A HIPAA shake-up?

Donna Grindle: Where it stands today, we tell people if all you're doing is worrying about compliance with HIPAA, you're not secure. And the privacy rules are pretty solid for the most part, but the security rules, you know, they haven't changed since the original rules. And as I point out, they became official, the majority of them, 2005, two years before the iPhone was introduced.

Dave Bittner: Hello, everyone, and welcome to "Caveat," N2K CyberWire's privacy, surveillance, law, and policy podcast. I'm Dave Bittner. And joining me is my co-host Ben Yelin from the University of Maryland Center for Health and Homeland Security. Hey, Ben.

Ben Yelin: Hello, Dave.

Dave Bittner: On today's show, Ben has the story of a new frontier in the encryption wars coming from the UK. I look at the latest spree of firings from DOGE. And later in the show, I'm joined by the one and only Donna Grindle, CEO at Kardon, and co-host of the Help Me With HIPAA podcast. While this show covers legal topics, and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. All right, Ben. We've got some interesting things to share this week. Why don't you start things off for us?

Ben Yelin: So we have a new frontier in the encryption wars that I wasn't really expecting, and it comes from our friends across the pond in the United Kingdom.

Dave Bittner: Yeah.

Ben Yelin: So we just found this out a couple of weeks ago. The order was issued in December, but it had remained classified. So what this order did is it directs Apple to create a backdoor into its advanced data protection offering, which allows users such as me and you, devoted Apple users -- that is not a sponsorship thing. We seriously both have Apple products. So it allows users to fully encrypt data from iPhones and computers, putting it into iCloud.

Dave Bittner: Right.

Ben Yelin: Obviously, this prevents Apple, even, from retrieving that data. But the UK has a law called the Investigatory Powers Act, which allows the British Home Office to compel Apple to cooperate and forbids these companies from disclosing anything about the demand. So they issue a demand to a company, say Apple, that says we need data on an individual user. And if you can't reach that data, then you need to create a backdoor so that we can access that data. So this is kind of a bombshell. It's been a while since we have been knee-deep in the encryption wars. This is obviously a story going back a decade or more. I always think about Apple versus FBI in trying to decrypt the device of the San Bernardino shooter. And now it's happening in the United Kingdom. So a couple of interesting angles here. The first is that this is going to have an impact on the United States. And Washington Post had a really interesting article about a letter sent by ideological opposites in Congress. Senator Ron Wyden, who we probably have mentioned 100 times on this podcast.

Dave Bittner: We refer to him on this show as the usual suspect.

Ben Yelin: The usual suspect. Yeah. And then in the House side, it's like a Tea Party Trumpy Conservative member, Representative Andy Biggs. And they sent a letter to the new Director of National Intelligence, Tulsi Gabbard, basically saying this is a huge concern not just for residents of the United Kingdom but for US persons because we have a very close working relationship with the United Kingdom when it comes to signals intelligence. We are both part of Five Eyes, those five English-speaking countries that share data with one another. And if the UK is requiring Apple to decrypt its own information, its own devices, its own networks, then that's going to filter down into the United States if we're constantly sharing data with one another. And then that could have downstream effects. We've talked about the US-EU privacy shield, which is contingent on companies that are a party to that agreement protecting their data. Now in case you've been in a coma for the last 10 years, the United Kingdom is no longer part of the European Union. But, again, this is the type of thing that filters down. If the US, through its relationship with Five Eyes and just generally through its close working relationship with British signals intelligence authorities, is getting access to data that was created through this backdoor, then that could have an impact on the US-EU privacy shield, which is very important for us economically. So I don't know exactly what Tulsi Gabbard thinks about this, let alone really anything. But it's one of the things where she has expressed support for civil liberties in the past. She's made comments talking about the dangers of creating backdoors, about breaking encryption, about compelling companies to break their own encryption. So she's had some hints that that underlies her belief, which I think is a positive sign. But I'm wondering what the US can do to push back against this. It is obviously the sovereign choice of another country. But if we start to threaten some of our bilateral or multilateral agreements, then maybe we could convince our UK counterparts to reverse this action. So that's really an interesting angle. And then this is just kind of part of a broader story in the UK of a government pushback against big tech. They elected a new government last year. That's a center-left government. And in just a number of realms, including for things like hate speech, they've been pretty aggressive in attacking big tech companies. And this is just kind of the latest front for that battle. So I just thought this was a really interesting story. It surprised me. I wasn't expecting to see this from the United Kingdom. And I think it's caused a big backlash among the usual suspects who care about electronic privacy, both here and in the UK.

