Social media takes a lot of heat for spreading disinformation, but Francesca Tripodi thinks we should look more closely at another fixture of our browsers: search engines. On this episode of "Civic Genius" we learn more about how the same forces that shape our social media diets also drive the information we find when we search online, and how we can boost our own media literacy.
Background
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to protect sensitive health information from being disclosed without patients’ consent. Under this act, a patient’s privacy is safeguarded through the enforcement of strict standards on managing, transmitting, and storing health information.
In 2003, the U.S. Department of Health and Human Services published the HIPAA Security Rule. The Security Rule aimed to protect the security of a subset of identifiable patient information called Electronic Protected Health Information, or ePHI. Under this rule, regulated entities, such as providers and hospitals, are required to comply with administrative, technical, and physical requirements.
On January 6, 2025, the Office for Civil Rights within the HHS issued a notice of proposed rulemaking (NPRM) for the HIPAA Security Rule. NPRMs are a part of the federal rulemaking process in which a proposed rule is published in the Federal Register and made public and open to feedback from individuals, organizations, and other stakeholders. After reviewing the comments, agencies like the HHS can revise the rule before finalizing it. The proposed rule to the HIPAA Security Rule comes in response to a surge in data breaches in the healthcare industry. Cybersecurity challenges in healthcare top those of any other industry with over $10.93 million lost to breaches in 2024, a number that has been increasing in the past years. This NPRM seeks to “improve cybersecurity and better protect the American health care system from a growing number of cyberattacks” by strengthening the Security Rule. The Security Rule had only been changed once before, in 2013, under the HIPAA Omnibus Rule, and these changes were also aimed at enhancing the privacy of ePHI.
Arguments in Favor
Supporters of the proposed changes to the HIPAA Security Rule argue that it is a crucial and necessary move to strengthen the privacy of electronic protected health information. They contend that the changes will close existing gaps in security by creating a more consistent defense and also increase the public’s trust in digital health systems. Proponents emphasize the stricter wording and removal of ambiguous language will enhance compliance and reduce vulnerabilities in protecting sensitive information.
Enhanced Privacy of ePHI
The proposed changes would ultimately strengthen protections around ePHI in response to the high utilization of electronic records and the increased risk for cyber incidents associated with electronic records. HHS aims to establish more consistent baseline regulations for all covered entities to ensure proper compliance and enhanced protection. The rule enforces more rigorous safeguards on formerly addressable controls through mechanisms such as a technical inventory, data mapping requirements, and mandatory authenticity controls. Together, these measures will aim to close existing security gaps and create a more uniform defense against cyber threats.
Increased Public Trust
The proposed rule is also expected to increase and restore the public’s trust in the new world of digital health systems. Currently, breach costs and high frequency of attacks constantly put patients’ data at risk. Between 2018 and 2023, breach reports made to OCR doubled and the number of people targeted and affected by these attacks increased by more than tenfold, with over 167 million people affected in total in 2023. In early 2024, over 100 million UnitedHealth patients were victims of cyberattacks that leaked their private information, exposing the vulnerabilities across the healthcare industry. Shortly after this incident, the NPRM was introduced as a direct regulatory response to the growing concerns. Through a multi-lever effort in ensuring heightened security of ePHI, the proposed rule works to rebuild patients’ and other stakeholders’ confidence in the protection of their digital health information.
Decreased Ambiguity
Much of the proposed rule’s efforts are directed toward eliminating the ambiguity and leniency around compliance by enforcing more stringent and defined standards. It amends the “addressable” language in the original Security Rule which offers flexibility to covered entities on implementing safeguards and replaces it with required specifications to ensure that entities do not misinterpret “addressable” as optional. The rule changes reduce uncertainties around regulation for healthcare providers and provide clarity for enforcement agencies via more explicit requirements. This would promote more efficient and consistent interpretation and compliance around cybersecurity.
