Low Code/High Impact

The episode has pockets of useful, practitioner-level detail—particularly around the BAA-as-prerequisite point, the shadow AI breach risk, and the class action settlement breakdown—but is padded with HIPAA 101 explainers (three categories of covered entities, what a business associate is) that any healthcare compliance professional already knows. The signal-to-filler ratio is mediocre.

“there is no such thing as HIPAA certified or someone being able to tell you that you're HIPAA compliant”

“if you put in phi, you have a breach”

The 'HIPAA is not the hard part' framing is mildly contrarian and the observation that AI fear is pushing organizations to blanket-prohibit de-identification, reversing a decade of progress, is a genuinely fresh observation. Most of the rest—shadow AI risk, checkbox compliance critique, BAA limitations—is widely circulated in healthcare compliance circles.

“before AI really started exploding over the past couple years, it felt like the industry had gotten to a place where there was comfort around de-identification...It now feels like we're falling back 10 plus years”

“HIPAA helps you build a good foundation that you can then build a really solid house on top of”

Matt Fisher is a credible, working practitioner—a partner at a real firm doing actual healthcare regulatory and privacy work with a range of clients including multi-state health systems and startups. He's not a thought-leader-for-hire, but he's also not an operator who has built and scaled something himself, limiting the operational depth of his insights.

“I'm currently a partner at the law firm of Hancock, Daniel and Johnson...My specialty is I do corporate and regulatory law within healthcare”

“I've been doing it for about 10 years now and it's a show where I just get to talk with fun people from all across the healthcare industry”

The $900K class action settlement breakdown (roughly $400K to attorneys, $1,200 to class litigants, $10 voucher) is the standout concrete data point. The shift from a few breaches per week 12–15 years ago to 3–5 per day now is useful. However, most claims are heavily hedged with 'probably,' 'might,' and 'I think,' and named examples beyond AWS/Azure/OpenAI are absent.

“it was a $900,000 total settlement...about 400 went to the attorneys...the five people who are identified as the class litigants, they each got about $1,200...a $10 voucher to be used at the provider that was impacted”

“when I first started really paying attention to it, say like 12, 15 years ago, it would be a couple a week...there's probably anywhere from three to five or more breaches that are being covered as reported that day”

The host's questions are topically organized but consistently soft—'What do you mean by that?', 'Do you think organizations are aware?'—and there is zero pushback or challenge to any of Matt's claims throughout. The host mainly functions as a topic-switcher rather than a genuine interlocutor, and several answers drift into vagueness without a follow-up to pin them down.

“Yeah, no, thank you for sharing. That makes sense”

“Do you think organizations are aware of the exposure of that?”