Low Code/High Impact

The episode has pockets of useful, practitioner-level detail - particularly around the BAA-as-prerequisite point, the shadow AI breach risk, and the class action settlement breakdown - but is padded with HIPAA 101 explainers (three categories of covered entities, what a business associate is) that any healthcare compliance professional already knows. The signal-to-filler ratio is mediocre.

“there is no such thing as HIPAA certified or someone being able to tell you that you're HIPAA compliant”

“if you put in phi, you have a breach”

The 'HIPAA is not the hard part' framing is mildly contrarian and the observation that AI fear is pushing organizations to blanket-prohibit de-identification, reversing a decade of progress, is a genuinely fresh observation. Most of the rest - shadow AI risk, checkbox compliance critique, BAA limitations - is widely circulated in healthcare compliance circles.

“before AI really started exploding over the past couple years, it felt like the industry had gotten to a place where there was comfort around de-identification...It now feels like we're falling back 10 plus years”

“HIPAA helps you build a good foundation that you can then build a really solid house on top of”

Matt Fisher is a credible, working practitioner - a partner at a real firm doing actual healthcare regulatory and privacy work with a range of clients including multi-state health systems and startups. He's not a thought-leader-for-hire, but he's also not an operator who has built and scaled something himself, limiting the operational depth of his insights.

“I'm currently a partner at the law firm of Hancock, Daniel and Johnson...My specialty is I do corporate and regulatory law within healthcare”

“I've been doing it for about 10 years now and it's a show where I just get to talk with fun people from all across the healthcare industry”

The $900K class action settlement breakdown (roughly $400K to attorneys, $1,200 to class litigants, $10 voucher) is the standout concrete data point. The shift from a few breaches per week 12 - 15 years ago to 3 - 5 per day now is useful. However, most claims are heavily hedged with 'probably,' 'might,' and 'I think,' and named examples beyond AWS/Azure/OpenAI are absent.

“it was a $900,000 total settlement...about 400 went to the attorneys...the five people who are identified as the class litigants, they each got about $1,200...a $10 voucher to be used at the provider that was impacted”

“when I first started really paying attention to it, say like 12, 15 years ago, it would be a couple a week...there's probably anywhere from three to five or more breaches that are being covered as reported that day”

The host's questions are topically organized but consistently soft - 'What do you mean by that?', 'Do you think organizations are aware?' - and there is zero pushback or challenge to any of Matt's claims throughout. The host mainly functions as a topic-switcher rather than a genuine interlocutor, and several answers drift into vagueness without a follow-up to pin them down.

“Yeah, no, thank you for sharing. That makes sense”

“Do you think organizations are aware of the exposure of that?”