Dave Bittner: Yeah. One of the things that I thought was, I don't know, chilling, sobering about this story, and correct me if my perception is wrong here, but my understanding is that the only reason we know about this is because it was leaked.

Ben Yelin: That's absolutely true. So anything -- and I do not pretend to be an expert in the relevant law, the Investigatory Powers Act that was issued by British Home Office. But these are -- these orders are supposed to say confidential. So it's kind of like a FISA court order in the United States, where they are ex parte proceedings. And in the United States, maybe we get a redacted, released court case two or three years down the line. But largely, these are things that are kept confidential, and that was the case in the UK. You're right. We only heard about this because it was leaked. And that's very disturbing, obviously, from a transparency perspective. There is no democratic, small d, democratic accountability. People have no idea what their government is doing. And I think it's certainly a disturbing part of the story.

Dave Bittner: Yeah. I also wonder about the technical aspects of this because, you know, a lot of the folks who enable end-to-end encryption, Apple among them, but you think about apps like Signal, where they claim, rightfully, that even they can't look inside of things. You know, if your stuff is encrypted end to end, Apple doesn't have a key to look into that. Signal doesn't have a key to look into that. But what we're seeing here is the UK is saying --

Ben Yelin: Make a GD key.

Dave Bittner: Right. Make a key. Don't tell anybody, right? So your users think that they still are operating securely. Presumably, they're not. Now here's a question for you.

Ben Yelin: Yeah.

Dave Bittner: Does Apple have an obligation to change their terms of service? Or is this, because this is a secret order, does that give Apple the option or requirement to basically lie to their users?

Ben Yelin: It's a great question for which I do not have the answer.

Dave Bittner: Okay.

Ben Yelin: If this was not a secret program, I think they would have an obligation to say that if your data travels through the United Kingdom, there is a chance that it will go through this backdoor that has forced us to decrypt ourselves. But we kind of just learned about this a couple of weeks ago. I don't think any of the principals here have acknowledged this on the record, if I'm correct. So I don't know exactly what Apple is going to do. I think since this is out there, and it's become an international story, to me they do have an obligation to include that in their terms of service. Now they'd be very loathed to do that because that's not how they've marketed themselves for the last decade or more. I mean, they value data privacy. They are the company that always stands by your data, and that's a big part of their appeal. That's why a lot of people use Apple products. And so this would badly cut against that reputation. But even though it's not Apple's fault, they were forced to do this, they're being compelled by the UK government, I do think it does give them an ethical obligation to inform the users here.

Dave Bittner: Should we assume then that not just Apple but all the major cloud suppliers have been served with a similar message?

Ben Yelin: I would guess so. I don't think whatever the order was was just limited to Apple. I think the reason this is an Apple story is just because of Apple's market share. The iCloud is bigger than any other data storage from another company.

Dave Bittner: I see. For consumers.

Ben Yelin: Yeah. And I think the order -- so there's the policy and then the specific order that was issued toward Apple. I think the policy applies to every company that has encrypted data. But I think the leaked story was specifically about the order that went out to Apple to create this backdoor for advanced data protection.

Dave Bittner: So how much would this be similar to Section 702, in that, since this is a UK order, presumably is designed for people in the UK or people communicating with people in the UK? So what I'm asking is, let's say I'm an Apple user here in the US, and I'm communicating with you over -- we're using iCloud technology. We're sharing files. We're doing all that kind of stuff.

Ben Yelin: And I am a British person in this scenario.

Dave Bittner: No. Let's start off with you being in the US.

Ben Yelin: A US person. Okay. I was going to put on my accent, but I'll hold off for a second.

Dave Bittner: So we're completely domestic for the time being. Safe to say that under this order, the UK would not have a window into what we're doing.

