cuttingedgecomputers

AI in the Practice: Saving Time Without Putting Patient Information at Risk

Tue, 06 Oct 2026 18:25:25 GMT

AI in the Practice: Saving Time Without Putting Patient Information at Risk

AI has moved into medical practices faster than most practices have written rules for it. In the American Medical Association's 2026 Physician Survey on Augmented Intelligence , 81% of physicians said they use AI professionally, more than double the 2023 rate. Documentation and research summaries top the list.

The tools are easy. Sign up with an email, paste in some text, and get a clean summary in seconds. That ease is the appeal, and it's also the gap. A physician tries a new transcription app on a busy Tuesday. A front desk employee uploads a billing spreadsheet to fix the formatting. Nobody stopped to check how the service handles what it received.

This isn't an argument against AI. It's an argument for deciding, as a practice, which tools you use, what goes into them, and who checks what comes out.

Where AI Helps, and Where It Goes Wrong
Most AI mistakes in a practice aren't dramatic. They're shortcuts taken by good employees trying to save time. Here's what that looks like day to day:

The pattern is the same in every row. The task is fine. The problem is the tool, the account, or the data that went into it.

The Tool and the Account Matter More Than the Brand
A familiar name doesn't make a service appropriate for patient information. Neither does a paid subscription.

Many AI companies offer personal, team, and enterprise versions of the same product, each with different terms for storage, retention, and how your data may be used. Those terms also change over time. What matters is the agreement attached to the specific account your staff is logged into, not the logo on the screen.

HIPAA has a clear position here. When a vendor creates, receives, maintains, or transmits protected health information (PHI) on your behalf, that vendor is a business associate, and you need a signed Business Associate Agreement (BAA) before sharing PHI with it. HHS has stated this directly in its Guidance on HIPAA & Cloud Computing , and it has said that using a cloud service to maintain electronic PHI without a BAA is a violation of the HIPAA Rules . A $20/month personal plan almost never comes with a BAA.

Our recommendation: use AI services the practice has approved, under accounts the practice controls, with documented protections that prevent patient information and confidential practice data from being used to train shared or general-purpose models.

What Happens to the Information Afterward
Typing something into an AI tool doesn't publish it to the internet. The real questions are about copies, access, and control. Ask each of these separately, because a good answer to one tells you nothing about the others:

Storage. Where is the data kept, and is it encrypted in transit and at rest?
Retention. How long are prompts, uploaded files, recordings, and transcripts kept? Can the practice delete them, and does deletion actually remove them?
Access. Who at the vendor can view your data, and why? On your side, can an administrator see who used the tool and what they submitted?
Sharing. Does the vendor pass data to other companies, such as hosting providers or the AI model provider behind the app? Under HIPAA, a business associate's subcontractors that handle PHI need their own BAAs .
Model training. Is your data used to train or improve models? Is the "no" written into the contract, or is it a settings toggle that someone could switch back on?

A "no training" commitment is worth having. It's one line in the review, not the whole review. A tool can promise never to train on your data and still keep it for years, give broad internal access, or share it with a subcontractor.

What the Government Expects
This is a practical summary, not legal advice. It's worth separating what HIPAA requires from what we recommend.

What HIPAA requires today :

A BAA with any vendor handling PHI on your behalf. This includes AI vendors. See HHS guidance on Business Associate Contracts .
A security risk analysis that covers all electronic PHI . The Security Rule requires an "accurate and thorough" assessment of risks to electronic PHI, plus steps to reduce those risks. A new AI tool that touches patient data belongs in that analysis. HHS explains the requirement in its Guidance on Risk Analysis , and OCR is actively enforcing it: its Risk Analysis Initiative had reached 13 completed investigations as of April 2026 .
Minimum necessary. For most uses outside of treatment, practices must limit PHI to the minimum necessary to accomplish the purpose.
Workforce training and breach response . Staff must be trained on your privacy and security policies, and an impermissible disclosure of PHI may trigger obligations under the Breach Notification Rule.

What we recommend (good practice, not a specific legal mandate):

A written list of approved AI tools
An AI use policy that spells out what information can and can't be entered
Contractual "no training" commitments from vendors
Human review of every AI output before it's used

What's coming . HHS proposed the first major update to the Security Rule since 2013, published in January 2025. It would add more specific requirements around asset inventories, encryption, and multifactor authentication. It is not final, and HHS states that the current Security Rule remains in effect in the meantime. Final action is now projected for July 2027 .

Recording patient conversations can also raise consent questions under state law, separate from HIPAA. Check your state's rules before turning on any ambient scribe.

