Help Me With HIPAA

When a cybersecurity CEO strolls into a hospital and decides to play malware magician with a couple of unlocked computers, you've got yourself a plot twist worthy of a Netflix docuseries. In this episode, we dive headfirst into bizarre breaches, finger-pointing fiascos, and the kind of contractual confusion that'll make you want to reread your SLAs before breakfast. It's a rollercoaster of respons...

Healthcare still has a giant "Hack Me" sign taped to its back — and the latest reports from Mandiant and Verizon are here to confirm it. These cybercrime breakdowns reveal that attackers are smarter, sneakier, and spending more time poking around your network than ever before. Waiting to secure your systems until after a breach is like installing a smoke detector after the house has already burned...

If the Ponemon study were a horror flick, it'd be titled "The Login Came from Inside the System." This week's episode dives into the alarming trend of organizations handing out privileged access like Halloween candy — only to forget who's still got it long after the party's over. With 59% of breaches linked to insiders or third parties, and executives confidently sailing past the iceberg of realit...

Turns out, "they got hit, they just didn't tell you" isn't just a snarky title—it's a terrifying reality. The Black Fog report basically says, "Hey, the cybersecurity iceberg is way bigger below the surface." From undisclosed data heists to the rapid rise of ransomware attacks, this is your reminder that you don't want to be the next plot twist in a cyber thriller. Oh, and yeah... shadow AI is wat...

Imagine your hospital gets hacked—the MRIs are down, billing's frozen, and suddenly you're faxing patient records like it's 1999. No, that's not a "Twilight Zone" rerun—it's real life in health care. This week, we're diving into what the Health Sector Coordinating Council (HSCC) is doing about it, including their recent trip to Congress to lay it all out. From legacy devices clinging to life like...

Forget action-packed heist movies — the real cybersecurity heroes are the ones making their auditors yawn. In this episode, we break down why "boring and patched" should be everyone's new life goal. From AI developments that won't sit still for five minutes to real-world cyber drama featuring surprise FBI visits (no popcorn needed), we're serving up a crash course in staying safe, sane, and just b...

AI in healthcare is kind of like an overenthusiastic intern—it's full of potential, but someone probably should be watching it a little closer. In this episode, we dive into why artificial intelligence might be more "oops" than "awesome" when it comes to patient safety. A recent ECRI report flagged AI as a top safety concern and offered up smart recommendations like stronger governance and better...

Think your once-a-year vulnerability scan is enough? That's adorable. Waiting to check your security metrics until something goes wrong is like only checking your smoke alarm after the house starts smelling like burnt toast. In this episode, we peel back the layers on the top 10 security and privacy metrics every business should be tracking—whether you're the CEO, the IT person, or just someone wh...

Buckle up, folks—this episode is a rollercoaster of cyber chaos! We kick things off with a quick chat about the upcoming PriSec Boot Camp (because let's be real, who doesn't love a good security boot camp?). But then, we dive headfirst into the madness: a fresh HIPAA smackdown over right-of-access failures, a rogue IT guy who locked down an entire company out of revenge, and some seriously sketchy...

500 episodes. A whole decade. Countless cybersecurity threats (and just as many dad jokes). Somehow, we're still talking about the same cybersecurity nightmares—only now with fancier threats and AI-powered scams. In this milestone episode of Help Me With HIPAA, we take a trip down memory lane—reminiscing about our early struggles, the evolution of security risks, and why some lessons seem to need...

Cybersecurity: It's like flossing—we all know we should do it, but a shocking number of people just…don't. This week, we're digging into the annual cybersecurity attitudes and behaviors report, which reveals just how careless people are with their passwords, personal info, and, well, basic online survival skills. But don't worry, AI is here to save us! Or, possibly, to make things even worse. We'l...

Cybersecurity report cards are in, and let's just say—most companies would be grounded if their IT security grades were real school grades. With over 80% of Fortune 500s scoring a D or F, and healthcare companies hovering around the danger zone, it's clear that many organizations are securing data about as well as a cardboard vault. Just ask Warby Parker, which racked up multiple breaches over the...