Ben Yelin: Seemingly not, because this only applies to communications housed in the United Kingdom. So yes, seemingly, in the United States, we're safe, although you never know where data travels. I mean, there are things like mirror servers, where, for stored communications, you have facilities all over the world. We've studied that in the context of our own surveillance laws, especially Executive Order 1233, which governs our surveillance overseas when we're out of the realm of FISA and Section 702. And I think that's relevant here that even a communication between two US persons can end up overseas, and then looser intelligence rules apply. So if our communications end up in the United Kingdom, they could still be decrypted there. Now I don't know, you know -- it's hard for me to know anything about the so-called series of tubes.

Dave Bittner: Yeah. Well, I mean, this is -- obviously, we are wildly speculating now. But that's okay because, you know, it's fun, and these are interesting things to ponder.

Ben Yelin: Yeah, we can do what we want.

Dave Bittner: Well, so I guess if I put on my tinfoil hat, I could imagine a scenario where, let's say, some US law enforcement agency wanted a window into the communications between the two of us. Rather than breaking into those communications, what if they changed some routing tables so that anything between the two of us made a round trip to the UK and back?

Ben Yelin: A nice round trip on British Airways?

Dave Bittner: Right.

Ben Yelin: British underseas cables.

Dave Bittner: Right. Right. So we would never know. It wouldn't affect, you know, how the traffic flows as far as we're concerned. But is this a possibility?

Ben Yelin: Sure, I'd be worried about that. And, again, that's the type of thing that's going to implicate the EU-US privacy shield, right? Because if these EU countries know that not only their own communications but US communications are traveling through this wild west of the United Kingdom, where at least the government has the capability to compel companies to hand over encrypted communications, then why -- I mean, they'd have to make some sort of adjustment to the privacy shield to say, you know, we're restricting communications that travel through the United Kingdom, or some type of policy. And any interruption in the EU-US privacy shield is going to be tough to negotiate and also is going to have downstream economic impacts. So yeah, I think that's absolutely a concern.

Dave Bittner: I also think about how Apple famously stood up to the FBI when it came to decrypting some iPhones. And do we suppose Apple could do that in this case?

Ben Yelin: The reporting has not indicated that that has happened yet. If you look at, like, the outrage quotes and the articles, they're from people, public interest organizations in both the United States and the UK, former officials who used to work for the Home Office. But we haven't seen any direct communication from Apple itself. Part of it is that this has just been declassified through a leak, so we just haven't had enough time. But I would not be surprised at all if Apple is fighting this in the courts. And I think eventually that'll filter into their public communications because I think this bears so heavily on their reputation.

Dave Bittner: Right. But I also wonder, like, you think about what kind of a stick does the UK government have, right? And let's say this never leaked. Okay? So it was a secret program, and the UK government goes to Apple and they say we want you to make this backdoor. And Apple says no way, we're not going to do that, you know, bug off. And the UK says no, you have to do this, or we're not going to let you do business in the UK, for example. Right?

Ben Yelin: I'm wondering if, like, Apple could withstand that, you know, call their bluff. How many people --

Dave Bittner: So what I'm thinking, though, is imagine what would happen if both the Apple and the UK said --

Ben Yelin: The Apple.

Dave Bittner: Apple and the UK said, "Hey, Apple is not doing business in the UK anymore because secrets." Right?

Ben Yelin: Right. Because there's something that we can't tell you exactly what it is.

Dave Bittner: Right.

Ben Yelin: Yeah. I think Apple could potentially have that leverage, and then everybody would start to wonder. I mean, you saw the freakout when they took TikTok away in the United States for one day. Imagine all of a sudden they don't sell iPhones in the United Kingdom. I think that would -- that would be a big problem. So I think Apple does have substantial leverage here. You know, ultimately, this is also a cybersecurity story, because when you create a backdoor, it's not just going to be law enforcement that comes in your back door. If I open the back door to my house and said, "I want this open, so just in case the police need to come in to protect me," I'm also leaving that door open to potential cyber criminals.

Dave Bittner: Right. Right.

Ben Yelin: So I think there is a very serious element of this that would make me concerned from a cybersecurity perspective. And I'm hoping that the Home Office in the UK has taken that into consideration in promulgating this policy because that's always been, I think, the best argument against backdoors is once you cross that Rubicon, the door is going to be open for malign actors. And, you know, that's kind of the universal warning that's always been at the center of these encryption wars.

Dave Bittner: Well, as we well learned here with our telecommunications companies and China being able to take advantage of the backdoors that were built into them.

