When the hospital and the health plan share an owner, the access model has to keep them apart.

The court said an employer that collects sensitive employee data and stores it online owes a duty of reasonable care, and that purely financial losses can be recovered in negligence. So treat HR and payroll like any other high-value system, with MFA for admins, short-lived integration credentials and logged exports. Your counsel can tell you what the ruling means for your exposure.

Usually not. One directory can work if roles, groups and approvers are split by business line and the data platform enforces the same split. We look at who crosses the line today and why, then decide whether a separate tenant is worth the cost.

For workforce SSO, maybe. For machine identity, no, because signing keys and fleet certificates are hard to rotate once robots are in the field. A short engagement that puts those in a vault and documents rotation is far cheaper before your first large deployment than after.

For private companies the act says without unreasonable delay, with no day count for residents. The newer rules add Attorney General notice above 500 residents and credit monitoring for certain data. If you also hold data on Ohio or West Virginia residents, their own notice rules apply too, so plan with counsel.