Paubox Weekly Fully Automated - A HIPAA compliant email security Podcast

This episode examines three critical developments in healthcare cybersecurity and compliance: widespread MyChart phishing campaigns targeting Medicare patients across 30+ health systems, the $15 million DaVita settlement following the 2025 Interlock ransomware attack, and California's new AB 1979 legislation restricting autonomous AI clinical decision-making. Key takeaways include proactive patient communication strategies, incident response planning, and auditing AI workflows to ensure appropriate human oversight.

In this episode, Alex and Jen discuss recent cybersecurity threats affecting healthcare organizations, including the ShinyHunters breach of oncology company Novocure and the FBI disruption of a China-linked botnet targeting hospitals. They also cover new Paubox Email API features for scheduled sends and the Senate HELP Committee's advancement of legislation to extend HIPAA-style protections to health data held by non-covered entities.

In this episode, we discuss Paubox's recognition in G2's Fall 2026 reports, a surge in MyChart phishing scams targeting patient credentials, and a Chicago cardiology practice breach that went undetected for ten weeks. We also cover the new customizable reply-to feature in Paubox Forms and examine how ransomware groups are now using AI-generated legal risk reports as a pressure tactic against victims.

In this episode, Alex and Jen discuss Paubox's new PDF import feature for HIPAA compliant forms, unified scoped API keys, and the latest IBM data on healthcare breach costs, which remain the highest of any industry at $6.6 million on average. They also cover an emerging credential theft scam targeting professionals on X and share insights from a recent Paubox Table dinner in New York, emphasizing that most security vulnerabilities stem from fixable configuration issues rather than sophisticated attacks.

In this episode, Alex and Jen discuss the latest healthcare cybersecurity threats including a major data extortion claim against NYC Health + Hospitals, sophisticated phishing campaigns using fake font files, and an in-flight Wi-Fi attack targeting travelers. They also cover the $650,000 settlement by Highland Health Systems following a 2023 breach and emphasize that most security incidents stem from preventable gaps rather than sophisticated attacks.

In this episode, we break down recent healthcare data breaches including an 83,000-record phishing incident at Aitkin County Health and a nine-year undetected email forwarding leak at Child Care Resource Center. We also cover the HHS 2026 Unified Agenda timeline, the Health-ISAC warning on ShinyHunters threat actors targeting cloud identity infrastructure, and key takeaways for strengthening your organization's security fundamentals.

In this episode, Jen and Alex cover new Paubox features including attachment preview for quarantined messages and dark mode, then discuss the alleged Abbott Laboratories data breach, emerging threats from malicious AI skills and ClickFix attacks, and privacy implications of ChatGPT Health's nationwide launch. The hosts emphasize actionable steps including vendor audits, user training, and understanding the limitations of HIPAA protection when patient data moves to consumer AI platforms.

In this episode, we break down four major healthcare cybersecurity incidents: the Craneware billing platform attack, a nonprofit breach affecting 75,000 individuals, Medtronic's exposure of nearly 370,000 patient records, and ApolloMD's $4.02 million settlement following a ransomware attack. These cases underscore critical lessons for healthcare organizations on vendor management, network segmentation, and incident response planning.

In this episode, Alex and Jen discuss a major breach affecting 542,000 individuals at Centers Laboratory, a $500,000+ ransomware settlement involving a Pennsylvania treatment facility, and the HHS delay of the final HIPAA Security Rule update to 2027. They also cover practical tools like the new Paubox Email API template gallery and emphasize how consistent security fundamentals can prevent costly incidents.

This episode examines three emerging cybersecurity threats affecting healthcare organizations: Microsoft 365 Groups being exploited for calendar-based phishing attacks, newly discovered vulnerabilities in the widely used DICOM Toolkit that could impact medical imaging systems, and a data breach that originated through social engineering targeting third-party applications. The hosts provide actionable guidance on tightening platform configurations, vetting vendors, and strengthening staff training to address these preventable security gaps.

In this episode, Jen and Alex discuss Paubox's new MFA options, the ShinyHunters breach involving legacy Iora Health data, World Cup-related phishing scams, and a Senate bill addressing cybersecurity risks in Chinese-made medical devices. The hosts emphasize the importance of addressing legacy systems, conducting thorough asset inventories, and implementing foundational security controls to protect patient data.

In this episode, we cover emerging threats targeting healthcare and enterprise organizations, including AI platform impersonation scams, the ShinyHunters attacks on Oracle PeopleSoft systems, and research showing AI email agents are vulnerable to phishing. We also discuss Paubox joining LegitScript's Compliance Collective and the Novo Nordisk clinical trial data breach investigation. Key takeaways include verifying AI tool sources, reviewing legacy system configurations, and applying least-privilege principles to AI agents.

