There is no shortage of tools, scans, checklists, and reports that promise to help with cybersecurity, but calling something a risk analysis does not magically make it one. This episode takes a hard look at what OCR keeps saying about Security Risk Analysis, why incomplete SRAs continue to show up in enforcement actions, and why understanding your actual environment still matters more than simply checking the right boxes.
More info at HelpMeWithHIPAA.com/576
Every October, the National Cybersecurity Alliance uses Cybersecurity Awareness Month to remind us how to stay safer online, and this year’s message is beautifully simple: don’t make it easy for the criminals. They’re looking for weak passwords, missing MFA, unpatched software, and people who click before they think. In other words, they’re rattling digital doorknobs to see which ones open. This episode takes a look at this year’s campaign and the real-world cybercriminals being used to show why basic cyber hygiene still matters. You don’t have to become a cybersecurity genius. You just need to practice a few basic security habits to keep you from becoming the easiest target on the block.
More info at HelpMeWithHIPAA.com/577
Remember when spotting a phishing scam meant looking for terrible grammar, a suspicious link, and maybe a Nigerian prince having a bad week? Those were simpler times. Today’s attackers can sound like your IT department, use tools you already trust, and even walk you through legitimate-looking security steps. The scams have gotten much better at looking trustworthy, which means the old security awareness rules need an upgrade. When urgency, anxiety, or pressure shows up, slowing down and verifying may be your best defense.
More info at HelpMeWithHIPAA.com/576
There are two times to spend money on cybersecurity: before something goes wrong, when you still have choices, and after something goes wrong, when your choices have packed a bag and left town. With the average U.S. data breach now costing $11.5 million, the question isn’t whether security costs money. It’s whether you’re spending that money on the things most likely to keep a bad day from becoming a very long, very expensive year. The latest breach-cost research offers some surprisingly practical clues, including faster detection, smarter access controls, employee training, encryption, simpler systems, qualified security help, and properly managed AI. And there’s an important catch: outsourcing the work doesn’t outsource the accountability. This episode digs into how to spend smarter while you still have the luxury of deciding where the money goes.
More info at HelpMeWithHIPAA.com/575
Ransomware used to sound like a fairly straightforward nightmare: attackers get in, encrypt your files, demand money, and ruin everyone’s week. Unfortunately, the business model has gotten an upgrade. Today’s ransomware groups are stealing massive amounts of data, recruiting affiliates with surprisingly competitive revenue splits, disabling security tools, contacting patients directly, and even hijacking social media accounts to turn up the pressure. Meanwhile, regulators are asking harder questions about risk analysis and looking further into the past for answers. Connect those dots, and the picture gets uncomfortable fast. This episode explores what recent ransomware headlines are really telling healthcare organizations, including the small ones still hoping they’re too tiny to attract attention. Spoiler alert: the bad guys appear to have misplaced their minimum-size requirement.
More info at HelpMeWithHIPAA.com/574
Cybersecurity has always been a moving target, but lately the target seems to have strapped on roller skates, grabbed an AI assistant, and headed straight for the nearest hotel Wi-Fi. Vulnerabilities are being patched at record rates, attackers are finding clever new ways to steal credentials, and AI agents can now take action with surprisingly little supervision. In this episode, we look at what happens when threats evolve faster than the plans designed to handle them, and why having security tools isn’t the same as knowing they’re actually protecting you. The real question isn’t whether technology will keep changing. It’s whether your security practices can keep up.
More info at HelpMeWithHIPAA.com/573
Most organizations have an incident response plan, but how well would it hold up if your normal communication channels suddenly couldn't be trusted? In this episode, we dive into a nationwide healthcare cybersecurity exercise that challenged participants to think beyond compliance and technical defenses, exposing just how critical preparation, collaboration, and secure communication become during a large-scale cyber crisis. Along the way, a surprising real-world AI development reminds us that tomorrow's threats may arrive sooner than anyone expects.
More info at HelpMeWithHIPAA.com/572
Regulations may move at the speed of a sleepy turtle, but patient expectations certainly don't. As healthcare organizations wait to see what the final HIPAA Privacy Rule will include, there is a surprising amount of work that can, and should, already be underway. This episode explores the practical steps you can take now, the common misconceptions that continue to create confusion, and why preparing early is far less painful than trying to outrun an approaching compliance deadline. If you start getting your ducks in a row today, it just might save you from chasing them all over the parking lot tomorrow.
More info at HelpMeWithHIPAA.com/571
Cyberattacks are expensive—but just how expensive? This episode dives into a brand-new study that finally puts real numbers behind the financial impact of data breaches, using thousands of cyber insurance claims instead of scary headlines and wild guesses. From ransomware and business interruption to cyber insurance surprises, you'll discover why the biggest cost isn't always what you think. If you've ever wondered whether your organization is truly prepared for a breach—or just hoping insurance will magically save the day—this conversation is packed with practical insights, a few laughs, and plenty of reasons to take another look at your risk management strategy.
More info at HelpMeWithHIPAA.com/570
Think cybersecurity is all about how much money you throw at the problem? Think again. In this episode, we unpack the idea of the "cybersecurity poverty line" and why being under-protected isn't always about having an empty wallet. From outdated technology to missing expertise and leadership roadblocks, you'll discover why even organizations with healthy budgets can still leave the front door wide open to cybercriminals. If you've ever wondered whether your biggest security challenge is really your budget, or something else entirely, this conversation is for you.
