June 5, 2026 • 4 mins
In this episode, Alex and Jen discuss new Paubox product updates including a Forms template library and API dashboard improvements, then analyze recent healthcare data breaches affecting Esse Health, Gandara Mental Health Center, and NYC Health + Hospitals. The conversation highlights common security gaps, the growing risk of third-party vendor breaches, and practical steps organizations can take to strengthen their compliance and security posture.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:00):
You're listening to Pow Box Weekly Fully Automated.
SPEAKER_01 (00:03):
And I'm Jen.
I spend my days thinking aboutall the ways healthcare data can
go sideways.
SPEAKER_00 (00:08):
I'm Alex.
I'm the one trying to keep itfrom going sideways in the first
place.
Alright, we've got a packedweek.
Let's start with some good newsfor a change.
SPEAKER_01 (00:18):
Wait, good news?
In healthcare cybersecurity?
I'm suspicious already.
SPEAKER_00 (00:23):
Powbox Forms now has a template library.
13 pre-built templates acrossfive categories: intake,
consent, clinical, patientexperience, operations.
SPEAKER_01 (00:35):
So instead of staring at a blank page
wondering how to make a HIPAAcompliant form, you just pick
one, tweak the fields, andpublish.
SPEAKER_00 (00:42):
Minutes, not hours.
SPEAKER_01 (00:44):
That's actually useful.
I've seen people spend way toolong reinventing the wheel on
intake forms.
SPEAKER_00 (00:50):
And speaking of making things easier, the email
API dashboard now lets you buildand manage dynamic templates
right in the UI.
No code, no file uploads.
That was a customer request,right?
Yep.
People wanted to managetemplates without going through
the API every time.
Now anyone with dashboard accesscan do it.
(01:12):
Small quality of life wins,those add up.
There's also a new embeddingfeature for Powbox forms.
Two API endpoints let you pullthe form structure, render it in
your own site with your ownstyling, and post submissions
back.
SPEAKER_01 (01:27):
So the form lives inside your website.
Your branding, your experience,PowBox handling the compliance
layer.
SPEAKER_00 (01:34):
Exactly.
Customers wanted thatintegration.
Now they have it.
SPEAKER_01 (01:38):
Okay, that's the good news.
Now, the other stuff.
SPEAKER_00 (01:42):
Yeah.
SE Health in Missouri,$2.5million settlement.
Cyberattack detected in Aprilaffected 521,000 patients.
And eight class action lawsuits.
Eight.
They're also funding two yearsof identity protection services,
including a million dollarmedical identity theft policy.
SPEAKER_01 (02:04):
Which sounds generous until you remember,
that's the cost of not catchingit earlier.
The breach is the expensivepart.
Everything after is damagecontrol.
SPEAKER_00 (02:13):
And it's not just ESI.
Gandhera Mental Health Center inMassachusetts settled for
$900,000.
They had 450 gigabytes of dataexfiltrated.
SPEAKER_01 (02:24):
450 gigs?
That's that's not a smash andgrab.
That's someone living in yournetwork.
SPEAKER_00 (02:31):
And Gandera is one of at least six behavioral
health providers to settlebreach lawsuits in the first
half of 2026.
SPEAKER_01 (02:38):
Mental health data is some of the most sensitive
information out there.
The exposure risk isn't justfinancial, it's deeply personal.
SPEAKER_00 (02:46):
Then there's NYC Health and Hospitals.
Attackers were inside for nearlythree months.
And here's the part that keepsme up at night.
Biometric data was exposed.
SPEAKER_01 (03:01):
Biometrics.
You can change a password.
You can freeze a credit card.
You cannot change yourfingerprints.
SPEAKER_00 (03:07):
This is their second security incident connected to
them this year.
SPEAKER_01 (03:11):
The largest public health system in the country.
SPEAKER_00 (03:17):
It's a reminder.
Your security posture includeseveryone you share data with.
SPEAKER_01 (03:22):
Vendor risk management isn't optional.
It's the perimeter now.
So looking at all of thistogether, what's the thread?
It's not bad luck.
It's configuration gaps, blindspots, vendors without
oversight, systems that weren'tmonitored closely enough.
SPEAKER_00 (03:39):
And most of it, fixable.
SPEAKER_01 (03:41):
That's the frustrating part.
These aren't exotic zero days.
They're the basics.
Access controls, monitoring,vendor contracts with teeth.
SPEAKER_00 (03:50):
Templates and dashboards won't stop a breach,
but they reduce friction on thecompliance side, which frees up
time for the security side.
SPEAKER_01 (03:59):
Every hour you're not rebuilding a form from
scratch is an hour you could bereviewing access logs.
