Cybersecurity and resilience.

Every sourced item on this beat, newest first, each read for the roles it touches. Every weekday morning.

Announced1 sourceFor patients and employeesWednesday, November 11, 2026

Chief AI Officer CISO CIO and CTO Compliance

Microsoft shows agent models can be backdoored by editing fewer than ten neurons

Microsoft Research released threat research showing that a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload. Microsoft also found that frontier agents can detect the threat by identifying anomalous weight edits.

Do this week. Add model provenance and weight integrity checks to the contract and intake review for every fine-tuned or open-weight model running in your environment. Run this

The claim.: Microsoft says the sleeper agent threat is detectable by frontier agents, which can identify anomalous weight edits.
The evidence.: This is Microsoft's own research, and no independent replication is cited.

For the Chief AI Officer. List every model in production with its origin and who could have modified its weights, and brief the board on the gaps.

For the CISO and security. Add weight tampering to the AI threat model and ask vendors how they verify model integrity before and after deployment.

Disclosure at publication: Ecofy is in the Microsoft partner program; Microsoft is one of the platforms it implements for clients.

Read the full item

Sources:Microsoft Security Blog

Announced2 sourcesFor employees and patientsTuesday, November 10, 2026

Chief AI Officer CISO CIO and CTO Compliance

Clear adds identity verification for outside providers and controlled-substance prescribing in Epic

Clear has launched two integrations with Epic, making its CLEAR1 identity platform available through Epic Toolbox for EpicCare Link and electronic prescribing of controlled substances, Becker's Hospital Review reports. The integrations let health systems verify outside providers accessing patient records and clinicians prescribing controlled substances. HIT Consultant reports it includes self-service onboarding for community providers in EpicCare Link.

Do this week. Audit how outside users of your EpicCare Link instance are identity-proofed today and decide whether in-workflow verification closes a gap. Run this

The claim.: Clear says the integrations eliminate manual administrative steps by embedding identity proofing in Epic workflows, per HIT Consultant.
The evidence.: No independent evidence on security or time outcomes exists yet; the information comes from the company's Nov. 9 release.

For the Chief AI Officer. Add identity verification of external and AI-adjacent users to the governance checklist for Epic-connected tools.

For the CISO and security. Inventory community provider accounts in EpicCare Link and their proofing method to size the outside-access risk.

Disclosure at publication: Ecofy orchestrates Epic for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Hospital Review HIT Consultant

Reported2 sourcesFor patients and employeesMonday, November 9, 2026

Chief AI Officer CISO Compliance CHRO

Hoag and Delta Dental of Missouri face separate data incidents

Hoag Memorial Hospital Presbyterian is notifying individuals of a cybersecurity incident that may have exposed personal and protected health information; it discovered suspicious network activity Oct. 8, according to a Nov. 4 notice filed with the California attorney general's office (Becker's Hospital Review). Separately, dark web monitoring sites Ransomware.live and HookPhish posted that the n0n group was responsible for a suspected breach at Delta Dental of Missouri reportedly on Nov. 5, with member names and Social Security numbers among the data reportedly exposed (Becker's Dental Review).

Do this week. Confirm whether any of your patients or employees are covered by Delta Dental of Missouri and test your own breach notification playbook against these timelines. Run this

The claim.: The n0n group claimed responsibility for the Delta Dental of Missouri incident, per dark web monitoring sites.
The evidence.: Hoag's account rests on its filing with the California attorney general; the Delta Dental claim rests on dark web postings and has not been confirmed in the source.

For the Chief AI Officer. Use both incidents to confirm that AI vendors holding patient data are covered by the incident response plan.

For the CISO and security. Review detection-to-notification time against Hoag's Oct. 8 discovery and Nov. 4 filing.

For the Compliance, privacy and legal. Check that state attorney general notice requirements are mapped for every state where you hold patient data.

