Latest / Tech Talks With Kinsoft / GO2 Health – A Veterans' Clinic, One Mailbox, and the Twelve Weeks Nobody Was Told

Transcript

GO2 Health – A Veterans' Clinic, One Mailbox, and the Twelve Weeks Nobody Was Told · Tech Talks With Kinsoft

0:00
I want you to imagine a scenario, right? You
0:02
are running a business and suddenly you are hit
0:05
with a crisis. Yeah, the worst nightmare. Exactly.
0:09
But, you know, you don't panic. You pull out
0:12
the emergency response manual and you do everything
0:15
entirely by the book. Yeah. You contain the threat,
0:17
you call in the external experts, and you notify
0:20
the government regulators right on schedule.
0:22
Right. You check every single box of the gold
0:25
standard for crisis management. Yeah. And you
0:28
feel a sense of relief. You think you've successfully
0:30
navigated the storm. But then a few months later,
0:33
you wake up, pour your coffee and see your business
0:35
plastered across the national news cycle. Like
0:38
you are being held up as a cautionary tale of
0:41
a massive failure in duty of care. I mean, it
0:44
is the ultimate nightmare scenario for any organization
0:47
because it really forces us to ask whether the
0:50
quote unquote book we are all supposed to follow
0:52
is actually just broken. And that. is exactly
0:56
what we are diving into today. Our sources for
0:58
this deep dive are a really fascinating stack
1:01
of documents. We are looking at technical cybersecurity
1:04
teardowns, an investigative news report from
1:07
the ABC featuring a pseudonymous victim, and
1:10
some academic analyses from researchers at Murdoch
1:13
University, RMIT, and UNSW. Yeah, and all of
1:17
this material centers around one specific cyber
1:19
incident at a place called GO2 Health. Right,
1:22
which is a medical and veteran care clinic based
1:24
in Everton Park up on the north side of Brisbane.
1:26
Yeah. They operate a prominent program called
1:28
Reforge, and they serve a massive community.
1:31
I mean, over 14 ,000 patients, including more
1:34
than 7 ,000 veterans. Which, you know, tells
1:37
us right away that we are dealing with an organization
1:39
handling incredibly sensitive, highly regulated
1:42
data every single day. Okay, let's unpack this.
1:45
Because the mission for our deep dives today
1:46
is to really look past the surface of a data
1:48
breach. This is not a Hollywood hacker story.
1:51
No, definitely not. We are not analyzing some
1:53
shadowy syndicate deploying sophisticated ransomware,
1:57
encrypting servers or, you know, demanding millions
1:59
in cryptocurrency. The inciting incident here
2:03
is almost aggressively uninteresting. Yeah, it
2:06
really is. It is just a boring tech issue. Yeah.
2:08
Literally one person clicking one phishing email.
2:11
But that single click exposes some glaring structural
2:14
vulnerabilities in how almost every business,
2:18
like your doctor, your accountant, the company
2:20
you work for, handles data. Right, because the
2:23
technical breach itself is mundane. But the 12
2:26
weeks that followed the discovery of that breach,
2:28
that is where the actual disaster unfolds and
2:31
where the most valuable lessons are hidden. So
2:33
we need to start by looking at the actual mechanics
2:35
of the hack because understanding how unremarkable
2:37
it was is kind of the baseline for everything
2:39
that goes wrong later. In April of 2026, somebody
2:43
at this clinic received a phishing email and
2:45
they clicked a link. And that is the extent of
2:47
the infiltration. Just that. Just that. An unauthorized
2:50
party gained access to just one single internal
2:52
mailbox. And. We should probably be specific
2:56
about what kind of mailbox this was, right? It
2:58
wasn't like the CEO's private account. No, it
3:00
wasn't the CEO's. It wasn't the chief medical
3:02
officer's correspondence either. It was the general
3:05
inbox. You know, the one that usually starts
3:07
with admin at or info at or reception at the
3:10
mailbox where patients, referral agencies and
3:13
other clinics send their day to day general correspondence.
3:17
Wait, let me break this down, because when I
3:20
think of a medical clinic being hacked. my brain
3:23
immediately pictures patient charts being downloaded
3:26
from a secure server. Yeah, that's what most
3:28
people think. But the sources are really clear
3:30
that the clinic's primary practice management
3:32
software was completely untouched. The clinical
3:36
record system where the actual medical history
3:38
is kept was never breached at all. That is correct.
3:41
In the cybersecurity industry, we classify this
3:43
specific event as a standard business email compromise,
3:46
or a BEC. Okay, a BEC. Right. And it is important
3:51
to understand how a BEC functions mechanically.
3:54
Because this was almost certainly not a targeted,
3:56
sophisticated campaign specifically aimed at
3:59
stealing veteran data from G02 Health. So it's
4:02
more like a random attack. Yeah, it operates
4:04
more like a spray and pray tactic. The attacker
4:07
sends out thousands of fake emails, maybe disguised
4:10
as a Microsoft 365 login alert or a fake invoice.
