标签：#healthcare

Edinburgh-based tech firm Craneware said customer data was stolen during a cyberattack. The company makes software that thousands of U.S. hospitals, pharmacies, and clinics rely on for billing patients, potentially exposing health data.

Every patient in the public tour of my care platform is a computer science pioneer. Ada Lovelace has a pain score. Alan Turing is due for a check-in. And every one of them has a patient ID no real system could ever issue, an ID that is wrong the way a date in month thirteen is wrong. None of this is an accident. It is the most useful compliance idea I have had this year. A good fake is a liability Here is the problem with realistic demo data. Under HIPAA, nobody can tell a well-made fake from the real thing by looking. A screenshot of a fake patient named John Smith with a plausible ID looks exactly like a screenshot of a real one. So when that image turns up in a deck, or a tweet, or a forwarded email, someone has to prove it is clean. And the only way to prove it is to go back to the database and show the record does not exist. That is an audit. Every plausible fake carries a future audit inside it. So a good fake does not reduce your risk. It just moves it. The better the fake looks, the more it costs to prove it is one. The safety of a fake is not in how real it looks. It is in how obviously fake it is. A plausible fake needs an audit to clear it. An impossible fake clears itself. The fix is to stop making fakes plausible and start making them impossible. A patient named Grace Hopper with an ID that breaks the format on sight cannot be a real record. Anyone can check that from the pixels alone. No lookup, no audit trail, no meeting. Zero pixels The public showcase at clearpathcare.ai contains zero pixels from the production console. Every screen is a React recreation, rebuilt by hand to look like the product without ever touching it. What broke: An early draft of the marketing screens started as console screenshots with seeded test patients: realistic names, realistic IDs. Then I asked one question the images could not answer: prove there is no real record in this frame. I could not. So I deleted every screenshot and rebuilt the screens from scratch. The rebuilt

Every developer I know has built something for themselves. A productivity tool. A habit tracker. A personal finance app. An AI that makes them smarter, faster, calmer. I did the same thing for 2 years. Then I had a conversation with someone close to me that I completely mishandled — and I realised no amount of personal productivity tools would have helped me there. The problem wasn't me, individually. The problem was the space between us. So I started asking a weird question Why has all of AI been built for individuals? Copilot helps you code faster. ChatGPT makes you smarter. Notion AI organises your thoughts. Calm helps you sleep better. Not one of them is built for what happens when two people try to understand each other. That's a massive gap. And it's one I couldn't stop thinking about. What I built Mendle — an AI-powered Relationship Intelligence platform. Not a therapy app. Not a chatbot companion. Not another journaling tool with an AI skin on top. The core idea is **shared emotional memory. Most relationship apps are built around one person's perspective. You log your feelings. You get insights. Your partner is an afterthought in the architecture. Mendle is different at the data model level. Both people contribute. Both people benefit. The AI builds an understanding of the relationship not just an individual. Over time it surfaces patterns. Communication loops. Emotional triggers. The things you keep missing because you're too close to them. The technical challenge that surprised me Building AI for two people is fundamentally harder than building it for one. Single-user AI: one context window, one set of preferences, one voice to understand. Relationship AI: two different communication styles, two different emotional vocabularies, shared history that neither person has complete visibility into, and privacy boundaries that have to be respected even between partners. The shared memory architecture was the hardest part to get right. How do you build something

If you build, run, or audit systems that touch protected health information (PHI), the HIPAA risk assessment is the document that quietly decides whether the next OCR investigation ends in a closure letter or a corrective action plan with a six-figure settlement. The proposed 2026 HIPAA Security Rule update (published as an NPRM in January 2025, still pending finalization at OCR) doesn't change the underlying requirement at 45 CFR § 164.308(a)(1)(ii)(A) — and OCR has repeatedly reaffirmed that the absence of a current, written risk analysis is itself the most-frequently-cited Security Rule deficiency . This is the engineering view: what a defensible HIPAA risk assessment actually contains in 2026, how to model it, and what tooling fits the workflow. 1. The asset inventory is non-negotiable Every defensible HIPAA risk assessment starts with a complete inventory of where ePHI lives, where it flows, and who touches it. If you can't enumerate every system, every integration, and every workforce role that creates / receives / maintains / transmits ePHI, the rest of the assessment is built on sand. A minimal asset-inventory record per system: { "system_id" : "ehr-prod-01" , "system_type" : "ehr" , "ephi_states" : [ "create" , "receive" , "maintain" , "transmit" ], "data_classification" : "phi-high" , "hosting" : { "type" : "saas" , "vendor" : "epic" , "region" : "us-east-1" }, "workforce_roles_with_access" : [ "clinician" , "billing" , "admin" ], "integrations" : [ { "to" : "billing-system" , "protocol" : "hl7-fhir" , "direction" : "outbound" }, { "to" : "patient-portal" , "protocol" : "https-rest" , "direction" : "bidirectional" } ], "encryption_at_rest" : true , "encryption_in_transit" : true , "mfa_enforced" : true , "audit_log_destination" : "central-siem" , "ba_agreement_on_file" : true , "last_reviewed" : "2026-05-15" } If you don't have this, build it before you do anything else. The HHS-provided ONC SRA Tool walks through asset enumeration but it's optimized for s

This specific undertaking is not fundamentally burdensome in terms of labor; however, this endeavor serves as the crucial support for my unwavering commitment to see it through to its ultimate conclusion. It is precisely the motivation behind my relentless 72-hour shifts and the impetus that prevents me from ceasing my efforts. My affection amidst my grief—my aspiration is to assist others and ensure that the tragedy you experienced is never repeated. Caitlyn Walmsley, RIP. I will love you always.

There are strategies to improve healthcare, but US isn't trying them.