Five Simple Rules for Physicians and Staff
Policies only work if people can remember them. Start here:

Use approved tools only, through practice accounts. If a tool isn't on the list, ask before using it for work. Personal accounts stay personal.
Know what never goes in . Patient names, records, images, billing exports, and confidential business data (contracts, payroll, financials) stay out of any tool that isn't approved for that type of information.
Get a review before turning on recording or connecting systems . Linking an AI tool to email, calendars, or the EHR gives it ongoing access, not a one-time look. That decision belongs to the practice, not one user.
A person checks every output. AI summaries, letters, and coding suggestions can be wrong in confident-sounding ways. A qualified person reviews anything before it goes into a chart, to a patient, or to a payer.
Report mistakes right away, without blame. If someone uploads the wrong file, they should know exactly who to tell. Fast reporting gives the practice time to assess the incident and meet any notification deadlines. People hide mistakes when they expect to be punished for them.

How Cutting Edge Computers Can Help

AI can give your team back real time, especially on documentation and administrative work. The practices that get the most from it treat adoption as an organizational decision: they pick the tools, sign the agreements, set the boundaries, and train their people. The ones that run into trouble let each employee figure it out alone.

CEC can help. We work with medical practices to evaluate AI tools, review security settings and vendor agreements, and put practical staff policies in place. Contact Cutting Edge Computers to start the conversation.

Sources:

American Medical Association, More than 80% of physicians use AI professionally: AMA survey (March 2026)
HHS, Guidance on HIPAA & Cloud Computing
HHS FAQ, Using a cloud service provider to maintain ePHI without a BAA
HHS, Business Associates
HHS, Business Associate Contracts
HHS, Guidance on Risk Analysis
HHS Press Release, OCR Settles Four HIPAA Security Rule Ransomware Investigations (April 23, 2026)
HHS, Minimum Necessary Requirement
HHS, Breach Notification Rule
HHS, HIPAA Security Rule NPRM
Troutman Pepper Locke, HIPAA Rulemaking Delays: Trends, Causes, and the Future of the Pending Security Rule Update (July 2026)

Franchise Resiliency

Mon, 22 Jun 2026 17:14:03 GMT

Restaurant Resiliency Starts with Reliable Technology
In today’s Quick Service Restaurant (QSR) environment, technology is no longer just a convenience—it’s the foundation of daily operations. From POS systems and online ordering platforms to drive-thru technology, kitchen displays, loyalty programs, and payment processing, restaurants rely on a complex web of interconnected systems to deliver the fast, seamless experience customers expect.

According to the 2026 State of Restaurant Resiliency survey conducted by QSR Magazine and Global Payments , restaurant operators increasingly recognize that technology disruptions represent one of the greatest threats to operational performance and profitability. The survey found that only 18% of restaurant leaders consider their organizations “highly resilient” with robust technology redundancies in place, while 50% describe themselves as only moderately resilient. This means the majority of operators remain vulnerable to outages, downtime, and technology failures that can quickly impact revenue and customer satisfaction.

The Biggest Technology Risks Facing QSR Operators
The survey identified several key operational vulnerabilities affecting restaurant brands today. Among the most significant were staffing shortages (45%), network and internet outages (32%), POS system downtime (32%), and supply chain or inventory disruptions (32%).

While labor challenges continue to dominate industry conversations, many of these operational issues are directly connected to technology infrastructure. When a restaurant loses internet connectivity or experiences a POS outage, the impact extends far beyond the register. Orders can fail to reach kitchen display systems, inventory updates may stop syncing, online ordering channels can become unavailable, and payment processing may grind to a halt.

For franchise organizations operating dozens or hundreds of locations, the consequences are even greater. A network disruption affecting multiple stores simultaneously can result in substantial lost revenue, customer frustration, and damage to brand reputation.

Why Network Reliability Matters More Than Ever
Modern restaurants have embraced cloud-based technologies because they offer scalability, centralized management, and visibility across multiple locations. However, cloud-based systems also introduce new dependencies. When connectivity is interrupted, critical business systems can become unavailable at the exact moment operators need them most.

The survey revealed that 82% of participants operate with either fully cloud-based or hybrid cloud environments. While these systems provide tremendous business advantages, they also create vulnerabilities when proper network redundancy and failover strategies are not in place.

For restaurant operators, resilience is no longer about simply preventing outages—it’s about maintaining operations when disruptions occur.

