Search
magnifying-glass
The Encrypted Chart
Log in
Subscribe
Home
Archive
The Encrypted Chart

Breach Response

Practice Security

+1

No One Hacked Your EHR. They Just Logged In.

Jun 24, 2026

•

3 min read

No One Hacked Your EHR. They Just Logged In.

In June, researchers found a database of 24 billion stolen passwords, most of it freshly lifted off infected personal devices. Here is how a solo practice's EHR login lands in it, and why "remember this device for 30 days" quietly cancels the MFA you were counting on.

Brad Lieberman
Brad Lieberman

HIPAA Compliance

+1

Two Breaches, One Question: When Does Your Clock Start?

Jun 20, 2026

•

4 min read

Two Breaches, One Question: When Does Your Clock Start?

Two breaches hit the news this week, but the part that matters for your practice is not the headline. It is one question hiding in the HIPAA notification rule: when does your sixty-day clock actually start.

Brad Lieberman
Brad Lieberman

Practice Security

+2

The Email Habits That Just Cost a Mental Health Practice $900,000

Jun 13, 2026

•

5 min read

The Email Habits That Just Cost a Mental Health Practice $900,000

A Massachusetts behavioral health center settled a class action this week for $900,000 over a breach that started with one phished email account. A national legal alert published two days ago explains how a routine group email becomes a reportable HIPAA event. Both stories point at the same form most solo therapy practices don't have.

Brad Lieberman
Brad Lieberman

Practice Security

+1

Three Breaches Last Month. All Started With One Email

Jun 9, 2026

•

6 min read

Three Breaches Last Month. All Started With One Email

The Acadia Healthcare notice that went out May 22, the Genesis ransomware that hit an independent California cardiology practice, and the 35,000-account phishing campaign Microsoft tracked in April. Same fact pattern, three different scales. The attackers did not break in. They logged in.

Brad Lieberman
Brad Lieberman

Vendor and BAA Risk

+1

Your Vendor's Breach Just Became Your Lawsuit.

Jun 2, 2026

•

4 min read

Your Vendor's Breach Just Became Your Lawsuit.

A federal court in Chicago ruled last week that patients can sue a healthcare provider over a vendor's data breach. The diligence defense — "they were reputable, they had certifications, I trusted them" — just got materially narrower.

Brad Lieberman
Brad Lieberman

HIPAA Compliance

+1

$900,000 for the 72 Hours You Didn't Plan For

May 30, 2026

•

6 min read

$900,000 for the 72 Hours You Didn't Plan For

A Small OB/GYN practice just paid $900,000 to settle a class action over a four-day breach in 2022. The breach itself wasn't extraordinary — what made it expensive was what happened next. Here's the operational document most independent practices don't have, and why it's the difference between $0 and seven figures.

Brad Lieberman
Brad Lieberman

HIPAA Compliance

+1

$245,000 for the Form You Don't Have

May 19, 2026

•

4 min read

$245,000 for the Form You Don't Have

OCR fined five practices a combined $1.41 million in the past two weeks. The common thread wasn't sophisticated hacking. It was a missing annual document. Here's why solo and small-group practices should be reading their own compliance paperwork this week.

Brad Lieberman
Brad Lieberman

Vendor and BAA Risk

+2

When Your Billing Service Gets Hacked: A $225K Federal Wake-Up Call

May 9, 2026

•

7 min read

When Your Billing Service Gets Hacked: A $225K Federal Wake-Up Call

If your billing service got hacked tomorrow, what does the contract you signed with them actually say? Last month the federal government fined a vendor in that exact pattern $225,000. Here's what to read this week — before it's your patients calling.

Brad Lieberman
Brad Lieberman

The Encrypted Chart

Join the list to receive our newest posts straight to your inbox.

The Encrypted Chart

Home

Subscribe

Archive

Login

Reset Password

Update Password

Profile

Search

© 2026 The Encrypted Chart · The Encrypted Chart is published by Lieberman Consulting, LLC, a consulting firm — not a law firm. Content is educational, not legal advice..
beehiivPowered by beehiiv