Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · birmingham

Birmingham's bank towers and its medical district share one headache. Too many people can see too much.

Birmingham is where a regional bank with about $158.8 billion in assets keeps its head office, and where a university health system employs more people than any other single employer in the state. Banks and hospitals pile up access rights faster than anyone removes them, and regulators want proof of who can reach what.

Talk to an engineer
work in birmingham7 services
4 local rules covered below
in short·20-second read

For Birmingham, our work splits between financial services and health care.

Banks, insurers and their service providers ask us for access reviews, privileged access controls and the logging that a 36-hour regulator notice depends on. Health systems and health plans ask for clinical identity lifecycle, research data controls and claims data pipelines. Cohash has no Birmingham office. We deliver remotely from Frisco, Texas and fly in for workshops and launches.

Cohash is headquartered in Frisco, Texas and keeps no office in Alabama. Birmingham teams work with us remotely, and we fly in for role-mining sessions, design workshops and cutover weekends.

Ask an engineer facts checked 2026-10-21 · 10 sources
rules
Alabama Data Breach Notification Act of 2018, Ala. Code §8-38-5Alabama Personal Data Protection ActFederal bank computer-security incident notification ruleHIPAA Security Rule
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
birmingham by the numbers

What's specific about Birmingham

Each figure comes from a public source, linked on the card.

01 $158.8 billion

Regions Financial Corporation is headquartered in Birmingham and reported total consolidated assets of approximately $158.8 billion at December 31, 2025, according to its Form 10-K for fiscal 2025.

source ↗ 02 28,000

UAB says no single employer in Alabama is bigger. It counts more than 28,000 full-time and part-time workers and puts its yearly economic impact on the state at $12.1 billion in its FY2022 study.

source ↗ 03 2.8 million

Blue Cross and Blue Shield of Alabama keeps its corporate headquarters in Birmingham. It reports more than 2.8 million members and over 3,300 employees.

source ↗ 04 42,100

In the Birmingham metro, BLS counts 42,100 financial activities jobs and 80,900 education and health services jobs out of 571,600 nonfarm jobs for September 2026 (preliminary).

source ↗ 05 $11 million

StoneX Group is expanding in Birmingham with about 90 jobs and roughly $11 million in investment, moving its office to the Protective Center corporate campus, Area Development reported on 28 May 2026.

source ↗
who and what

Who we work with in Birmingham, and the rules they work under

industries

  1. Regional banking and securities operations

    A bank of this size carries decades of mergers in its directory, so tellers, loan officers and operations staff often hold rights from three reorganizations ago. We set up role models in an identity governance platform, run certification campaigns that managers can finish in an afternoon, and vault the admin accounts behind core banking, wires and treasury systems.

  2. Health insurance and claims

    A statewide health plan moves member, provider and claims data between its core admin platform, pharmacy managers, brokers and employer groups. We build those feeds as governed pipelines with lineage, and we put each partner connection on its own scoped credential so one leaked key cannot read the whole member file.

  3. Academic medicine and research

    At a teaching hospital a single person can be a physician, a faculty member and a principal investigator at once. Their access should change when any of those roles changes. We tie provisioning to credentialing and grant records as well as HR, and keep research datasets behind access that expires with the protocol.

  4. Life insurance and annuities

    Insurers headquartered here run policy admin systems that predate modern sign-in. We put agents, policyholders and back-office staff on separate identity stores, add MFA in front of the legacy screens, and map which batch jobs still run on shared service accounts.

regulations

  1. Alabama Data Breach Notification Act of 2018, Ala. Code §8-38-5 ↗

    Covered entities must tell affected Alabama residents within 45 days of determining that a breach occurred and is reasonably likely to cause substantial harm. Section 8-38-3 also requires reasonable security measures, including keeping management and the board informed.

  2. Alabama Personal Data Protection Act (HB 351, 2026) ↗

    Signed in April 2026 and effective 1 May 2027. It reaches businesses processing data on more than 25,000 Alabama consumers, but exempts GLBA financial institutions, HIPAA covered entities and universities at the entity level, so many Birmingham banks and hospitals fall outside it. Fintechs and retailers may not.

  3. Federal bank computer-security incident notification rule ↗

    Banking organizations supervised by the OCC, Federal Reserve or FDIC must notify their primary federal regulator within 36 hours of determining that a notification incident occurred. Bank service providers must alert customers about disruptions of four hours or more.

  4. HIPAA Security Rule ↗

    Applies to the area's hospitals, physician groups and health plans as covered entities, and to their vendors as business associates. Unique user IDs, access controls and audit logs on systems holding ePHI are the parts identity work touches directly.

services

Most requested in Birmingham

The services clients in Birmingham ask us for most.

you are hereBirmingham
01Our bank's access reviews take months and managers rubber-stamp them. Can that change?

Usually yes. Most of the delay comes from asking managers to judge raw entitlement names. We translate entitlements into business roles first, pre-approve the low-risk ones and send reviewers only the exceptions, which cuts the volume and gives examiners a cleaner record.

02Does the new Alabama privacy law apply to us?

It depends on what you are. HB 351 exempts financial institutions under GLBA, HIPAA covered entities and higher education institutions at the entity level, and it starts 1 May 2027. A fintech, retailer or marketing firm in Birmingham with data on more than 25,000 Alabama consumers may well be covered. Ask counsel to confirm your status.

03How does the 45-day Alabama breach deadline interact with HIPAA?

The Alabama act has provisions for entities already notifying under federal rules, but the Attorney General notice still applies when more than 1,000 Alabama residents are involved. Our part is making sure your logs can tell counsel quickly which records an attacker reached, because both clocks depend on that answer.

04Can you work with Epic or our claims platform?

We integrate identity governance and SSO with clinical and payer platforms through their supported interfaces, and we build the data pipelines around them. We do not resell those platforms, and configuration inside the clinical record stays with your certified analysts.

alabama

More cities in Alabama

All 82 cities
HuntsvilleDefense, missiles & space
sources 10 sources linked last checked 2026-10-21 content fingerprint 4aa20fa8
  1. 01Regions Financial Corporation Form 10-K for fiscal 2025 (SEC)sec.gov ↗
  2. 02UAB economic impactuab.edu ↗
  3. 03Blue Cross and Blue Shield of Alabama, About Usbcbsal.org ↗
  4. 04BLS, Birmingham economy at a glancebls.gov ↗
  5. 05Area Development, StoneX Group in Birmingham (May 2026)areadevelopment.com ↗
  6. 06Ala. Code §8-38-5 (Justia)law.justia.com ↗
  7. 07Alabama Data Breach Notification Act text (ACUA copy)acua.alabama.gov ↗
  8. 08Mayer Brown, Alabama enacts comprehensive consumer data privacy law (April 2026)mayerbrown.com ↗
  9. 09Federal Register, bank computer-security incident notification rulefederalregister.gov ↗
  10. 10HHS, HIPAA Security Rulehhs.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it