The Critical Role of POS System Continuity
The POS system sits at the center of every QSR operation. It connects payment processing, digital ordering, inventory management, loyalty programs, kitchen operations, and customer data.

Yet the survey found that only 20% of operators are highly confident their POS systems could continue operating if network connectivity were compromised.

A POS outage can create a chain reaction throughout the restaurant. Orders may not reach the kitchen, inventory counts become inaccurate, delivery integrations can fail, and employees are forced into manual workarounds that slow service and increase errors. For a business where speed and consistency drive profitability, even brief disruptions can have a measurable impact on revenue.

Building a More Resilient Restaurant Infrastructure
As restaurants continue investing in automation, AI-driven forecasting, self-service kiosks, digital ordering, and customer engagement technologies, the need for resilient infrastructure becomes even more important.

Technology initiatives only deliver value when the underlying network and support systems remain stable. Without proactive monitoring, redundancy planning, backup connectivity, and rapid issue resolution, new innovations can actually increase operational risk.

This is where experienced technology partners become invaluable.

How Cutting Edge Computers Can Help

At Cutting Edge Computers, we understand that franchise operators cannot afford downtime. Our managed IT services are designed to provide the reliability, visibility, and support that modern restaurant brands require.

We help franchise organizations maintain resilient technology environments through:

Proactive network monitoring and management
Multi-location IT support and standardization
POS system support and troubleshooting
Internet failover and redundancy solutions
Cybersecurity protection and compliance support
Remote issue resolution and help desk services
Infrastructure planning for growth and expansion

By continuously monitoring critical systems and addressing issues before they become outages, Cutting Edge Computers helps restaurants reduce operational disruptions, protect revenue, and maintain a consistent customer experience across every location.

Don't wait for an incident to find out where you stand. Reach out to Cutting Edge Computers today and let's talk about what the right security strategy looks like for your business.

Sources:

QSR Magazine & Global Payments. The State of Restaurant Resiliency: How Operators Maintain Reliability in a Disrupted World. Survey eBook, 2026.

Ransomware in 2026: What's Changed, Why It's Worse, and How to Protect Your Business

Tue, 17 Mar 2026 13:08:07 GMT

Ransomware isn't new. But if you think you understand it based on what you heard about a few years ago, it's time for an update. Today's attacks are faster, smarter, and far more destructive than anything we've seen before. Whether you're a business owner trying to keep your company safe or an IT professional looking to stay ahead of the threat landscape, this post breaks down exactly what's happening, why it matters, and what you can do about it.

AI Is Making Attacks Nearly Impossible to Spot
Not long ago, phishing emails — the most common entry point for ransomware — were relatively easy to identify. Awkward phrasing, broken English, strange formatting, and requests that just didn't quite make sense were telltale signs that something was off. Employees were trained to look for these red flags, and for a while, that training worked reasonably well.

That era is over.

Cybercriminals are now using artificial intelligence to craft phishing emails and social engineering attacks that are polished, professional, and completely convincing. A bad actor operating from another country no longer needs to speak fluent English: AI writes it for them. These messages can mimic the tone of your CEO, replicate the formatting of your bank, or pose as a trusted vendor with alarming accuracy. There are no typos. No strange requests. Nothing that feels "off."

This shift has fundamentally changed the threat landscape. AI allows attackers to personalize messages at scale — referencing your company name, your industry, even recent news about your business — making each attack feel targeted and legitimate. The result is that even savvy, well-trained employees are getting fooled.

According to Microsoft's 2025 Digital Defense Report , AI-enhanced phishing and social engineering have increased 4.5x over the last year and have become among the most significant drivers of cybersecurity incidents globally, with attackers leveraging large language models to generate highly convincing lure content across multiple languages.

The takeaway: You can no longer rely solely on "just look for the red flags." Technical defenses — email filtering, multi-factor authentication, endpoint protection — must now do a lot of the heavy lifting that human vigilance once handled.

Ransomware Has Evolved: Your Files Are Being Stolen Before They're Locked
Here's what most people still picture when they hear "ransomware attack": files get encrypted, a message pops up demanding payment, and you restore from backup. Problem solved, right?

That playbook is obsolete.

As businesses got smarter about backups, attackers got smarter about their strategy. Today's ransomware operates in two stages, and the first stage is the one most people don't know about:

Stage 1 - Silent Exfiltration: Before a single file is encrypted, ransomware quietly copies everything it can find. Files on your PC, your server, your network shares, cloud-connected drives, all of it is uploaded to the attacker's servers without triggering any obvious alarms. This can go on for days or even weeks before you notice anything is wrong.