Ben Yelin: Absolutely. And that's one of the things that Wyden and Biggs in their article mention is we literally just saw this happen with China. And I think that highlights the vulnerability here.

Dave Bittner: All right. Well, we will have a link to that story in our show notes. I am going to head down to Washington and continue our ongoing discussion of what's going on with Elon Musk and DOGE and the sweeping cuts that are taking place. It is -- it's all happening so quickly.

Ben Yelin: It is.

Dave Bittner: And so chaotically that it is hard to keep track of what's going on. There are so many lawsuits swirling around. The two stories I'm highlighting here, one is there's a gentleman who oversaw information security at the VA who got let go. He got fired amid some of the mass layoffs. His name was Jonathan Kamens. He was an information security lead for va.gov. And he got fired amongst this DOGE restructuring. He was an employee of the US Digital Service, which is the department that became DOGE. Kamens says that the firings are illegal. And he says that these cuts are going to weaken cybersecurity protections for veterans' data. It's hard to, I think, argue with that if your lead security people are being fired without warning, no plans for any sort of transition. These people are just gone.

Ben Yelin: So, like, taking a step back here, how they're going about this. So what Elon Musk has done in other companies is just like identify parts of your organization or sectors or teams that he thinks are useless, and he just fires everybody.

Dave Bittner: Right.

Ben Yelin: You can't really do that because of civil service protection in the United States. You can't just go in and fire everyone, although I wouldn't put it past these guys if they try and do it and, you know, make the court enforce it. But right now, what they're doing is firing the people they can fire. And that usually pertains to people in their probationary period. So if you've been in the federal government, usually, it's a year for less than a year. That's the low-hanging fruit. I think that's a backwards way of going about this because that is depriving a lot of these agencies of young, dynamic talent. Like, when you're picturing a lazy government bureaucrat, you're thinking about people who've been entrenched in these agencies for years. And those are the people who are not getting fired. Instead, you're attacking recent college graduates or people with advanced technical skills. The probationary period is different as it applies to this agency that you're referencing in this piece on the Boston man overseeing VA information security, because that agency has term limits. But he was still under his probationary period. So it's just the absolute dumbest way to go about this, and they're doing it in a way that's indiscriminate. And I'll give you the best example from this weekend, which is almost cartoonish in how ridiculous it is. They fired a bunch of people who work for the government agency that monitors nuclear weapons. So there's a bunch of nuclear engineers. Obviously, that's a high-skilled job, to put it mildly.

Dave Bittner: Kind of an important job.

Ben Yelin: Yeah. They were all fired. Apparently, DOGE didn't realize that they were firing the foremost experts in nuclear security, despite the fact that that's kind -- that was kind of implied in the agency's name. So they desperately were calling these people individually to try and rehire them over the weekend. And apparently, they partially succeeded. If I were one of those nuclear scientists, and I had been summarily fired based on this arbitrary process, I would have bargained for a significant salary increase.

Dave Bittner: Right. Right.

Ben Yelin: Right. Maybe they are better public servants than I am. But it just makes -- it makes absolutely no sense. There is a way to do this where, if you were actually concerned about government efficiency, you'd have a methodical process. You would loosen the rules around hiring and firing in the federal government to make it easier, for example, to fire people based on performance. You would do that through some type of act of Congress. It would be a long-term process. The philosophy of Elon and his DOGE team is barge in and break things. And then if we need to reassemble them, we can do that once we've established that there is a need for a type of team. That's great when it comes to X, Twitter, or Tesla, or even SpaceX. Not great when it comes to nuclear security or air traffic controllers, for that matter. It's just not well suited for the government. And it's kind of crazy.

Dave Bittner: Yeah. And it points to this thing that sort of drives me to distraction. You hear folks say that we need to run the government more like a business. And I get what they're saying. But at the same time, government is government and business is business, and they are two very different things.

Ben Yelin: Right. I mean, for one, businesses can't print their own money.

Dave Bittner: Right. Right.

Ben Yelin: Businesses generally do not have an army or a navy or an air force. And businesses generally don't run retirement/medical programs for millions and millions of people, things that people are dependent on for their own livelihood.

