Five healthcare providers have reached class action settlements in the past eighteen months over one issue: marketing teams deployed tracking pixels on patient-facing web properties without security review, without privacy oversight, and without Business Associate Agreements. That is not an IT failure. That is an organizational governance failure, and it carries price tags that belong in every board risk briefing this quarter. The stakes are no longer theoretical. Boards need to understand...

A new HIPAA Journal report documents what many of us in healthcare security have been tracking for years: a sustained surge in malicious insider incidents, running alongside a rise in mega data breaches, with 2026 on track to set records across both categories. For health system executives and boards still treating insider threat as an IT checkbox, this data demands a fundamentally different response. The Structural Problem Healthcare Cannot Outspend Healthcare's insider threat exposure is...

The $18 million multistate settlement reached between 23andMe and a coalition of 42 state attorneys general deserves more than a news cycle. For healthcare executives, it is a signal that the regulatory terrain around genomic and sensitive health data has permanently shifted, and most organizations are not positioned to respond. Background: Genomics Has Entered the Care Delivery Stack The 23andMe breach originated in October 2023 through a credential stuffing attack that exposed genetic...