In this episode, we discuss Paubox Forms' new conditional logic feature, the Conduent breach affecting 62 million people, and critical findings from controlled tests revealing Amazon SES may transmit PHI in plaintext despite documentation claims. We also cover recent ransomware incidents at Mt. Baker, Northwest Radiologists, and Singing River Health System, along with key takeaways from the June Zoom social mixer on AI tooling and vendor management strategies for small IT teams.

This episode examines recent healthcare data breaches and settlements, including the $4 million IBJI case involving extended attacker dwell time, Mission Community Hospital's $1.5 million RansomHouse extortion settlement, and third-party vendor risks exposed by the La Perouse billing breach. We also discuss Rutgers University research showing hospitals using third-party tracking pixels are 46 percent more likely to experience breaches, emphasizing the critical need for system patching, vendor oversight, and web property audits.

In this episode, Alex and Jen discuss new Paubox product updates including a Forms template library and API dashboard improvements, then analyze recent healthcare data breaches affecting Esse Health, Gandara Mental Health Center, and NYC Health + Hospitals. The conversation highlights common security gaps, the growing risk of third-party vendor breaches, and practical steps organizations can take to strengthen their compliance and security posture.

This episode covers the new Paubox CLI support for Forms, the LockBit 5.0 ransomware attack on Mt. Spokane Pediatrics affecting over 32,000 patients, a CISA-flagged vulnerability in medical imaging software, and the FBI warning about the Kali365 phishing-as-a-service platform targeting Microsoft 365 credentials. The hosts discuss the security gaps facing small clinics and emphasize actionable steps including patching systems, network segmentation, and staff training to address these evolving threats.

In this episode, Jen and Alex break down the surge in QR code phishing attacks, the cautionary tale of a ransomware negotiator who defrauded healthcare clients, and practical strategies for reducing security friction. They also cover new tools for HIPAA-compliant email automation and self-service archive exports that streamline compliance workflows.

In this episode, we break down the SAG-AFTRA Health Plan's $950,000 phishing settlement, Medtronic's nine-million-record breach, and the Inc Ransom attack on Sandhills Medical Foundation. We also highlight Henderson Behavioral Health's patient-centered approach and discuss practical takeaways for strengthening your organization's security posture through staff training, system patching, and incident response planning.

In this episode, we examine a Microsoft-flagged phishing campaign that bypassed MFA across 13,000 organizations, analyze Saint Anthony Hospital's breach notification that expanded from 6,500 to 146,000 affected individuals, and discuss the ransomware attack impacting 92,000 patients at a Puerto Rico community hospital. Key takeaways include the importance of layered email security, thorough incident scoping, and addressing configuration blind spots before threat actors exploit them.

In this episode, we break down the FBI's latest Internet Crime Report naming healthcare as the top ransomware target, OCR's four new HIPAA settlements totaling over $1 million, and the Medtronic data extortion incident affecting millions of records. We also examine findings from Paubox's Healthcare Email Security Maturity Index, which reveals critical gaps in AI-based defenses despite rising AI-driven attacks, and discuss what these trends mean for your organization's security posture.

In this episode, we break down recent healthcare cybersecurity incidents including a $1.45 million class action settlement stemming from missing MFA and unencrypted data, a repeat ransomware attack on a small cardiology practice, and how attackers are bypassing traditional email authentication. We also discuss the emerging threat of AI-assisted cyberattacks and actionable steps organizations can take to address common security blind spots.

This episode examines recent ransomware attacks affecting Brockton Hospital, Stockton Cardiology, and Rocky Mountain Care, alongside a Dutch supply chain breach impacting eleven hospitals. The hosts discuss the EvilTokens phishing kit that bypasses MFA through Microsoft 365 device code flow exploitation, and share practical defenses including conditional access policies, improved logging, and incident response planning. Key insights from the April Zoom social mixer cover monthly penetration testing, effective security awareness training, and AI adoption guardrails.

This episode examines recent cybersecurity incidents affecting healthcare organizations, including breaches at Intuitive Surgical, Nacogdoches Memorial Hospital, and Innovative Pharmacy Packaging Corp, alongside a sophisticated job scam targeting professionals. Key takeaways include the critical importance of phishing training, network monitoring, vendor risk assessments, and reducing detection dwell time. The discussion reinforces that most breaches stem from preventable issues like misconfigurations, blind spots, and social engineering vulnerabilities.

In this episode, Alex and Jen break down three recent cybersecurity incidents affecting healthcare and social services organizations: Microsoft Teams impersonation attacks targeting healthcare and financial sectors, fake AI apps harvesting credentials, and a ransomware breach at a nonprofit serving vulnerable populations. The discussion highlights how misconfigurations and overlooked security basics create exploitable gaps, and offers practical steps for locking down external communications, verifying app legitimacy, and strengthening defenses against ransomware.