4:14
Oh, I get this all the time. We all do. And one
4:16
employee clicks the link, gets taken to a fake
4:19
login page and types in their credentials. The
4:22
attacker harvests those. credentials, logs into
4:24
the actual webmail and simply sits in that inbox.
4:27
They just sit there. Yeah. Often setting up forwarding
4:30
rules to just monitor the traffic and see what
4:32
rolls in. Man, it's like spending a fortune on
4:34
a high tech laser guarded vault for all your
4:37
most precious valuables. You make sure the combination
4:39
is perfectly secure. The steel is impenetrable.
4:42
Right. But then you leave a cardboard box. completely
4:45
full of your sensitive bank statements and old
4:48
tax returns just sitting on the front porch.
4:50
The vault did its job flawlessly, but you still
4:53
handed over your identity to a passing thief.
4:55
That analogy perfectly illustrates the vulnerability
4:58
here. You secure the primary asset, but you completely
5:01
ignore the periphery. Yeah. Though we do need
5:04
to recognize that GO2 Health's immediate response
5:06
to this front porch theft was actually remarkably
5:08
swift. True. The timeline on day one is pretty
5:11
solid. They discovered the unauthorized access
5:14
on April 24th, and they contained it on that
5:17
exact same day. Yep, same day. They immediately
5:20
brought in external cybersecurity experts to
5:23
investigate, and they even sent a preliminary
5:25
alert to anyone who had received a secondary
5:27
malicious phishing email originating from that
5:30
compromised account. Right, so on day one, their
5:32
incident response is basically flawless. But
5:35
this raises an obvious contradiction for me.
5:37
If that highly secured clinical database inside
5:40
the vault wasn't touched, why did so much sensitive
5:43
patient data actually get compromised? Like,
5:46
how did that much information end up in the cardboard
5:48
box on the porch in the first place? Well, this
5:50
brings us to the first major conceptual shift
5:53
from our sources. We really have to change our
5:55
definition of what a database is, because an
5:58
inbox is a database. Wow, I never thought of
6:00
it that way. Yeah, it is just one you never intentionally
6:02
designed, and therefore one you never properly
6:04
manage. I see where this is going. We treat general
6:07
inboxes like the digital equivalent of that one
6:10
junk drawer everybody has in their kitchen. Exactly.
6:13
You throw old takeout menus, spare batteries,
6:16
and maybe your passport in there just because
6:18
you don't know where else to put them, assuming
6:19
you'll sort it out later. But, like, nobody ever
6:22
actually sorts the junk drawer. Never. And in
6:25
a busy medical practice, that digital junk drawer
6:27
accumulates an astonishing... amount of sensitive
6:30
material over a decade. Because people are just
6:32
emailing stuff in. Right. Patients email in with
6:35
completed intake forms attached as PDFs. Government
6:39
agencies send through claim details. Specialists
6:42
forward referral files. Yeah. And none of this
6:45
information is classified. It isn't tagged with
6:47
security controls. It simply piles up in the
6:50
admin at inbox. And for GO2 Health, because a
6:53
massive portion of their patient base consists
6:56
of veterans. Department of Veterans Affairs or
6:59
DVA identification numbers are just flowing constantly
7:02
through that general inbox. Constantly. There
7:06
is a really striking detail in the ABC News report
7:08
that just brings this to life. The journalist
7:11
spoke to an affected veteran, a patient who had
7:14
been receiving psychological treatment at the
7:16
clinic. Right. And she was speaking pseudonymously
7:20
to protect her identity. Yes. But she stated
7:23
explicitly that she had sent, and this is a direct.
7:26
quote, extremely personal and extremely sensitive
7:30
information about her care directly to that general
7:33
email address. Her assumption was entirely logical,
7:35
though. I mean, when you are interacting with
7:37
a health care provider, you naturally assume
7:40
that any communication channel they provide is
7:42
protected by the same standard of medical confidentiality
7:45
as the doctor's physical office itself. Right.
7:47
Of course you would. But the reality of email
7:49
infrastructure is that it treats a highly sensitive
7:51
psychological update the exact same way it treats
7:54
a newsletter subscription. That's terrifying.
7:57
But the breach didn't actually expose a full
7:59
decade's worth of this sensitive data, did it?
8:02
I remember the sources showing the damage was
8:04
capped. Yes. And what's fascinating here is how
8:07
that happened. We find this incredible piece
8:09
of accidental security, the single best mitigation
8:13
factor in this entire incident. was almost certainly
8:16
never intended to be a security control at all.
