How California Healthcare Teams Can Navigate Overlapping Compliances
California healthcare doesn’t just answer to HIPAA. SB 446 cuts your breach notification window to 30 days. CMIA covers vendors and digital health platforms HIPAA doesn’t reach. CCPA applies to employee and marketing data your PHI exemption won’t protect. In this blog, we will talk about what the full compliance picture for California looks like.
Florida Healthcare Security in 2026: How to Stop Data Breaches
Healthcare breaches cost an average of $6.64M in 2026, and Florida providers have no state safe harbor from breach lawsuits. Here is what Florida healthcare security teams should validate first, and how pentesting proves it.
CMMC Phase 2: A Readiness Guide for Michigan Manufacturers
Starting November 10, 2026, defense manufacturers will have to prove they have the required security controls for CMMC Level 2 to remain eligible for DoW contract awards. While it may take 6 to 18 months for organizations to be compliance ready, this CMMC readiness guide covers what Level 2 demands and Michigan manufacturers can close the gap.
Texas Medical Device Cybersecurity: 2026 HHSC Requirements
The Texas Health and Human Services Commission’s April 2026 directive requires Texas hospitals, acute care facilities, and long-term care facilities to review applicable FDA cybersecurity guidance for medical devices. Facilities must assess network-connected or remotely accessible devices, align relevant operational policies, and coordinate with manufacturers and IT teams to address vulnerabilities.
SOC 2 Type II for Healthtech Startups: The Ultimate Hospital Procurement Checklist
SOC 2 Type II has become a practical trust signal for healthtech startups. It shows your reliability as a partner during the hospital procurement process as a SOC 2 Type II report demonstrates effectiveness of your security controls over a prolonged period. This blog lists what the process entails and how you can build your own SOC 2 supported cybersecurity.
M&A Due Diligence: Why You Must Pentest an Acquired Clinic’s Web Apps Before Integration
When a healthcare group acquires a clinic, web application security rarely makes the due diligence checklist. Every acquired clinic comes with a patient portal, billing apps, and EHR integrations carrying ePHI. Once the deal closes, their vulnerabilities are yours. Here are the risks that you inherit and what a pre-integration webtest should cover.
Securing ERP API Integrations: Prevent Vendor Apps from Exposing Supply Chain Data
API integrations in ERP are a bigger risk than anyone can anticipate. ERPs handle sensitive information about clients, finance, and machine specifications. A compromised vendor and underlying API vulnerabilities can wreak havoc. Manufacturing data breaches not only affect your production, but also the entire supply chain you cater to.
Active Directory Pentesting
For most organizations, a single compromised account is all it takes to have a major incident and credibility loss – and most teams don’t realize how short that path really could be in their environment. This case study walks through a real KLEAP Active Directory pentesting engagement – the client’s objective, the attack paths we identified, […]
AI & HIPAA Violations: From Real-World Impact to Mitigating Security Risks
In the AI-era, negligence of organizations and ignorance of care providers are giving rise to new security risks. This blog investigates real-world reports, and charts a course through the deployment process, giving a step-by-step guide to meet HIPAA compliance.
HIPAA Compliance & Security for Federally Qualified Health Centers
Unlike other healthcare providers, Federally Qualified Health Centers operate on a fixed budget with severe staff shortage. Oversights, poor technical safeguards, and lack of personnel training make PHIs the most vulnerable target in an FQHC ecosystem. FQHCs need specialized safeguards and a system that makes them ready for HIPAA compliance.