More info at HelpMeWithHIPAA.com/569
If you’ve ever caught yourself saying, “We’re too small to be hacked,” or “That’s why we have cyber insurance,” you might want to keep reading. This episode shines a spotlight on five cybersecurity assumptions that seem perfectly reasonable – right up until they cost you time, money, or your sanity. From misplaced confidence in vendors to the myth that restoring your systems means the crisis is over, this conversation serves up practical reality checks with just enough humor to make the hard truths a little easier to swallow.
More info at HelpMeWithHIPAA.com/568
What do lava lamps, whoopee cushions, and HIPAA have in common? More than you’d think! This week, a familiar mall retailer famous for gag gifts and lava lamps finds itself at the center of an OCR enforcement action that highlights a common misconception about employer-sponsored health plans. Along the way, you’ll learn why “we’ve never had a problem before” isn’t a cybersecurity strategy, how self-funded health plans fit into HIPAA, and why ignoring compliance can quickly become a very expensive joke.
More info at HelpMeWithHIPAA.com/567
Ever wish you could get expert HIPAA advice straight from the source – without the invoice? This episode digs into a little-known offering: the “free consulting” that the Office for Civil Rights (OCR) actually gives out, if you know where to look. We break down the seven biggest lessons buried in official OCR videos and settlement guidance, covering everything from keeping tabs on your inventory (yes, all your data – even the digital version of an old truck growing weeds) to why risk management means more than doing paperwork once a year. If you’re in healthcare and want practical tips to avoid trouble before it makes the headlines, this episode’s for you.
More info at HelpMeWithHIPAA.com/566
Healthcare is rushing to adopt AI, but most organizations haven’t figured out what it really means to keep it in check. The HSCC just released an AI governance framework aimed at helping healthcare leaders get ahead of the curve—before “shadow AI” and unapproved tools turn into a bigger problem. This episode breaks down why AI governance isn’t just IT’s job, where most organizations are getting stuck, and the surprisingly simple questions privacy and compliance teams should be asking about AI before things go sideways.
More info at HelpMeWithHIPAA.com/565
AI isn’t just a buzzword anymore—it’s showing up everywhere in healthcare, whether you realize it or not. In this episode, we get honest about what it means to live and work with AI, why so many people still feel anxious (or even a little excited) about it, and why avoiding it altogether just isn’t an option. We dig into practical ways healthcare teams can safely experiment with AI in their daily routines, what to watch out for, and how the right approach can help you solve problems instead of just creating new ones. If you’ve been wondering how AI is changing the way you work—or if it really might replace your job—this one’s for you.
More info at HelpMeWithHIPAA.com/564
Are healthcare organizations overcomplicating cybersecurity and missing the basics? In this episode, Donna and David break down the newest Verizon Data Breach Investigations Report and what it really means for hospitals, clinics, and business associates. Despite all the AI headlines and talk about new threats, most breaches still come down to old-school problems—missed patches, credential abuse, and human mistakes. The fundamentals aren’t glamorous, but they’re what keep your data safe. If you’ve ever wondered whether all the new risks really change the game for HIPAA compliance, this episode will help you cut through the noise and focus on what actually matters.
More info at HelpMeWithHIPAA.com/563
How much should we really trust the systems and people we rely on every day? This week, we’re looking at how trust itself can open the door to risk – whether it’s attackers using AI to speed up finding software flaws, insider threats turning frustration into vulnerability, or the limits of encryption we thought was unbreakable. As healthcare organizations try to keep up, these aren’t just tech problems – they’re operational headaches and policy questions that hit close to home. And yes, the pace of change is only picking up.
More info at HelpMeWithHIPAA.com/562
AI is showing up everywhere these days like ketchup at a backyard cookout — apparently it belongs on absolutely everything. But as this episode points out, tossing AI into healthcare operations without governance is basically just upgrading your chaos to premium speed. Using insights from a massive global digital health study, the conversation explores why leadership, oversight, and workforce engagement still matter far more than simply throwing AI, cloud apps, and a little “digital transformation seasoning” on every problem. From forgotten integrations and mystery AI tools to the hard truth that automating a bad process just gives you faster bad results, this episode delivers equal parts practical strategy, healthcare reality checks, and painfully accurate tech humor.
More info at HelpMeWithHIPAA.com/561
Cybercrime has officially entered its “hold my beer” era. In this episode, we break down the FBI’s annual Internet Crime Complaint Center report and the numbers are equal parts fascinating and horrifying. We’re talking over $20 billion in reported losses, exploding ransomware attacks, AI-powered scams, fake charities, romance cons, business email compromises, and criminals who apparently work harder than some middle managers. It’s a practical, eye-opening look at how modern scams actually work — and why staying skeptical online may now qualify as a survival skill.
More info at HelpMeWithHIPAA.com/560
If you’ve ever wondered what happens when ransomware, bad decisions, cyber insurance confusion, and TikTok tech advice all collide in one spectacular dumpster fire… this episode is for you. The conversation dives into four fresh OCR enforcement actions that all share one painfully common theme: nobody did a proper risk analysis until after everything caught on fire. Add in cybersecurity “professionals” secretly helping ransomware gangs and business owners trying to replace enterprise security tools with AI-generated software from TikTok, and you’ve got an episode that somehow manages to be both educational and deeply concerning.
More info at HelpMeWithHIPAA.com/559
