that can generate a number for almost any vendor relationship. Leaders like scores. They are simple. They are comparable. They fit into a dashboard and offer a way to simplify the risk of a vendor population that keeps growing.
Read More
By Matt Fisher – The Centers for Medicare and Medicaid Services released its proposed 2027 Physician Fee Schedule for Medicare (the 27 PFS) on July 14, 2026. The 27 PFS contained a pretty big surprise: a complete shift in approach to the two primary modes of remote monitoring: remote physiologic monitoring and remote therapeutic monitoring.
By Amy Oliver – I have always cared about healthcare access and equity. But recently it stopped being just a professional conviction and became something messier and more specific, the kind of care that comes from watching the system fail someone you love and not being able to do anything about the system, only about showing up.
By Matt Fisher – The biggest recent news for HIPAA is the quiet reveal that updates to the Security Rule are now delayed until sometime in the middle of 2027. The update was made on an Office of Management and Budget webpage, which now shows expected final action as an undefined date in July 2027.
By Russell Teague – Healthcare is getting better at seeing its risk. The hard part is now what we do after the finding. During the first half of 2026, organizations have been identifying more risk than ever, but they are remediating less of it according to Fortified Health Security’s rolling risk assessment data.
By Matt Fisher – Artificial intelligence remains a hot topic in seemingly every area of life, with healthcare a particular focus. Where does AI fit in exactly though? There are so many questions and conflicting suggestions about how AI fits in. Recently, three different reports and surveys pointed to very different assessments and potential uses.
By Dr. Nick van Terheyden – If you’ve ever tried to see the Mona Lisa in person, you know the feeling: a shuffling mass of humanity, phones held aloft like ritual offerings, security guards barking orders, and a vague sense that whatever you’re looking at cannot possibly justify this level of chaos.
By Dr. Nick van Terheyden – Years ago, I was driving across states with a good friend and colleague from Spain. We stopped in at a gas station that had a Subway restaurant on the side. When my Spanish colleague was asked if he wanted his sandwich “To Go,” he looked at me quizzically and asked what they meant (he spoke excellent English).
By Matt Fisher – Revealing a data breach can be a hard action for an organization to take. The ongoing stream of notifications still generates attention, which is typically not positive when a security breakdown is revealed. At the same time, the notification is (or should be) unavoidable since the HIPAA breach notification rule is clear about what action is necessary.