Dave Bittner: I think another example I read over the weekend when you talk about this probationary period, there was an example I saw of a woman who was in a very senior position, who was seen as being a critical member of the team that she was on. I believe this was a research organization, you know, responsible for fundamental research. I can't remember if it was medicine or science, but something like that. And she had been recently promoted because of her excellent performance. She'd been promoted to a new position. But because she was put in a new position, she was probationary in the new position, despite her 20-plus years of government service.

Ben Yelin: It makes no sense. I mean, they're doing it because that's the one thing they can do to immediately decrease the federal workforce. It makes no logical sense whatsoever. And that's a perfect example of it. It's just -- it's reckless. And in the long run, is this something that's actually going to reduce our federal deficit? Maybe. You know, we're all -- we're tinkering around the margins here because most of federal spending is on things like Social Security, Medicare, national defense.

Dave Bittner: The federal employees are only like 4% of the budget, something like that.

Ben Yelin: Yeah. And, you know, everybody freaks out about foreign aid when that's less than 1% of our federal budget. But something is going to happen. Bad things happen all the time. And either our ability to respond to it or our ability to anticipate it, whether it's a terrorist attack, whether it's a new infectious disease, whether it's airplanes falling out of the sky. Like, eventually, we're going to suffer because of a dearth of expertise because we were just indiscriminately firing people over a weekend, even though some of these people might be the best and the brightest of government employees. So, again, like, this is not to say that there isn't waste and fraud in these organizations. You know, I think that's kind of the strawman that Musk and his team are using. Like, oh, I can't believe that people would be so against rooting out waste and fraud in our governments. You know, I get that. It's a clever line. But this is just not the way to do it.

Dave Bittner: So there are 14 states. The attorneys general from 14 states are suing to challenge Elon Musk's authority. They say in the lawsuit that the actions taken by Musk at the helm of DOGE can only be taken by a nominated and Senate-confirmed official. They cite constitutional provisions that delineate the powers of Congress and the President. Ben, you are much more a constitutional scholar than I am. Do you think they have a point here?

Ben Yelin: I don't think the case is going well -- this particular case is going well for the attorneys general. They had a preliminary hearing on it. The attorneys general are looking for a temporary restraining order. They were a little late, I think, in filing for this, so it kind of negates their argument that this is an emergency. And I think the judge was trying to make that point in the proceedings. The government is also kind of ridiculously, but, you know, this is what they're saying, that Elon Musk isn't actually the head of DOGE. He's a presidential advisor.

Dave Bittner: Right.

Ben Yelin: And that DOGE -- the actual actions are being carried out by people who work for the agencies themselves. Sure, you know.

Dave Bittner: He's like Schrodinger's --

Ben Yelin: Schrodinger's billionaire.

Dave Bittner: Yeah, he is simultaneously both the leader of DOGE and has no connection or responsibility at all.

Ben Yelin: Exactly. I mean, he's the one bragging, like I shut this down. But I think what the government is saying in these cases is don't listen to what he says, but, like, here's how it's actually working. He's an advisor to the president, the way any other domestic policy advisor has their position, which is not subject to Senate confirmation. He's giving advice to DOGE members who actually work for these agencies, and many of these agencies do have confirmed heads. Now is this how this is actually working in practice? No, of course not. But it's a plausible legal argument. And this is the one case where I kind of think those attorneys general are going to lose. Now they've had a lot of success in other cases. The government has tried to do some pretty reckless things, like shutting off -- immediately shutting off all grants and loans from the entire federal government to root out DEI. And that was stopped rather quickly through a temporary restraining order. One that I know is very relevant to the university community is that they put a cap on indirect costs for NIH grants at 15%, which is way lower than most institutions are able to handle, because just to conduct scientific research, you have to spend a lot of money on things like facilities and grants management. And all of that exceeds 15%. So it would have been like an extinction level event for a lot of research institutions. And there's been a temporary restraining order on that as well. So they are having -- people are having some success in having courts put a stop to this. But I don't think the facial challenge to DOGE itself and Musk's role in it is likely to be successful, in my opinion.

Dave Bittner: All right. Interesting. Well, we will have links to all of these stories in our show notes. And, of course, we would love to hear from you, if there's something you'd like us to consider for the show. You can email us. It's caveat@n2k.com. [ Music ] Ben, I am super excited for our guest this week. It is the one and only Donna Grindle, who is CEO at Kardon and also the co-host of the Help Me With HIPAA podcast. She has been a guest on our show before, always delightful, and this is no exception. Here's my conversation with Donna Grindle. Donna, welcome back. It is so great to have you back with us on Caveat here. And before we dig into the topic at hand, for folks who have not heard you on the show before, can you give us a little bit of your own background and tell us a little bit about the Help Me With HIPAA podcast?