Arguments in Opposition
Opponents of the proposed changes to the HIPAA Security Rule highlight concerns about the costs and practicality of implementing the new rules. They argue that the more stringent requirements may burden smaller or resource-limited healthcare providers, potentially diverting resources from patient care or creating workflow disruptions. Critics also note potential overlaps with existing cybersecurity frameworks, which could result in redundancy, making compliance more difficult.
Resource and Cost
HHS’s proposed changes to the HIPAA Security Rule may place significant financial burdens on smaller or rural healthcare providers. The more stringent requirements on ePHI regulation can put a strain on these providers who may lack resources to conduct annual audits, risk assessments, and other mandatory procedures. This, in turn, can lead to resources being diverted from clinical care, impacting timely patient care. Furthermore, the new regulations would require a significant portion of employees in a practice to engage in HIPAA training, which can lead to even greater workflow disruptions. These providers will also have to ensure that they have sufficient staffing and procedures to provide records in a shortened timeframe. This further widens the equity gap between large and small healthcare entities.
Complexity of Implementation
The implementation of the new rule changes may potentially be a complex and disruptive process. Training a large number of employees on HIPAA procedures and performing the now required security evaluations may interfere with workflow and delay timely patient care. With an increase in documentation and compliance burden, entities may necessitate the help of third-party legal and IT experts in order to meet the requirements to implement high level security measures under a shorter timespan. Equity concerns may be raised as a result of disproportionate burdens falling on smaller providers who may face more barriers to compliance than larger organizations.
Overlapping Policy Frameworks
Redundancy and misalignment of policies may also pose a problem for healthcare organizations and entities that already adhere to existing cybersecurity frameworks. The NIST Cybersecurity Framework (CSF) and HITRUST Common Security Framework (CSF) are two frameworks that contain similar controls in HIPAA risks as the proposed rule. Many of the changes outlined in the NPRM overlap with the rules that are already in place under these existing frameworks which may create confusion and conflicts that can lead to duplicative efforts. Covered entities may face inefficiencies in complying with the proposed rule without clearer guidance on how the rule changes align with existing regulations.
Conclusion
HHS’s proposed rule to the HIPAA Security Rule is a timely response to the rising concern over cybersecurity vulnerabilities in healthcare. As ePHI use and technology are rapidly evolving, the proposed rule is a necessary effort toward modernizing outdated standards for digital health information. However, despite the rule’s potential for strengthening privacy and public trust in digital health, there are equity concerns regarding the financial burdens and complications that smaller entities may face in implementing these changes. Moving forward, it will be important to strike a balance between security and feasibility in the implementation of the proposed rule in order to effectively protect patient privacy while maintaining an equitable healthcare system.
New Cybersecurity Rules for Healthcare? Understanding HHS’s HIPPA Proposal was originally published by the ACE and is republished with permission.
A case for optimism, risk-taking, and policy experimentation in the age of AI—and why pessimism threatens technological progress.
Society needs people to take risks. Entrepreneurs who bet on themselves create new jobs. Institutions that gamble with new processes find out best to integrate advances into modern life. Regulators who accept potential backlash by launching policy experiments give us a chance to devise laws that are based on evidence, not fear.
The need for risk taking is all the more important when society is presented with new technologies. When new tech arrives on the scene, defense of the status quo is the easier path--individually, institutionally, and societally. We are all predisposed to think that the calamities, ailments, and flaws we experience today--as bad as they may be--are preferable to the unknowns tied to tomorrow.
This mental handicap probably helped us survive at some point, but excessive hesitancy can be paralyzing in the short-run and fatal in the long-run. Think of the lives that could have been saved had seat belts been adopted sooner. Imagine the diplomacy that may have occurred and, by extension, the wars avoided, if the telegraph were available decades earlier. Ponder how diffusion of electricity across America over the course of a few years, rather than a few decades, could have improved the quality of life for millions.
Each of these technological advances required individuals willing to test ideas, to fail, and to persist. Seat belts were far from popular when initially introduced. People doubted their efficacy and pushed back on related regulations. The officials and organizations that saw through skepticism and worked diligently to provide more evidence, demonstrations, and case studies related to these novel devices deserve tremendous thanks.
