Email provider news

Hardcoded credentials, PHI exposure, insecure data storage, and missing encryption are the security risks healthcare leaders report most often in AI-generated code. In a July 2026 Paubox survey of 151 healthcare leaders, more than half (54%) said AI-generated or AI-assisted code has contributed to hardcoded…

It is HIPAA compliant to put PHI into AI coding assistants only when the assistant's vendor has signed a business associate agreement (BAA) and the use meets HIPAA's minimum necessary standard. In most builds, test data that contains no PHI does the job, so real patient data doesn't need to go into the assistant at…

Seven in ten healthcare leaders (70%) say their organization has found an AI-built tool that handled protected health information (PHI) without IT or security knowing, according to a July 2026 Paubox survey of 151 healthcare leaders.

Yes, if the platform sending it has signed a BAA. No, if it hasn’t.

In April 2024, the Health Sector Cybersecurity Coordination Center (HC3) put out a sector alert about phone calls reaching hospital IT help desks. The callers said they worked in revenue cycle or another finance role, and their numbers carried a local area code. Each one had the same story.

Apple Notes is a note-taking app that allows users to create notes, organize checklists, add images and documents, and record audio. With iCloud, users can sync notes across Apple devices and collaborate with others.

Generative artificial intelligence (AI) is an artificial intelligence tool that creates new content, such as text, images, audio, video, computer code, and summaries, based on patterns it has learned from existing data.

It depends on what type of email it is. Information blocking will likely occur if the email contains the result that the patient is requesting or if you have a policy in place not to release results until the provider reviews them first.

HIPAA’s preemption rule is at 45 C.F.R. § 160.203. It says a HIPAA standard that is contrary to a state law generally overrides that state law, unless an exception applies. The most important exception is for more protective state laws.

Paubox Forms can now import flat PDFs. Upload the intake or consent form you already use and get a HIPAA compliant draft to review and publish. Most practices already have the forms they need. The new patient intake, the consent form, and the health history questionnaire are usually sitting in a folder as PDFs.

Edward Dubrovsky, a 54-year-old Canadian, was arrested in Pennsylvania on October 8 and faces extortion conspiracy charges in Texas.

Monitoring more activity does not produce better monitoring, speakers said at a patient privacy symposium last week.

Researchers linked a September case to two earlier incidents in February and June through matching settings in the attackers' tools.

Attackers continue to exploit gaps in MFA to gain access to corporate networks using stolen credentials.

On Tuesday, October 27, we hosted The Paubox Table in the Fireplace Room at The Fig Tree in Charlotte, North Carolina.

On Tuesday, October 27, we hosted The Paubox Table in the Poolhouse at The Arthur J in Manhattan Beach, California.

Ambient artificial intelligence (AI) is changing how healthcare providers document patient encounters. These tools can listen to clinician-patient conversations, generate clinical notes, and reduce the time physicians spend on administrative tasks.

“In 2020, 14.5% of adults had trouble falling asleep most days or every day in the past 30 days,” according to data from the CDC’s Sleep Difficulties in Adults: United States, 2020 National Health Interview Survey.

Genetic information cannot be reissued. A Social Security number is hard to change, a credit card can be replaced within hours, and a password can be changed immediately, which is why the standard breach response of credit monitoring and replacement account numbers exists at all.

The PHP security team has warned of a new remote code execution (RCE) vulnerability, CVE-2026-115560, but says it will likely affect only a small share of users.

The Justice Department took seven domains on October 8. A joint advisory the same day detailed password attacks on Microsoft email accounts.

The Senate passed the measure by unanimous consent. Breach notices would also have to state the total number of people affected.

Yes, if a subcontractor handles protected health information (PHI) by creating, receiving, maintaining, or transmitting it on behalf of a business associate, they absolutely need a business associate agreement (BAA).

The settlement follows a class action suit over a breach that impacted approximately 115,940 individuals.

HIPAA does not apply to machine learning models operations and functioning. However, it does cover how protected health information (PHI) is used to create a model. The vendors and employees working with it and any messages created from the model's findings.