The 229 Podcast

June 31, 2026: David Finn has watched health IT security evolve from a compliance checkbox to an enterprise risk conversation, and now into an AI agentic era that's rewriting the rules again. Now teaching courses and advising across the industry, he unpacks what the recent OpenAI and Hugging Face breaches really exposed, and it wasn't a technology failure. It was a governance failure. David draws on decades of building security programs, including a stint as an "accidental CIO," to explain why healthcare keeps solving the wrong problem, why third-party risk is still underestimated, and why AI agents need constant behavioral monitoring instead of one-time guardrails.
Key Points:
04:42 Governance Over Controls

10:43 Pace Change: Get It Right

16:12 Third Party Risk Reality

20:34 Start With Executives

22:39 AI Jobs Policies Monitoring

37:56 Guardrails to Behavior Monitoring

Keep up to date on the latest in health IT:
https://thisweekhealth.com/news/
X: This Week Health
LinkedIn: This Week Health
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

June 30, 2026: John Helvey, CEO of SacValley MedShare, has spent five-plus years building one of California's leading regional health information exchanges. He sits down with Sarah Richardson to unpack why national data networks still fall short: patient-matching gaps, geofencing blind spots, and the 60 to 90 seconds patients and providers spend waiting for data that should already be there. John explains how his team is turning raw interoperable data into something clinicians can actually use, why health systems need better incentives to share, and what it will take to build a true patient-centered data home.
Key Points:
01:44 Why Interop Is Hard

09:17 Push vs Pull Data Sharing

11:36 Consumer Access and Identity

14:55 From Movable to Usable Data

20:06 Future Vision and Closing

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

July 27, 2026: Clay Maddox, Healthcare Horizon Practice Manager at CrowdStrike, to unpack a threat that's quietly reshaping healthcare security: adversary-in-the-middle attacks. These aren't your old-school man-in-the-middle exploits. Adversaries are stealing session tokens after a legitimate login, then pivoting straight into SaaS applications and browsers, no credentials needed. Clay breaks down the increasing supply chain risk and the identity problem everyone's still fighting, and what CrowdStrike's healthcare team is teaching in a free session on August 13th.
Key Points:
00:40 What Is Adversary in the Middle

02:03 Key Takeaways Overview

05:02 Who’s Speaking and Unified View

06:06 Register and Closing Thanks

Register for the Defending Against AiTM Attacks in Healthcare Webinar: https://go.crowdstrike.com/2026-08-aitm-healthcare.html?utm_campaign=stop_ai_accelerated_adversaries&utm_medium=evt&utm_source=prtn&utm_language=en-us
Keep up to date on the latest in health IT:
https://thisweekhealth.com/news/
X: This Week Health
LinkedIn: This Week Health
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

July 27, 2026: Bill Russell, Drex DeFord, and Sarah Richardson break down a week's worth of headlines, starting with Bill’s AI musings on the future "workhorse" models built for speed over depth. The conversation turns serious fast: healthcare doesn't own its AI platforms; it rents them, and that dependency carries real resilience risk. They dig into who's actually accountable when AI gets a clinical decision wrong, unpack the first fully autonomous ransomware attack, and revisit why CIOs keep reacting to agendas instead of setting them.
Key Points:
05:16 Platform First and Shadow AI

13:13 Owning the Harness

15:57 Mayo AI Safety Lawsuit

18:33 Autonomous Ransomware Agents

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

Picture this. You're the CISO at one of the world's largest healthcare companies, and Monday morning brings a call about a cybersecurity incident in a legacy diagnostics environment. Before the briefing even wraps, someone walks in with news of a second incident. Different system, different root cause, same day.
Drex breaks down why that scenario isn't hypothetical, using a recent real-world healthcare giant's dual cyber battles as the wake-up call. Between sprawling app portfolios, aging infrastructure, and an expanding web of AI-powered partners, the attack surface has changed and so has the shape of a breach.
So here's the question for your team this week. If two incidents hit at once, could you actually handle both?
Remember, Stay a Little Paranoid