Leo Cole

I think it's time we start talking about the elephant in the room in healthcare. Over 100 hospital systems led by CHIME are fighting to kill the proposed HIPAA Security Rule overhaul. The headline number they keep throwing around? $9 billion in first-year compliance costs. I have questions about that number. We work with small and mid-sized healthcare organizations every day — practices, clinics, specialty groups — and we're implementing these exact controls right now. MFA. Encryption. Asset inventories. Pen testing. Risk assessments. Incident response. We're doing it on Kool-Aid budgets, not champagne ones, because that's who we built our services for. Organizations that need enterprise-grade security but don't have enterprise money. So when I hear $9 billion, I have to wonder — who's pricing this out? Because if a 50-person practice can get compliant with our tools and fractional CISO support for a fraction of what the big consulting firms charge, maybe the cost argument is more about protecting the status quo than protecting patients. And here's the thing — this is happening whether the NPRM survives or not. A bipartisan group of Senators — Cassidy, Warner, Hassan, Cornyn — already reintroduced the Health Care Cybersecurity and Resiliency Act with the same core mandates: MFA, encryption, annual pen testing, cybersecurity audits. Paired with federal grants to fund it. New York didn't wait at all — they enacted mandatory cybersecurity regulations for every general hospital in the state. CISOs, annual risk assessments, penetration testing, 72-hour incident reporting. Full compliance hit October 2025 with $500 million in state funding behind it. Other states are already drafting their own. The direction is set. The only variable is the timeline. So why are we fighting this? This isn't bleeding-edge stuff. This is basic security hygiene that every organization handling patient data should already have in place. 275 million healthcare records were breached last year. 238 ransomware attacks on healthcare. The Change Healthcare breach alone hit 190 million people. At some point we have to stop treating cybersecurity like a regulatory burden and start treating it like what it is — patient safety. If your organization needs help getting ahead of this without blowing your budget — that's literally what we do. We make enterprise security accessible for organizations that were told they couldn't afford it. Reach out. I'm happy to have the conversation. #HIPAA #HealthcareCybersecurity #Compliance #FractionalCISO #SecurityRule #HealthIT #CyberResilience #InfoSec #RiskManagement #DataBreach #Ransomware #ePHI #NIST #HealthcareIT #PatientSafety #HealthcarePolicy #RegulatoryCompliance #vCISO #ThirdPartyRisk #IncidentResponse #PenetrationTesting #MFA #CyberInsurance #HealthcareLeadership #CHIME #HHS #Pittsburgh #IronCityIT #SmallBusiness #RuralHealth

4

1 Comment

While healthcare organizations rank among the best at preventing serious cybersecurity vulnerabilities, they lag significantly in remediation—with only 57% of serious issues resolved and a median fix time of 58 days, according to a Cobalt-sourced HIPAA Journal report. That's why teaming up with Reclamere empowers healthcare leaders to close the gap—driving faster, smarter remediation and confidently safeguarding patient data." https://lnkd.in/eXmDVSZ8

9

🚓 CJIS compliance doesn’t have to be a checkbox exercise. The City of Marietta, GA turned a security requirement into a workflow win by boosting productivity, simplifying access, and strengthening security with Imprivata Enterprise Access Management (EAM). 👉 Read the full story: https://ow.ly/TPyI30sQQFr

5

I heard this reported by CBS news this morning. While AI has so many benefits, the bad actors are using it against us. And they continue to focus on critical infrastructure, like hospitals and health systems. Great read! #cyberattack #cyberresiliency #ameliormss

8