Read the full item

Sources:Becker's Hospital Review Becker's Dental Review

Announced1 sourceFor patients and employeesFriday, November 6, 2026

Chief AI Officer CISO CIO and CTO

OpenAI introduces GPT-6 Cyber for finding and fixing vulnerabilities

OpenAI announced GPT-6 Cyber, a cybersecurity model for finding exploitable vulnerabilities and developing fixes, trained to stay within authorized scope. This is the company's own announcement.

Do this week. Ask your security team to assess whether an authorized-scope vulnerability model fits your testing program and vendor rules. Run this

The claim.: OpenAI says the model is trained to stay within authorized scope.
The evidence.: No independent evaluation exists yet; the source is OpenAI's announcement.

For the Chief AI Officer. Set governance rules for AI security agents before any team runs one against production systems.

For the CISO and security. Define the authorized scope and approvals any AI vulnerability testing would require.

Disclosure at publication: OpenAI is one of the enterprise AI platforms Ecofy implements for clients.

Read the full item

Sources:OpenAI News

Reported2 sourcesFor patients and employeesThursday, November 5, 2026

Chief AI Officer CISO Compliance CNO

Staff at two Washington state facilities drafted patient notes in personal ChatGPT

A staff member at a Washington state-run mental health facility used a personal ChatGPT account to draft patient notes, and a similar incident occurred at a second state facility, potentially exposing the protected health information of 16 patients, The Seattle Times reported, per Becker's Behavioral Health. One facility named is Lake Burien Transitional Care Facility, which treats youth. Separately, a report covered by Cybersecurity Dive found shadow AI remains a persistent problem even as IT and security budgets grow.

Do this week. Inventory which generative AI sites clinical staff can reach from work devices this week, and pair any block on personal accounts with an approved, contracted documentation tool. Run this

The claim.: The Cybersecurity Dive report says shadow AI persists despite rising IT and security budgets.
The evidence.: The Seattle Times reporting, via Becker's Behavioral Health, documents two incidents and 16 patients potentially affected; no data on how common this is across health organizations is given.

For the Chief AI Officer. Treat unmet demand for note drafting as a portfolio signal and put an approved tool in front of the staff most likely to reach for a personal account.

For the CISO and security. Add web and DNS controls on consumer AI endpoints from clinical workstations and log attempts to see where the demand is.

For the Compliance, privacy and legal. Confirm the policy on generative AI use with PHI is written, trained and attested, and that the breach assessment process covers this scenario.

Disclosure at publication: Ecofy orchestrates OpenAI for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Behavioral Health Cybersecurity Dive

Reported2 sourcesFor patientsFriday, October 30, 2026

Chief AI Officer CISO CIO and CTO Compliance

Oracle Health breach count rises to nearly 20 million as systems move to Epic

The number of people affected by Oracle Health's 2025 data breach rose to nearly 20 million, while two large health systems moved hospitals from its EHR to Epic's, Becker's reported. Oracle also spent October pitching its AI to hospitals that run Epic, and HIStalk reported Larry Ellison's AI platform remarks at Oracle AI World.

Do this week. Ask every EHR and hosting vendor for its breach notification terms, legacy data retention and access logging, and confirm your incident plan covers a vendor-side breach. Run this

The claim.: Oracle's Larry Ellison says AI will let Oracle build a platform connecting care, research, insurance and public health.
The evidence.: Becker's reports the breach count; no independent assessment of Oracle's remediation has been published.

For the Chief AI Officer. Weigh vendor security history in any decision to add AI modules from an EHR vendor.

For the CISO and security. Inventory legacy or migrated data held by EHR vendors and verify it is encrypted, logged and scheduled for deletion.

Disclosure at publication: Oracle Health and Epic are among the platforms Ecofy orchestrates for clients.

Read the full item

Sources:Becker's Hospital Review HIStalk

Regulatory1 sourceFor patientsWednesday, October 28, 2026

Chief AI Officer CISO CIO and CTO

NIST publishes timelines for moving to post-quantum cryptography

NIST released a report describing timelines and migration activities for federal agencies moving to post-quantum cryptography standards. NIST says it can serve as a resource for technology providers and organizations building quantum-readiness road maps.