In this episode, we break down recent healthcare cybersecurity incidents including the Navia benefits administrator breach affecting nearly three million individuals, ransomware attacks on Kettering Health and a US healthcare provider, and the Essen Medical Associates settlement. We examine common vulnerabilities across these cases—from inadequate privileged access monitoring to untested incident response plans—and discuss actionable steps organizations can take to strengthen their security posture. The key takeaway: most breaches stem from addressable gaps, and consistent attention to fundamentals remains the most effective defense.

In this episode, Alex and Jen break down the latest cybersecurity incidents affecting healthcare, including ransomware targeting community health organizations, phishing attacks leveraging trusted cloud platforms, MFA bypass techniques, and the exploitation of legitimate admin tools in cloud environments. The discussion emphasizes that most breaches stem from preventable configuration gaps and offers actionable guidance on endpoint protection, network segmentation, and phishing-resistant authentication methods.

Episode 68 features Aja Anderson, Paubox Customer Success Manager. 

Episode 67 features Aja Anderson, Paubox Customer Success Manager. 

Episode 66 of HIPAA Critical features an interview with Founder CEO, Hoala Greevy, about workflow automation. 

Episode 65 of HIPAA Critical recaps the HIPAA Breach Report details breaches from December 2021. 

Episode 64 of HIPAA Critical features an interview with Dave Ledoux, CIO of Innovive Health. 

Episode 63 of HIPAA Critical features a discussion with Aja Anderson on this month's Paubox HIPAA Breach Report. 

Episode 62 of HIPAA Critical features an interview with Hector Rodriguez, Principal Industry Specialist, Healthcare & Life Sciences - AWS

Episode 61 of HIPAA Critical features an interview with Su Bajaj, CTO of Compex Legal. 

Episode 60 of HIPAA Critical features an interview with Brian Fritton, CEO of Havoc Shield. 

Episode 59 of HIPAA Critical covers the Paubox HIPAA Breach Report for October 2021 and other cybersecurity trends with guest Aja Anderson, Paubox Customer Success Manager. 

Episode 58 of HIPAA Critical includes an interview with Matt Cooper, Cybersecurity & Data Privacy Principal at Vanta. 

Episode 57 of HIPAA Critical features an interview about AI with Paubox Founder CEO, Hoala Greevy. 

Episode 56 of HIPAA Critical features an interview with Sara Sosa, Director of Information Services at Vista Care. 

Episode 56 of HIPAA Critical welcomes back Paubox Customer Success Manager, Aja Anderson, to discuss the findings of the Paubox HIPAA Breach Report for September 2021.  

Episode 54 includes an interview with Jane Harper. Jane is the senior director, information security risk management and business engagement at Eli Lilly and Company. 

Episode 53 of the HIPAA Critical podcast features an interview with Anshul Pande, vice president and chief technology officer at Stanford Children's Health. 

Episode 52 of HIPAA Critical welcomes back Paubox Customer Success Manager, Aja Anderson, to discuss the findings of the Paubox HIPAA Breach Report for August 2021. 

Episode 51 of HIPAA Critical includes an interview with Dr. Eric Cole, a former CIA hacker and founder of Secure Anchor.Read the transcript here. More about Paubox: www.paubox.com 

Fred Kwong, CISO of Delta Dental is featured on episode 50 of HIPAA Critical.Read the full transcription here.  

Episode 49 covers the findings of the Paubox HIPAA Breach Report for July 2021. Aja Anderson, customer success manager at Paubox, joins the episode to discuss key trends, share insights, and give cybersecurity tips. 

Episode 48 of the HIPAA Critical Podcast includes an interview with Todd Pang, president and co-owner of Caring Manoa. 

The challenges of 2020 are still lingering in many industries we might be in a new year. But the effects of the covid-19 pandemic reach far and wide. The way we work and the way business operated changed dramatically and almost overnight. Jeff Karlsson is on today's episode. Jeff is the chief operating officer of Divergent Business Consulting, a Salesforce and financial consulting company. Jeff and Sierra Langston sit down to discuss the COVID-19 pandemic, how to force change across many industries, and emerging healthcare trends. 

Elderly care organizations need to comply with HIPAA regulations and security rules, especially if they deal with their patient’s medications, doctors, or other sensitive information. What is the best way for these types of organizations to approach HIPAA compliance and secure data? How do we keep the most vulnerable members of our society safe from bad actors? John Benbrook, president of Oasis Senior Partners, and Paul Giovacchini, enterprise customer success manager at Paubox, join Sierra Langston on today’s episode to discuss HIPAA compliance training, assessing risk management, and unencrypted data vulnerabilities.

Cybersecurity protocols and practices will never be a one-size-fits-all solution. Different industries have different requirements for compliance. Healthcare has vague but vast security rules to follow under HIPAA. So how do organizations stay ahead of the cybersecurity curve?Greg Reber, Founder and CEO, of AsTech Consulting, is with us on today’s episode. He and Sierra Langston discuss the changes and challenges in cybersecurity, including implementing solutions that meet regulatory standards, the evolving threat landscape, and how information sharing is a key to the future of cybersecurity.