The laying of the first telegraph cables did not go well. Rough seas and resource constraints all made this infrastructure feat something that a risk-averse person would avoid like the middle seat. Yet, a few such people didn’t shy away from the hope of rapid communication. We’re in their debt, too.
Advocates for electricity faced their own hurdles. Consider Lyndon B. Johnson, then a just local politician, forcefully pushing the federal government to invest in the electrification of rural Texas. Some thought such investments were unnecessary or better left to another time. Johnson and others insisted.
Risk-taking, in hindsight, tends to look like the common sensical path. Of course, there are exceptions--there’s a difference between risks and true gambles. The former are grounded in more than mere speculation; they are based on specific moral principles and technological understandings. When people take those kinds of risks, we all tend to benefit.
The same is true in the Age of AI. Many Americans are understandably underwhelmed by artificial intelligence (AI) systems that seem little more than slop machines and job destroyers. It’s politically and culturally easy to take the view that AI is a net negative and to resist its application in new situations.
That’s precisely why we need another generation of risk-takers and, to be more precise, optimists. We won’t realize the benefits of AI in health care, education, and transportation, unless three conditions are met: policymakers with sufficient popular support to experiment with novel regulations; institutions with the proper staff, technology, and financial flexibility to test new workflows and develop new products; and, founders with access to the funds required to build the AI we actually want.
None of these conditions will be satisfied if pessimism abounds. Pessimism induces zero-sum thinking. You’ll rarely meet a doomsday prepper keen to share their cans of beans. Extreme doubt about tomorrow saps risk-taking energy like a wet blanket on a bonfire.
Skepticism, however, is necessary. It’s grounded in curiosity and invites further investigation. What’s even better, though, is optimism. Optimism cultivates risk-taking by making it socially-, financially-, and politically-easier to bet on the future.
Many aspects of technological disruption caution against such optimism. We’ve heard the promise of technology before, only to see it fray our social fabric and upend our economy. That’s why optimism must be paired with the proper institutional governance that fosters the right distribution of risk and reward.
To borrow from Betsey Stevenson, “The lesson is not that technology is bad, but that productivity gains do not automatically translate into flourishing. They only do so when societies build institutions that make the new economic regime first tolerable, and then genuinely beneficial, for most people.”
But that core task—building, redesigning—won’t occur if pessimism is pervasive. It requires the sort of imagination and investment only possible with some degree of optimism.
The tricky part is how to generate that outlook. There’s no deposit of optimism in some mine—it’s something we have to create and sustain. The easiest place to start is challenging prophets of doom. Their ubiquity and dominance in the headlines quashes the seeds of hope. Simply by challenging those who say our best days are behind us, we can get closer to betting that there are brighter days ahead.
President Donald Trump with Secretary of State Marco Rubio, left, and Secretary of Defense Pete Hegseth
President Donald Trump signed into law this month a measure that prohibits anyone based in China and other adversarial countries from accessing the Pentagon’s cloud computing systems.
The ban, which is tucked inside the $900 billion defense policy law, was enacted in response to a ProPublica investigation this year that exposed how Microsoft used China-based engineers to service the Defense Department’s computer systems for nearly a decade — a practice that left some of the country’s most sensitive data vulnerable to hacking from its leading cyber adversary.
U.S.-based supervisors, known as “digital escorts,” were supposed to serve as a check on these foreign employees, but we found they often lacked the expertise needed to effectively supervise engineers with far more advanced technical skills.
In the wake of the reporting, leading members of Congress called on the Defense Department to strengthen its security requirements while blasting Microsoft for what some Republicans called “a national betrayal.” Cybersecurity and intelligence experts have told ProPublica that the arrangement posed major risks to national security, given that laws in China grant the country’s officials broad authority to collect data.
Microsoft pledged in July to stop using China-based engineers to service Pentagon cloud systems after Defense Secretary Pete Hegseth publicly condemned the practice. “Foreign engineers — from any country, including of course China — should NEVER be allowed to maintain or access DoD systems,” Hegseth wrote on X.