Donna Grindle: Oh, sure. So I got my start way back in the previous century doing software development for healthcare, electronic claims, actually. And so I really am still a data nerd and love that. But since that time, I've evolved into so many different roles. We ran a managed service provider, and then I realized I don't care if you can't print, so that's not a good business. And so -- but starting in 2012, we really became focused on helping companies manage HIPAA privacy and security requirements because all the changes that we're rolling out. And that's been our focus. And, you know, no one was listening to me then. But amazingly now, a lot of people are interested. And we stay very, very busy in focusing on the small and medium market because, you know, there's not a lot of folks that really do focus on how do they manage cybersecurity and privacy.

Dave Bittner: Well, as I mentioned, you are the co-host of the Help Me With HIPAA podcast, which is a great place to go to stay up on the latest. I want to start off just by kind of level setting, because it's been a little while since you and I have spoken. If you were to just describe to someone what the current state of HIPAA is, where we stand with that regulation, what would you say?

Donna Grindle: Well, where it stands today, we tell people, if all you're doing is worrying about compliance with HIPAA, you're not secure. And the privacy rules are pretty solid for the most part, but the security rules, you know, they haven't changed since the original rules. And as I point out, they came -- became official, the majority of them, 2005, two years before the iPhone was introduced. And you just think about that for a second and realize those are the same security rules we're using today. Now it's great news. They've been adaptable. And if you understood and knew how to adapt them, it'd be great. But if all you're doing is HIPAA compliance for a security standpoint, you're not secure. That's great, right?

Dave Bittner: What sort of things are you recommending, then, for folks to go beyond just that kind of checkbox compliance mode?

Donna Grindle: Well, one of the things I'm really active in is the Health Sector Coordinating Council Cybersecurity Working Group. You know, we use acronyms for that. HSCC. And they work with HHS on the 405(d) projects, which is providing the Health Industry Cybersecurity Practices, which is industry-specific recommendations based on the size and complexity of your organization. And there is an amendment they added, the high tech that said if you could prove you're doing those things, then we'll take that into consideration should we do any audits or those kind of things. But it's completely optional. You don't have to do it. So, again, if you're doing minimal compliance, you're not going to care. We have been encouraging folks since 2019 to adopt those practices. And then that amendment came out in 2021. And we've really been pushed since then. So that's been the focus is get educated and don't assume that what you've always done is correct in the first place. And then utilize these resources that are available to help direct your decision making.

Dave Bittner: Well, as we're in the closing days of the Biden administration, President Biden has indicated some changes coming to HIPAA through, I believe, executive order. What sort of things are they proposing?

Donna Grindle: Well, actually, they have a notice of proposed rulemaking that just came out. It's well over 100 pages of detail. And the NPRM is great because it tells you why they're making these suggestions. But the vast majority of the changes are prescriptive, where, today, it says, you know, you have to have encryption in transit, but encryption at rest can be what is called adaptable or addressable. Adaptable. I don't know where that came from. Addressable. And first thing they're doing is saying, well, we're getting rid of addressable. There's no such thing anymore. We're used to you could evaluate everything and come up with compensating controls on encryption at rest. They're saying no, that's gone. You need encryption at rest. So that's simple, right? You don't do an assessment anymore. You just know you got to do it. On the flip side, though, it's actually being very specific about, you know, the security risk analysis, because HIPAA is a risk-based standard. And if you're not evaluating your risk properly, then everything else fails. Right? And it's like the number one failure that we run across. And it's kind of the reason that the first time you do an assessment with Kardon, or if you sit down and listen to the Help Me With HIPAA podcast that's telling you how to do these things, you're overwhelmed because it's like, well, we've never done it that way before. And so many haven't. I mean, we've even had IT people say, well, this isn't the way it's done. You don't have to do this. And I said there is a little bit of that joy of I told you so when you read the NPRM. But we're trying not to dance or anything.

Dave Bittner: Well, help me understand. I mean, is this -- are these changes bringing HIPAA into the modern era? Are we seeing -- is this better alignment?