SPEAKER_00 (04:05):
Or actually reading that vendor security
questionnaire.
Novel concept.
Alright, that's our week.
Stay patched, stay skeptical,and we'll see you next time.
Take care of yourselves outthere.
You're listening to Pow Box Weekly Fully Automated.
SPEAKER_01 (00:03):
And I'm Jen.
I spend my days thinking aboutall the ways healthcare data can
go sideways.
SPEAKER_00 (00:08):
I'm Alex.
I'm the one trying to keep itfrom going sideways in the first
place.
Alright, we've got a packedweek.
Let's start with some good newsfor a change.
SPEAKER_01 (00:18):
Wait, good news?
In healthcare cybersecurity?
I'm suspicious already.
SPEAKER_00 (00:23):
Powbox Forms now has a template library.
13 pre-built templates acrossfive categories: intake,
consent, clinical, patientexperience, operations.
SPEAKER_01 (00:35):
So instead of staring at a blank page
wondering how to make a HIPAAcompliant form, you just pick
one, tweak the fields, andpublish.
SPEAKER_00 (00:42):
Minutes, not hours.
SPEAKER_01 (00:44):
That's actually useful.
I've seen people spend way toolong reinventing the wheel on
intake forms.
SPEAKER_00 (00:50):
And speaking of making things easier, the email
API dashboard now lets you buildand manage dynamic templates
right in the UI.
No code, no file uploads.
That was a customer request,right?
Yep.
People wanted to managetemplates without going through
the API every time.
Now anyone with dashboard accesscan do it.
(01:12):
Small quality of life wins,those add up.
There's also a new embeddingfeature for Powbox forms.
Two API endpoints let you pullthe form structure, render it in
your own site with your ownstyling, and post submissions
back.
SPEAKER_01 (01:27):
So the form lives inside your website.
Your branding, your experience,PowBox handling the compliance
layer.
SPEAKER_00 (01:34):
Exactly.
Customers wanted thatintegration.
Now they have it.
SPEAKER_01 (01:38):
Okay, that's the good news.
Now, the other stuff.
SPEAKER_00 (01:42):
Yeah.
SE Health in Missouri,$2.5million settlement.
Cyberattack detected in Aprilaffected 521,000 patients.
And eight class action lawsuits.
Eight.
They're also funding two yearsof identity protection services,
including a million dollarmedical identity theft policy.
SPEAKER_01 (02:04):
Which sounds generous until you remember,
that's the cost of not catchingit earlier.
The breach is the expensivepart.
Everything after is damagecontrol.
SPEAKER_00 (02:13):
And it's not just ESI.
Gandhera Mental Health Center inMassachusetts settled for
$900,000.
They had 450 gigabytes of dataexfiltrated.
SPEAKER_01 (02:24):
450 gigs?
That's that's not a smash andgrab.
That's someone living in yournetwork.
SPEAKER_00 (02:31):
And Gandera is one of at least six behavioral
health providers to settlebreach lawsuits in the first
half of 2026.
SPEAKER_01 (02:38):
Mental health data is some of the most sensitive
information out there.
The exposure risk isn't justfinancial, it's deeply personal.
SPEAKER_00 (02:46):
Then there's NYC Health and Hospitals.
Attackers were inside for nearlythree months.
And here's the part that keepsme up at night.
Biometric data was exposed.
SPEAKER_01 (03:01):
Biometrics.
You can change a password.
You can freeze a credit card.
You cannot change yourfingerprints.
SPEAKER_00 (03:07):
This is their second security incident connected to
them this year.
SPEAKER_01 (03:11):
The largest public health system in the country.
SPEAKER_00 (03:17):
It's a reminder.
Your security posture includeseveryone you share data with.
SPEAKER_01 (03:22):
Vendor risk management isn't optional.
It's the perimeter now.
So looking at all of thistogether, what's the thread?
It's not bad luck.
It's configuration gaps, blindspots, vendors without
oversight, systems that weren'tmonitored closely enough.
SPEAKER_00 (03:39):
And most of it, fixable.
SPEAKER_01 (03:41):
That's the frustrating part.
These aren't exotic zero days.
They're the basics.
Access controls, monitoring,vendor contracts with teeth.
SPEAKER_00 (03:50):
Templates and dashboards won't stop a breach,
but they reduce friction on thecompliance side, which frees up
time for the security side.
SPEAKER_01 (03:59):
Every hour you're not rebuilding a form from
scratch is an hour you could bereviewing access logs.
SPEAKER_00 (04:05):
Or actually reading that vendor security
questionnaire.
Novel concept.
Alright, that's our week.
Stay patched, stay skeptical,and we'll see you next time.
Take care of yourselves outthere.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.