In September, the Pentagon updated its cybersecurity requirements for tech contractors, banning IT vendors from using China-based personnel to work on Defense Department computer systems. The new law effectively codifies that change, requiring Hegseth to prohibit individuals from China, Russia, Iran and North Korea from having direct or indirect access to Defense Department cloud computing systems.
Microsoft declined to comment on the new law. Following the earlier changes, a spokesperson said the company would “work with our national security partners to evaluate and adjust our security protocols in light of the new directives.”
Rep. Elise Stefanik, a Republican who serves on the House Armed Service Committee, celebrated the development, saying it “closes contractor loopholes … following the discovery that companies like Microsoft exploited” them. Sen. Tom Cotton, the GOP chair of the Senate Select Committee on Intelligence who has been critical of the tech giant, also heralded the legislation, saying it “includes much-needed efforts to protect our nation’s critical infrastructure, which is threatened by Communist China and other foreign adversaries.”
The legislation also bolsters congressional oversight of the Pentagon’s cybersecurity practices, mandating that the secretary brief the congressional defense committees on the changes no later than June 1, 2026. After that, such briefings will take place annually for the next three years, including updates on the “effectiveness of controls, security incidents, and recommendations for legislative or administrative action.”
As ProPublica reported, Microsoft initially developed the digital escort program as a work-around to a Defense Department requirement that people handling sensitive data be U.S. citizens or permanent residents.
The company has maintained that it disclosed the program to the Pentagon and that escorts were provided “specific training on protecting sensitive data” and preventing harm. But top Pentagon officials have said they were unaware of Microsoft’s program until ProPublica’s reporting.
A copy of the security plan that the company submitted to the Defense Department in 2025 showed Microsoft left out key details of the escort program, making no reference to its China-based operations or foreign engineers at all.
This summer, Hegseth announced that the department had opened an investigation into whether any of Microsoft’s China-based engineers had compromised national security. He also ordered a new third-party audit of the company’s digital-escort program. The Pentagon did not respond to a request for comment on the status of those inquiries.
Trump Signs Defense Bill Prohibiting China-Based Engineers in Pentagon IT Work was originally published by ProPublica and is republished with permission.
AI-powered wellness tools promise care at work, but raise serious questions about consent, surveillance, and employee autonomy.
Across the U.S. and globally, employers—including corporations, healthcare systems, universities, and nonprofits—are increasing investment in worker well-being. The global corporate wellness market reached $53.5 billion in sales in 2024, with North America leading adoption. Corporate wellness programs now use AI to monitor stress, track burnout risk, or recommend personalized interventions.
Vendors offering AI-enabled well-being platforms, chatbots, and stress-tracking tools are rapidly expanding. Chatbots such as Woebot and Wysa are increasingly integrated into workplace wellness programs.
Recently, Indian health platform Tata 1mg partnered with payroll fintech OneBanc to integrate AI-driven corporate healthcare directly into payroll systems, embedding wellness analytics into routine employment infrastructure rather than treating mental-health support as a separate benefit. Similar deployments are emerging across sectors.
While no public data reliably quantify how many workers use AI wellness tools, market growth and vendor proliferation suggest these systems already reach millions of workers. The market for chatbot-based mental-health apps alone is estimated at $2.1 billion in 2025, projected to grow to $7.5 billion by 2034.
Observers report that AI can potentially enhance workplace wellness by analyzing patterns of employee fatigue, scheduling micro-breaks, and flagging early signs of overload. Tools such as Virtuosis AI can analyze voice and speech patterns during meetings to detect worker stress and emotional strain.
On the surface, these technologies promise care, prevention, and support.
Imagine your supervisor asking, “Would you like to try this new AI tool that helps monitor stress and well-being? Completely optional, of course.”
The offer sounds supportive, even generous. But if you are like most employees, you do not truly feel free to decline. Consent offered in the presence of managerial power is never just consent—it is a performance, often a tacit obligation. And as AI well-being tools seep deeper into workplaces, this illusion of choice becomes even more fragile.