AI just leveled up, and we're here to talk about it! In this episode, we dive into DeepSeek—the AI model that shook up the stock market, gave OpenAI a run for its money (literally), and is both insanely cheap to run and totally open-source (which is equal parts exciting and terrifying). We also break down the rise of deepfake scams, AI's growing role in cybersecurity, and why you should probably q...

Imagine leaving your front door wide open in a neighborhood full of burglars, then acting shocked when your TV disappears. That's basically what's happening in healthcare cybersecurity. This week, we're talking about why hackers are running rampant, how small healthcare practices are prime targets (no, you're not "too small to matter"), and what basic security steps can actually make a difference....

If you've ever wondered what it's like to scream into the cybersecurity void, this episode might feel oddly relatable. We dive into why "bare minimum" isn't a security strategy—it's more like playing Russian roulette with your data. From regulatory head-scratchers to the harsh reality that a "bare minimum" security strategy is about as effective as locking your front door while leaving the windows...

If ignoring cybersecurity was a sport, some companies would be gold medalists—until they realize the prize is a hefty fine and years of regulatory headaches. It's like leaving your car unlocked in a sketchy part of town with a neon sign that says, "Free Stuff Inside." What could possibly go wrong? Well, in this episode, we break down six real-life cases that prove skimping on security is way more...

Buckle up, folks, because this week's episode is a wild ride through the Cavity of Lies—where HIPAA violations, ransomware attacks, and outright absurdity collide. What happens when a dental group tries to sweep a massive breach under the rug (or, you know, hide servers in bathrooms)? Let's just say it doesn't end well. From a 3-year-long cover-up to servers stored in all the wrong places, we've g...

Hold onto your compliance hats—big changes are brewing for HIPAA's Security Rule! The Notice of Proposed Rulemaking (NPRM) is officially out for public comment, and it's clear HHA and OCR are on a mission to modernize and tighten the safeguards for electronic protected health information (ePHI). From clarifying risk analysis expectations to making security requirements less, well, "vague," these u...

Ready to kick off 2025 with a bang? We're diving into the must-dos for your Q1 2025 compliance and cybersecurity checklist, sprinkling in some risk management wisdom, and why Windows 10 is about as fashionable as shoulder pads in the 2020s. Plus, we sprinkle in a hearty dose of snark to keep you entertained while you get your compliance game strong. Oh and if your incident response plan is just "h...

Ah, supply chain attacks—the gift that keeps on giving... headaches, fines, and catastrophic data breaches. In this episode, we unwrap three cautionary tales of organizations caught in the tangled web of digital supply chain chaos. From unpatched vulnerabilities and sneaky software backdoors to hackers casually buying network access like it's an eBay auction, each story serves up a hard truth: you...

It's the final countdown, folks—the last episode of the year! And OCR decided to end 2024 with a bang, handing out settlements like candy at a Christmas parade. But here's the twist: the candy comes with a price tag, and it's not cheap. This episode hones in on OCR's new enforcement initiative targeting incomplete and outdated risk analyses. So, before you pop the champagne, let's make sure your S...

Welcome to the 2024 Blooper Show, where we prove once again that even after nine years, perfection is overrated and laughter is mandatory! Big shoutout to Bojan, our long suffering audio engineer extraordinaire, who turns our chaos into coherence. And of course, we can't forget you—our amazing listeners—who tune in each week, send us your thoughts and questions, and share the chaos with your frien...

Cybersecurity incidents can feel like a punch in the gut, but with the right plan, you can roll with the hits instead of flailing in panic. In this episode, we're diving into executive strategies for tackling the unexpected, from building response teams to keeping business operations afloat when chaos strikes. Along the way, we also cover a recent corrective action plan that serves as a cautionary...

Is your healthcare organization ready for a triple threat, or are you playing a risky game of cybersecurity roulette with delayed access, ransomware demands, and a missing incident response plan? Today, we explore three tales in healthcare that are equal parts cautionary and compelling. We kick things off with the Healthcare and Public Health Sector Coordinating Council's shiny new cyber incident...

Feeling thankful this season? Us too—especially when it comes to dodging data disasters! In this episode, Donna and David dive headfirst into some eyebrow-raising cybersecurity tales, from job application breaches exposing sensitive information to the ever-creepy risks of unsecured IoT devices (yes, even your vacuum might be plotting against you). Whether it's researchers discovering unsecured dat...