Donna Grindle: Yes, because there are changes that are not just this -- a lot of the changes are saying this is what we meant all along. You should have been doing this. You need to have a technology inventory. You must have one. It should have been part of a security risk analysis, no matter how you look at it. But we're going to tell you exactly you have to have that. But also, there are things like you must have network segmentation. Hey, great idea. And particularly, you look in healthcare where you've got, you know, the business area. You've got the clinical area. You've got the treatment devices. All of those things, you can segment a lot of that out. But that was never even on the radar, except under the Health Industry Cybersecurity Practices, which, by the way, we do call HICP, because nerds. And so HICP says do network segmentation, but nothing in HIPAA alluded to that unless someone suggested it. Right? And then you say, well, yeah, we'll do that. But there are plenty of those things in there that will narrow that down and really push towards the HICP standards. And if you've been doing HICP, you're going to have -- if you've been doing HICP and documenting properly, this is not terrifying. But if you haven't, you need to get started now.

Dave Bittner: What's your advice for that person at the rural hospital who's been tasked with handling this? You know, is their job to secure things to the best they can with the resources they have? Do you have any words of wisdom there?

Donna Grindle: Well, I mean, the same goes for most small practices, too. It's the same thing. You don't have the resources, and we know that. But at the same time, this is the, you know, the thing that protects the blood that runs the technology, because if the security isn't there, and you lose all the technology, then you're short even more resources. And so it has to be -- the number one thing is education, because if you're not getting educated on what's required, and you're not working with leadership to get them educated on what's required, you're staying where you are is what we're seeing. I mean, you're just going to trade water, and not smartly invest. So find a way to get educated. We have things we do once a year, and we're already getting beat up on how many we've got. We need to do more. We call it our HIPAA boot camp. Or, well, now we call it our PrivSec boot camp, because we need to worry about privacy and security, not regulations is my theory, because it changes the way you see things and brings patient safety into the fold. So we call it the PrivSec boot camp, and it's four days now. We started years ago, and it was two days. Then it became two and a half. Then three, three and a half. Now it's four. And I don't know that I could do a fifth. And --

Dave Bittner: Sounds like you got yourself a little feature creep there, Donna.

Donna Grindle: Well, you know, it's like every time you turn around, the bad guys are learning some new way to get around you, you know.

Dave Bittner: Right. Right.

Donna Grindle: Overall, if you get educated with these free resources, HSCC has free resources at the Health Sector Coordinating Council, I think it's dot org. healthsectorcouncil.org. We have free resources. There's even training for clinicians about cybersecurity done by physicians. And, you know, we're doing everything we can and making it freely available to help all of those folks who are in that bind. And there's training on the 405(d) website that you can download and put it in a knowledge-based system. There's posters and guides and newsletters and all kinds of stuff, if you will, that are created in conjunction with HHS. And then HSCC, we build our own that are by the industry for the industry. So go use those resources. Go evaluate the USDA. We're just learning about the USDA has a program that will allow these rural areas to get funding that helps with rural health. And it's interesting to see all of the different angles that we can work with rural health entities. And that alone -- that work with rural health entities and small entities, whether they're -- no matter where they are is the one that I'm most passionate about, because otherwise, our healthcare, you know, just ends up being the big health system corporation approach. And I came from a small town. You know, you called up the doctor and said, "Hey, you know, I got to come by. I'm going to be in town today. Can I come by?" So that that's the big thing. Can we keep mustering these resources? And there are some bills being proposed in Congress that find ways to add funding for all entities because we know this costs money. [ Music ] Ben, what do you think?

Ben Yelin: I love having Donna on the pod again.

Dave Bittner: Right?

Ben Yelin: She's one of our best guests of all time. Love her podcast. So it was just great to have her.

Dave Bittner: No, she's absolutely delightful, and not to mention just expert knowledge when it comes to these things. So always a treat to have her on and help us figure out all the details. So again, do check out the Help Me With HIPAA podcast. And we appreciate Donna Grindle taking the time for us. [ Music ] That is "Caveat," brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your -- please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to caveat@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Tre Hester. Peter Kilpe is our publisher. I'm Dave Bitner.

Ben Yelin: And I'm Ben Yelin.

Dave Bittner: Thanks for listening.