The risks are no longer hypothetical: Amazon has faced public criticism over wellness-framed, productivity-linked workplace monitoring, raising concerns about how well-being rhetoric can justify expanding surveillance.
At the center of this tension is the ideal of informed consent, which for decades has been the ethical backbone of data collection. If people are told what data is gathered, how it will be used, and what risks it carries, then their agreement is considered meaningful. But this model fails when applied to AI-driven well-being tools.
First, informed consent assumes a single and static moment of agreement, while AI systems operate continuously. A worker may click “yes” once, but the system collects behavioral and physiological signals throughout the day—none of which were fully foreseeable when the worker agreed. It seems unfair that consent is a one-time act, yet the data collection continues indefinitely.
Second, the information that workers receive during consent is often inadequate, vague, or too complex. Privacy notices promise that data will be “aggregated,” “anonymized,” or used to “improve engagement”—phrases that obscure the reality that AI systems generate inferences about mood, stress, or disengagement. Even when disclosures are technically correct, they are too complex for workers to meaningfully understand. Workers end up consenting amidst power inequities and socio-organizational complexities.
And then there is consent fatigue. Workers face constant prompts—policy updates, cookie banners, new app permissions. Eventually, one might click “yes” simply to continue working. Consent would rather become a reflex or convenience rather than a choice.
To be sure, workplaces have made meaningful progress in supporting well-being, and AI can genuinely help when implemented thoughtfully.
Many organizations have expanded mental health benefits and adopted flexible or hybrid work models shown to reduce stress and improve work–life balance. Likewise, empirical research suggests AI can indirectly enhance well-being by improving task optimization and workplace safety.
Such advances in workplace AI tools are critical. Yet even with expanded structural support and promising technologies, the mindset around work and worker expectations has not kept pace—shaping how well-being tools are experienced and often making workers feel compelled to say yes, even when framed as “optional.”
Even perfect consent notices cannot overcome workplace power. Workers know that managers control evaluations, promotions, and workloads. Declining a “voluntary” well-being tool can feel risky, even if the consequences are unspoken. Consent becomes a reflection of workplace politics rather than an expression of personal autonomy.
Drawing from feminist theories of sexual consent, the FRIES model of affirmative consent-- Freely given, Reversible, Informed, Enthusiastic, and Specific—provides a sharp lens for evaluating workplace use of AI.
Consent is not freely given when declining feels risky. It is not reversible when withdrawing later invites scrutiny. It is not informed when AI inference is opaque or evolving. It is rarely enthusiastic; many workers say yes out of self-protection. And it is almost never specific; opting into a single function often authorizes far more data collection than workers realize.
This is where the FRIES model offers clarity, echoing the feminist, sex-positive shift from a “no means no” standard to a “yes means yes” understanding of consent. Consent is not freely given when declining feels unsafe.
It is not reversible when opting out later raises questions. It is not informed when AI inference is opaque. It is rarely enthusiastic; many say yes to avoid negative assumptions. And it is almost never specific; agreeing to one feature often enables a broader system of hidden data tracking.
In our own research on workplace well-being technologies, workers stressed that meaningful consent requires changes not only to the technology but to the policies and organizational practices around it—underscoring that workplace consent is a structural problem—something that requires socio-technical solutions, not just better disclosure screens.
If employers want meaningful consent, they must move beyond checkbox compliance and create conditions where affirmative and continuous consent is truly possible. Participation must be genuinely voluntary.
Opting out must have no social or professional penalty—neither explicit nor implicit. Data practices need to be transparent and auditable. Most importantly, well-being must be grounded in organizational culture—not in the hope that an algorithm can fix structural problems or unrealistic expectations.
The real challenge is not perfecting AI that claims to care for workers but building workplaces where care is already embedded—where consent is real, autonomy is respected, and technology supports people.
Dr. Koustuv Saha is an Assistant Professor of Computer Science at the University of Illinois Urbana-Champaign’s (UIUC) Siebel School of Computing and Data Science and is a Public Voices Fellow of The OpEd Project.