Stage 2 - Encryption + Extortion: Only after your data has been stolen does the attacker lock your files and reveal themselves. And now, when they demand payment, they're not just offering you a decryption key, they're threatening to publicly release your stolen data if you don't pay. Client records. Financial documents. Employee information. Private communications. All of it exposed.

This is known as double extortion , and it has made backups alone an insufficient defense. Even if you can restore your systems in hours, the threat of a data leak, and the regulatory, legal, and reputational consequences that come with it, remains very real.

The Verizon 2025 Data Breach Investigations Report (DBIR) confirmed that data exfiltration now accompanies the majority of ransomware incidents, with double extortion tactics becoming the dominant ransomware model across industries.

The takeaway: Backups are still essential, but they are no longer enough on their own. Preventing attackers from getting in — and detecting them early if they do — is now just as critical as recovery planning.

Healthcare Is the #1 Target ... And the Stakes Are Life-and-Death
Every industry faces ransomware risk, but no sector has been hit harder, or faces higher stakes, than healthcare and medical organizations. Hospitals, clinics, specialty practices, and medical billing companies are being targeted at a disproportionate rate, and it's not by accident.

Attackers target healthcare for a few specific reasons. Medical records are among the most valuable data on the black market: a single patient record can be worth many times more than a stolen credit card number because it contains everything needed for identity theft, insurance fraud, and more. Healthcare organizations also tend to run legacy systems that are harder to update and patch. And perhaps most critically, the pressure to restore operations immediately, because patient care literally depends on it, makes healthcare providers more likely to pay ransoms quickly.

The consequences of a ransomware attack in healthcare go far beyond financial loss. When systems go down, staff revert to paper processes, imaging systems go offline, and in some documented cases, patient care has been directly delayed or compromised. This urgency is exactly what attackers exploit.

The HHS Office for Civil Rights (OCR) Breach Portal — which tracks all reported healthcare data breaches — has shown a dramatic year-over-year increase in large-scale breaches affecting hundreds of thousands of patients, with hacking and ransomware consistently listed as the leading cause.

The takeaway: If you work in or support medical organizations, cybersecurity is not an IT issue, it's a patient safety issue. The regulatory consequences under HIPAA alone can be severe, and the reputational damage from a public data breach in healthcare can be permanent.

Under-Investing in Security Can Destroy a Business. Fast.
Many business owners view cybersecurity as an expense that's easy to defer. Firewalls, endpoint detection, employee training, cyber insurance, it all adds up. And when nothing bad has happened yet, it's tempting to push it down the priority list.

That calculation changes completely after an attack.

The cost of responding to a ransomware incident — forensic investigation, legal counsel, regulatory notifications, system recovery, potential ransom payment, and lost business — routinely runs into hundreds of thousands of dollars, even for small businesses. For companies without cyber insurance, those costs come entirely out of pocket. For companies without a tested incident response plan, the downtime alone can be fatal to the business.

Cyber insurance has become an essential part of the modern security strategy, but insurers are also raising the bar. Policies now commonly require demonstrated security controls: multi-factor authentication, endpoint protection, regular backups, employee training, before coverage is granted or claims are honored. Businesses that haven't invested in foundational security may find themselves uninsurable or denied coverage when they need it most.

The Sophos State of Ransomware 2025 Report found that the average total cost of recovering from a ransomware attack reached $1.53 million (a figure that doesn't include ransom payments themselves) and that organizations with mature security controls recovered significantly faster and at dramatically lower cost than those without.

The takeaway: Cybersecurity investment isn't just about preventing an attack. It's about ensuring your business can survive one.

How Cutting Edge Computers Can Help

At Cutting Edge Computers, we work with businesses every day who are navigating exactly these threats. We see firsthand how quickly things can escalate when the right protections aren't in place. We're not here to scare you. We're here to help you build a security posture that's practical, affordable, and actually effective.

Whether you need a security assessment to understand where your vulnerabilities are, help implementing multi-factor authentication and endpoint protection, guidance on cyber insurance requirements, or a recovery plan you can count on… we've got you covered.

Don't wait for an incident to find out where you stand. Reach out to Cutting Edge Computers today and let's talk about what the right security strategy looks like for your business.

Sources:

Microsoft Digital Defense Report 2025 — Microsoft Corporation

Verizon 2025 Data Breach Investigations Report (DBIR) — Verizon Business

HHS Office for Civil Rights (OCR) Breach Portal — U.S. Department of Health & Human Services

State of Ransomware 2025 — Sophos