Good morning everyone,
This week’s developments highlight risks beyond the core electronic health record. Weill Cornell disclosed unauthorized use of patient information in AI research, while federal agencies warned of attacks on refrigeration controls that could threaten temperature-sensitive supplies and disrupt operations. Both warrant attention from teams responsible for privacy, security, and patient care.
The five updates below cover notices and announcements issued November 3–9. Our practical focus is on verifying where information goes, who controls connected systems, and what evidence vendors can provide about their safeguards. New federal vendor-assessment guidance also offers useful questions for procurement and longer-term security planning.
Privacy, AI & Digital Health Updates
Weill Cornell discloses unauthorized patient-data use in AI research (Notice November 5, 2026)
What happened: Weill Cornell Medicine disclosed that patient information was entered into AI tools and processed using machine learning without authorization during a radiology research study. The activity occurred June 10–20; the organization learned of it September 6.
Information included medical record and radiology accession numbers, service dates, and clinical details such as diagnoses and medications. Although names, contact details, Social Security numbers, and financial information were not included, the clinical data provided represents potential protected health information. Weill Cornell suspended the research, requested deletion, and reinforced staff education. Its notice did not identify an affected-patient count or confirm completed deletion; it reported no evidence that an unauthorized individual viewed the information. (Weill Cornell patient notice)
Why it matters: Our takeaway is to make AI approval specific to the tool, dataset, and intended use. In this incident, removing names did not prevent the remaining information from being identified as protected health information.
Recommended actions:
- Review research and departmental AI projects against approved tools, permitted datasets, and documented privacy reviews.
- Require privacy and security approval before uploading clinical extracts; document applicable research permissions, vendor terms, and BAA determinations.
- For unauthorized uploads, preserve the incident chronology and obtain written answers about retention, downstream sharing, model training, and deletion.
Breach & Incident Notices
Hoag issues notices following potential unauthorized file access (Notice November 4; reported November 6, 2026)
What happened: Hoag Memorial Hospital Presbyterian in California notified individuals after discovering suspicious network activity October 8. Its investigation found that certain files may have been accessed without authorization. A subsequent review completed October 25 identified potentially affected personal or protected health information. (Becker’s reporting, November 6)
The public notice template identifies names but leaves additional data elements as individualized placeholders. It does not establish an affected-population total or the cause of the activity. Hoag said it secured its environment, added safeguards, and offered identity-protection services. (Hoag notification filed with the California attorney general)
Why it matters: This notice illustrates the distinction between detecting an incident and determining whose information was involved. For compliance teams, the operational priority is maintaining a defensible timeline while forensic findings and individual notice content develop.
Recommended actions:
- Maintain one chronology covering discovery, forensic findings, affected-file review, notification decisions, and completed notices.
- Assign privacy and legal staff responsibility for evaluating notification deadlines while technical investigation continues.
- Validate individualized letters against the affected-person dataset, and give call-center staff approved answers that distinguish confirmed facts from unresolved questions.
Cybersecurity & Threat Intelligence
Federal agencies warn of attacks on refrigeration and cold-chain systems (Released November 5, 2026)
What happened: CISA, FBI, HHS, USDA, and the Department of Transportation issued joint guidance addressing active attacks on industrial refrigeration and cold-chain monitoring systems. Attackers can exploit exposed or vulnerable controllers to change temperatures, trigger heating or defrost cycles, and interfere with temperature visibility. The agencies identify healthcare among the sectors using these systems. (Joint federal fact sheet, November 5)
Why it matters: The healthcare implication extends beyond data confidentiality. Include refrigeration supporting pharmacy, laboratory, and blood-bank operations in continuity discussions. A response exercise should address both compromised controls and the possibility that staff cannot trust the temperature readings they see.
Recommended actions:
- Have facilities, pharmacy, laboratory, and security teams identify connected controllers, remote-access paths, support vendors, and accountable owners.
- Remove public internet exposure, change default credentials, and separate operational devices from business networks.
- Confirm firmware support and replacement plans; test temperature alerts, escalation contacts, and procedures for evaluating potentially affected inventory.
These steps build on the agencies’ recommendations for access restrictions, device maintenance, monitoring, and safe temperature limits. (Federal mitigation guidance)
Vendor & Supply Chain Risk
NSA and partners release questions for assessing vendors’ post-quantum readiness (Announced November 4, 2026)
What happened: NSA announced joint guidance with Australia’s Cyber Security Centre and CISA to help organizations assess vendors’ readiness for post-quantum cryptography. The questions address cryptographic inventories, risk assessment, migration priorities, implementation, and supplier communications. They are intended for procurement, renewals, and ongoing vendor assurance. (NSA announcement, November 4)
Why it matters: Our healthcare takeaway is to use upcoming renewals to understand dependencies before committing to long contracts. Ask EHR, cloud, backup, identity, and device suppliers how their products can accommodate cryptographic changes. Treat this guidance as a planning resource; the announcement does not establish a new HIPAA compliance deadline.
Recommended actions:
- Add targeted questions to high-risk vendor reviews: which cryptographic components are used, who maintains them, and which require hardware replacement?
- Request product-specific migration milestones, supported versions, testing arrangements, and expected costs.
- Prioritize services holding sensitive information that must remain confidential over long periods; record vendor limitations and assign follow-up owners.
The published vendor questionnaire provides detailed questions and considerations for evaluating supplier responses.
Standards & Security Planning
NIST seeks input on revisions to key-derivation guidance (Announced November 4, 2026)
What happened: NIST opened a pre-draft comment process for revising SP 800-108 Revision 1, its guidance on deriving cryptographic keys using pseudorandom functions. NIST cited research raising security concerns about certain constructions and is considering changes to security expectations and implementation guidance. Comments are due December 18, 2026. This is an early standards-development step, not a finalized replacement. (NIST announcement and comment instructions)
Why it matters: For healthcare compliance leaders, the useful question is whether security teams and suppliers can identify their cryptographic dependencies and assess relevant changes. The announcement alone does not establish that a particular healthcare system is vulnerable or that existing encryption should be replaced immediately.
Recommended actions:
- Route the announcement to security architecture and relevant vendors for an applicability assessment.
- Request documentation of affected libraries or products, vendor analysis, and any planned remediation or validation work.
- Track the standards process and December comment deadline; require testing and change approval before modifying production cryptography.
Closing Thoughts
This week’s practical message is to connect policy with observable controls. Use risk analysis to identify overlooked data flows and operational dependencies, then assign owners to verify access restrictions, monitoring, encryption arrangements, and vendor commitments. Include research teams and facilities personnel where their work creates privacy or security exposure.
For the coming week, choose one focused check: review an AI project’s data handling, test a refrigeration alert, or examine a critical vendor’s security roadmap. Record what was verified, what remains unresolved, and who will follow through. Pair that work with clear workforce guidance and a rehearsed breach-notification process to strengthen defensible compliance.