How California Healthcare Teams Can Navigate Overlapping Compliances
California healthcare doesn’t just answer to HIPAA. SB 446 cuts your breach notification window to 30 days. CMIA covers vendors and digital health platforms HIPAA doesn’t reach. CCPA applies to employee and marketing data your PHI exemption won’t protect. In this blog, we will talk about what the full compliance picture for California looks like.
How Can Florida Healthcare Providers Protect Against Increasing Data Breaches
Florida healthcare ranks fourth in the US for healthcare data breaches. With 123 impacted organizations on record in 2026, the state’s healthcare services are facing an unprecedented challenge. As the proposed HIPAA Security Rule is raising the bar on pentesting and MFA, healthcare providers need to enforce cybersecurity measures right now.
CMMC Phase 2: A Readiness Guide for Michigan Manufacturers
Starting November 10, 2026, defense manufacturers will have to prove they have the required security controls for CMMC Level 2 to remain eligible for DoW contract awards. While it may take 6 to 18 months for organizations to be compliance ready, this CMMC readiness guide covers what Level 2 demands and Michigan manufacturers can close the gap.
Texas’s New Medical Device Security Directive: What You Need to Do Now
Texas Governor Greg Abbott has directed all state health agencies and medical facilities to review the cybersecurity of their connected medical devices. The Texas HHSC has extended this obligation to all hospitals statewide. Learn what that means for Texas cybersecurity regulations and the challenges the new update to medical device security presents.
SOC 2 Type II for Healthtech Startups: The Ultimate Hospital Procurement Checklist
SOC 2 Type II has become a practical trust signal for healthtech startups. It shows your reliability as a partner during the hospital procurement process as a SOC 2 Type II report demonstrates effectiveness of your security controls over a prolonged period. This blog lists what the process entails and how you can build your own SOC 2 supported cybersecurity.
M&A Due Diligence: Why You Must Pentest an Acquired Clinic’s Web Apps Before Integration
When a healthcare group acquires a clinic, web application security rarely makes the due diligence checklist. Every acquired clinic comes with a patient portal, billing apps, and EHR integrations carrying ePHI. Once the deal closes, their vulnerabilities are yours. Here are the risks that you inherit and what a pre-integration webtest should cover.
Securing ERP API Integrations: Prevent Vendor Apps from Exposing Supply Chain Data
API integrations in ERP are a bigger risk than anyone can anticipate. ERPs handle sensitive information about clients, finance, and machine specifications. A compromised vendor and underlying API vulnerabilities can wreak havoc. Manufacturing data breaches not only affect your production, but also the entire supply chain you cater to.
Active Directory Pentesting
For most organizations, a single compromised account is all it takes to have a major incident and credibility loss – and most teams don’t realize how short that path really could be in their environment. This case study walks through a real KLEAP Active Directory pentesting engagement – the client’s objective, the attack paths we identified, […]
AI & HIPAA Violations: From Real-World Impact to Mitigating Security Risks
In the AI-era, negligence of organizations and ignorance of care providers are giving rise to new security risks. This blog investigates real-world reports, and charts a course through the deployment process, giving a step-by-step guide to meet HIPAA compliance.
HIPAA Compliance & Security for Federally Qualified Health Centers
Unlike other healthcare providers, Federally Qualified Health Centers operate on a fixed budget with severe staff shortage. Oversights, poor technical safeguards, and lack of personnel training make PHIs the most vulnerable target in an FQHC ecosystem. FQHCs need specialized safeguards and a system that makes them ready for HIPAA compliance.