Do this week. Ask your EHR, cloud and medical device vendors for their post-quantum migration road maps and add the question to new contracts. Run this

The claim.: NIST says the report can guide organizations developing quantum-readiness road maps.
The evidence.: This is primary guidance from NIST, a federal standards agency; it describes federal timelines rather than private-sector mandates.

For the Chief AI Officer. Flag long-lived patient and research data as the category most exposed to future decryption.

For the CISO and security. Begin a cryptographic inventory of where encryption protects patient data at rest and in transit.

Read the full item

Sources:NIST News

Announced1 sourceFor patients and employeesTuesday, October 27, 2026

Chief AI Officer CISO CEO

Free six-month cybersecurity pilot launches for South Carolina rural hospitals

The White House and South Carolina officials launched Project Lifeline 250, a six-month pilot that provides cybersecurity resources and technology to participating rural hospitals at no cost, according to an Oct. 26 release reported by Becker's. The pilot aims to strengthen defenses and maintain patient care during technology disruptions.

Do this week. Ask your state hospital association whether a similar no-cost program is available or planned, and list the gaps you would put in front of it. Run this

The claim.: Officials say the pilot will help rural hospitals maintain patient care during technology disruptions.
The evidence.: The program has just launched, so no outcome data exists yet.

For the Chief AI Officer. Track the pilot's outputs as a benchmark for minimum controls a small hospital can sustain around its AI tools.

For the CISO and security. Use the pilot's scope as a checklist for the basics your own rural sites may still be missing.

Read the full item

Sources:Becker's Hospital Review

Reported1 sourceFor patients and employeesTuesday, October 27, 2026

Chief AI Officer Compliance CISO CFO

AI usage caps push staff toward free chatbots without business associate agreements

Medical Economics reports that as AI vendors tighten token and credit caps, staff who hit the limit may turn to free chatbots, exposing patient data to vendors with no business associate agreement. The article sets out eight steps practices can take to stay protected.

Do this week. Check current usage against your AI contract caps and publish an approved fallback tool so staff never need a free chatbot mid-shift. Run this

The claim.: The article argues usage caps create a direct path to shadow AI and HIPAA exposure.
The evidence.: This is a reported risk analysis from one outlet; no incidence data on cap-driven shadow AI exists yet.

For the Chief AI Officer. Add usage-cap monitoring to vendor reviews and size licenses to real demand.

For the Compliance, privacy and legal. Remind staff in writing which tools are covered by a business associate agreement and which are not.

Read the full item

Sources:Medical Economics

Heard1 sourceFor patients and employeesTuesday, October 27, 2026

Chief AI Officer CISO CEO

AI Daily Brief: security leaders urged to ask boards for help with the basics

On The AI Daily Brief, host NLW said Artificial Analysis scored Moonshot's Kimi K3.1 Pro at 64% on its Cyber Index. He cited Anthropic Deputy Chief Security Officer Jason D. Clinton urging security leaders to ask boards for help with the basics and to hold on for around eighteen months.

Ask your team. Ask your security team which foundational controls, such as patching, identity and backups, would most benefit from board-level backing this quarter. Run this

The claim.: Clinton said security leaders need to hold on for around eighteen months as AI cyber capability rises.
The evidence.: This was said on a podcast; the Cyber Index score is Artificial Analysis's figure as quoted, not independently verified.

For the Chief AI Officer. Factor rising model cyber capability into your AI risk register.

For the CISO and security. Bring a funded basics plan to the board rather than a new tool request.

Read the full item

Sources:The AI Daily Brief

Reported1 sourceFor patients and employeesMonday, October 26, 2026

Chief AI Officer CISO CIO and CTO

CrowdStrike says attackers used Claude Code against healthcare organizations

Hackers used Anthropic's Claude Code to compromise at least 15 healthcare organizations in Argentina, according to an Oct. 21 CrowdStrike report covered by Becker's. A separate Chinese-speaking actor reached Claude models through a China-based proxy service and targeted more than 20 organizations worldwide, including healthcare and biotech companies in the U.S. and Brazil.

