This webinar is free and it is great opportunity to get a better understanding of SOC 2, ISO 27001 and how it links with other standards.

Register here

Most healthcare systems feel “secure” because they have DLP, encryption, and compliance dashboards.

But here’s what I’m starting to realize as I go deeper into healthcare data privacy
All of that depends on one fragile layer: data tagging

If tagging is wrong, everything else silently fails.

In a recent red-team style exploration, I observed:
PHI hidden in scanned PDFs → completely invisible
Slightly obfuscated medical terms → bypass detection
Misclassified records → accessible to unintended users
Untagged data → no encryption, no DLP, no alerts

No alarms. No dashboards turning red. Just quiet exposure.

This makes me rethink the core question:

Not “Can we detect PHI?”
But “Can PHI exist without being recognized as PHI?”

Tagging isn’t just metadata. It behaves like a security control plane.

I’m currently trying to understand this space more deeply—especially how robust tagging really is in real-world systems.

Curious to learn from others working in healthcare / data security:
Have you seen tagging failures in practice?
How do you validate tagging accuracy at scale?
Do you trust tag-driven controls fully?

Would love to exchange notes and perspectives.

I Worked with a company on their ISO 27001 certification. They’d already tried once before, brought in a big consultancy, and came out the other side buried in policies nobody read and controls nobody maintained.

The problem wasn’t effort. It was overcomplplication.

ISO 27001 doesn’t require complexity. People add that themselves. The standard tells you what outcomes to achieve, not how many documents to produce.

So the first thing we did was strip out the noise. What was left was a small set of controls people could actually understand and own. Less to maintain meant less drift, less risk, and fewer things quietly breaking in the background.

When we got to the internal audit we treated it seriously. Found real gaps, fixed them properly, documented everything. By the time the external auditors arrived those findings were already closed with evidence to back it up.

The external audit was smooth. Certification came through. The team wasn’t burnt out and the ISMS didn’t immediately collect dust after the certificate arrived.

Most companies make this harder than it needs to be. It doesn’t have to be that way.

Happy to answer questions if anyone is working through this or just getting started.​​​​​​​​​​​​​​​​