Ghosts of HIPAA Past – Ten Years Later – Ep 584 

Ten years ago, we took a terrifying tour through the Cyber Scary Haunted House. Now, 507 episodes later, we’re going back to see if anybody ever cleaned the place up. Spoiler alert: They didn’t! The same old cybersecurity monsters are still lurking around, some have gotten even scarier, and AI has opened an entirely new wing of horrors. Join us for our annual Halloween episode as we revisit the ghosts of HIPAA past, meet some frightening new residents, and discuss what healthcare organizations can do to keep these monsters from haunting their patients.

In this episode:

Ghosts of HIPAA Past – Ten Years Later – Ep 584

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Want to document this episode for your HIPAA training?

Download your training documentation pdf.

Episode Roadmap

Ghosts of HIPAA Past – Ten Years Later

Ten years after Episode 77 (Scary HIPAA Stories) , we return to the same Haunted House. We discover that the original monsters never left, some have gained new powers, and an entire new wing has appeared.

Ten years later, we’ve gotten older, but the cybersecurity problems haven’t matured a bit. Of course, neither have we, but that’s beside the point.

Ten years and 507 episodes later, we’re back in the same haunted house. And apparently nobody’s cleaned the place!

1. Returning to the haunted house

Don’t Make It Easy for Them – Ep 577

• Ten years ago, October 28, 2016, our second Halloween episode #77.
• We decided to return to see what’s happened to the place.

2. The ghosts that never left

• Those were alarming numbers in 2016, not current statistics.
• Malware, malicious websites, botnets, compromised devices: still here.
• Ransomware was already a major concern in 2016. It certainly didn’t disappear.
• What’s changed? Criminal operations, extortion methods, attack surfaces, and the scale of disruption.
• AI can now make some familiar attack techniques faster, cheaper, or more convincing.

3. The room where your life was repackaged and resold

• Ten years ago, we were talking about stolen medical information and the long-term consequences for patients.
• The organization may recover, but the patient’s information doesn’t become private again.
• Criminals can exploit stolen information long after the original breach.
• New dimension: AI-enabled impersonation, convincing fake communications, and the ability to process stolen information at scale.
• This isn’t just about breach costs. It’s about the people whose information was entrusted to the organization.
• The same old monster, with new ways to exploit its victims.

4. The Crypt of Things We Thought We’d Buried

• We open the crypt. These problems were supposed to be buried years ago.
• Unsupported technology, old systems attached to medical devices, inadequate security risk analyses.
• The belief that small organizations aren’t targets.
• Policies that exist but aren’t followed.
• Security decisions driven by what can be postponed rather than what risks need to be managed.

Today, the impersonation might be much more convincing, but the importance of reporting quickly hasn’t changed.

5. The new AI wing: An entirely new generation of monsters

We’ve survived the old rooms. We think we’re leaving.

GRAND OPENING: THE AI WING

“Management assures us everything is under control.”

• First, AI gave some of the old monsters renewed energy.
• But that’s not the whole story.
• AI isn’t just making the old monsters more dangerous. It’s creating entirely new monsters.

The Shape-Shifter

• Deepfakes, voice cloning, and impersonation.
• What happens when seeing or hearing someone is no longer enough to know it’s really them?
• Can our existing verification procedures handle this?

The Invisible Employee

• Shadow AI being used without organizational knowledge or approval.
• Employees sharing sensitive information with AI tools.
• AI applications gaining access to systems and information without adequate review.
• Agents being set free

The Hall of Mirrors

• AI-generated answers that look and sound authoritative but can be wrong.
• Fabricated information, false confidence, and people trusting the output without verification.
• The danger grows when those answers influence patient care, privacy, security, or business decisions.

The Mad Scientist’s Laboratory

• AI agents connected to other systems, with tools and permissions to take actions.
• Who decides what they’re allowed to do?
• Who knows what they’ve done?
• Who can stop them?

Bring the discussion back to reality

• AI can help defenders, too. This isn’t an argument against using it.
• The problem is deploying capabilities without appropriate security, governance, oversight, and accountability.
• Human responsibility doesn’t disappear just because technology can perform a task.

6. The escape

• We’ve discovered the original monsters are still here.
• Some are more powerful.
• New monsters have moved in.
• The haunted house is expanding.
• But the answer isn’t to run screaming from technology.
• Know what you have, assess the risks, secure it, manage it, and keep humans accountable.
• Cyber safety is patient safety.

Well, we survived another trip through the Cyber Scary Haunted House, but apparently nobody’s been keeping up with the maintenance! Ten years later, the same old monsters are still lurking around, some have gotten even nastier, and AI has moved in with an entirely new collection of nightmares. The good news is that we don’t have to be afraid of every new technology or cybersecurity threat. We just have to know what we’re dealing with, understand the risks, and make sure we’re managing them. Because when it comes to protecting patient information and keeping healthcare organizations running, ignoring the monsters doesn’t make them disappear. And whatever you do, don’t let the AI answer the door!

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.