Do this week. Ask your security team to brief you on how its detection handles fast, agent-driven intrusion attempts, and to confirm that controls for patching, privileged access and egress monitoring are tested against that speed. Run this

The claim.: CrowdStrike says commercial AI coding agents are now part of real intrusion campaigns that reach healthcare targets.
The evidence.: The CrowdStrike report, as summarized by Becker's, profiles four actors; no independent analysis of the incidents is available yet.

For the Chief AI Officer. Add AI-assisted attack scenarios to the AI risk register and the next board security briefing.

For the CISO and security. Request the CrowdStrike indicators and run a threat hunt against them, and add agent-speed intrusion to this quarter's tabletop exercise.

Disclosure at publication: Anthropic is one of the AI platforms Ecofy tracks and orchestrates for clients.

Read the full item

Sources:Becker's Hospital Review

Reported1 sourceFor patients and employeesMonday, October 26, 2026

Chief AI Officer Compliance CISO CHRO

Johns Hopkins Bayview notifies 3,182 patients after upload to unapproved AI tool

Johns Hopkins Bayview Medical Center is notifying about 3,182 patients that their information may have been compromised after a workforce member uploaded a spreadsheet containing patient data to a public AI tool the hospital had not approved, according to an Oct. 23 news release reported by Becker's.

Do this week. Confirm this week that staff have an approved AI tool for routine work and that public AI sites are covered by data loss prevention rules for patient data. Run this

The claim.: Johns Hopkins describes the upload as a mistake by a workforce member.
The evidence.: Becker's reports the incident from the hospital's own release; no regulator finding has been published.

For the Chief AI Officer. Publish a short list of approved AI tools and the data each may receive, so staff have a sanctioned path.

For the Compliance, privacy and legal. Review breach notification procedures for AI-related disclosures and update the acceptable use policy to name public AI tools.

Read the full item

Sources:Becker's Hospital Review

Reported2 sourcesFor patients and employeesSunday, October 25, 2026

Chief AI Officer CISO Compliance Patient experience

PHP2Shell website flaw and Quest Diagnostics breach land in the same week

Medical Economics and Physicians Practice report a critical flaw in widely used website code, called PHP2Shell, and a breach of a Quest Diagnostics lab portal. Both outlets frame the response as patch, verify and document.

Do this week. Confirm with your web host and vendors that PHP2Shell is patched on every patient-facing site, and document what you told patients about the Quest portal breach. Run this

The claim.: Physicians Practice advises practices to patch, verify and document their response to both incidents.
The evidence.: Two trade outlets report both incidents; neither summary gives a count of affected organizations or patients.

For the CISO and security. Run a scan of all public websites, including those managed by marketing agencies, for the PHP2Shell flaw and require written patch confirmation.

For the Compliance, privacy and legal. Record your assessment of whether the Quest portal breach involves your patients and whether any notice obligations follow.

For the Patient experience. Give front desk and contact center staff a short script for patients asking about the Quest breach.

Read the full item

Sources:Medical Economics Physicians Practice

Reported1 sourceFor patients and employeesSunday, October 25, 2026

Chief AI Officer CISO COO CNO

University Hospitals shuts down some systems after a cybersecurity issue

Cleveland-based University Hospitals shut down some of its systems following an unspecified cybersecurity issue, HIStalk reports. The system said patient care was not affected.

Do this week. Run a tabletop exercise this week on a partial system shutdown, testing paper downtime procedures in nursing, pharmacy and registration. Run this

The claim.: University Hospitals says patient care is not impacted.
The evidence.: No independent detail on the cause or scope has been reported yet; HIStalk notes the statement is boilerplate.

For the CISO and security. Verify that you can isolate systems by segment without taking down the EHR and that backups have been restore-tested this quarter.

Read the full item

Sources:HIStalk