8:19
Wait, really? What was it? Because the general
8:21
mailbox had an auto -archive feature turned on,
8:24
the attacker only had access to the previous
8:27
12 months of emails. Oh, wow. Yeah, anything
8:29
older than a year had been automatically swept
8:31
into an inaccessible archive. We call this limiting
8:34
the blast radius. Hold on, I have to push back
8:36
a little on labeling that a security control.
8:38
Let's be real. Nobody in a small business turns
8:41
on auto archive to thwart international cyber
8:44
criminals. Fair point. You turn on auto archives
8:46
because your email provider starts flashing these
8:48
red warnings that your storage quota is at 99
8:51
% and you can't receive any more messages. That
8:54
isn't a deliberate cybersecurity strategy. It's
8:56
just boring digital housekeeping. It is entirely
8:59
housekeeping. But if we look at the mechanics
9:00
of risk, mail retention limits are arguably the
9:03
cheapest, lowest effort and highest leverage
9:05
security changes any organization can make. Is
9:09
deleting old email. Exactly. If your shared mailboxes
9:12
have unlimited retention, you have actively chosen
9:15
unlimited exposure. By simply allowing an automated
9:18
rule to archive or delete anything older than
9:21
12 months, you instantly reduce your risk footprint
9:23
by orders of magnitude without spending a dime
9:26
on complex security software. Okay, so let's
9:29
summarize the timeline so far. The blast radius
9:32
was limited to 12 months because of a housekeeping
9:34
rule. They caught the breach on the same day
9:37
it happened. They contained it immediately and
9:39
they brought in the experts. Right. From a technical
9:42
standpoint, this sounds like a massive victory.
9:45
So how on earth does this snowball into a national
9:48
scandal on the ABC? Well, the transition from
9:51
a technical win to a reputational disaster comes
9:54
down to the timeline of notification. And this
9:56
timeline exposes a massive structural friction
9:59
between legal compliance and human care. OK,
10:02
how so? To understand this, we have to look at
10:04
the regulatory framework. In Australia, this
10:07
is governed by the Notifiable Data Breaches Scheme
10:09
under the Privacy Act. What does that scheme
10:12
actually demand of a business when they get hacked?
10:15
Like, what are the rules? When an organization
10:17
discovers a breach, the clock starts ticking.
10:20
They are legally granted up to 30 days to conduct
10:23
an assessment. 30 days. Got it. The goal of that
10:25
assessment is to determine if the breach is likely
10:28
to result in serious harm to any individuals.
10:30
If they conclude that serious harm is likely,
10:33
they must notify the Office of the Australian
10:35
Information Commissioner, the OAIC, and the affected
10:39
individuals. Here's where it gets really interesting.
10:42
Let's look at GO2 health states. They discovered
10:45
the breach on April 24th. The sources show they
10:48
officially notified the OAIC and the Australian
10:51
Cyber Security Center on May 18th. Which is 24
10:53
days later. Right. So strictly legally speaking,
10:57
they met their statutory obligation with time
10:59
to spare. They played completely by the book.
11:02
They fulfilled the regulatory requirement for
11:04
notifying the government, yes. But here's the
11:06
critical failure point. They told the government
11:08
on May 18th. When do you think they told the
11:09
patients? You mean the actual veterans whose
11:12
sensitive psychological data and DVA numbers
11:15
were sitting in that compromised inbox? Yes.
11:18
When did they find out? The sources say July
11:22
16th. That is 12 weeks. Yep. Nearly three full
11:26
months after they discovered an unauthorized
11:28
person in their system. And they only told the
11:31
patients a matter of days before the ABC broke
11:34
the story nationally on July 21st. The optics
11:37
on that are, well, terrible. Seriously. Yeah.
11:40
If I'm looking at that timeline, my immediate
11:43
deduction is that they were trying to cover their
11:44
tracks. You know, sweeping it under the rug and
11:48
hoping nobody would notice until the journalists
11:49
started asking questions. It is the most natural
11:52
conclusion to jump to. But to understand the
11:54
true complexity of incident response, we really
11:57
have to examine the clinic's defense because
11:59
it highlights a genuine operational dilemma.
12:02
Okay, what was their argument? Their argument
12:03
was that forensic investigations of this nature
12:05
are painstakingly slow. They were trying to identify
12:08
precisely which individuals were affected. But
12:10
why does it take three months to figure out whose
12:12
emails were in an inbox? Can they just, like,
12:15
run a search? Let's think about the mechanics
12:17
of e -discovery on an unstructured inbox. It
12:20
is not like querying a neat, organized spreadsheet
12:23
where you can just filter by column. Oh, right.
12:26
It's just a pile of random emails. Exactly. You
12:28
have to run keyword searches. You have to open
12:30
attachments manually. If you find a DVA number
12:33
in an email, you have to read the context to
12:35
verify if that number belongs to the sender or
12:39
perhaps their spouse or a dependent. Oh, wow.
12:41
Yeah. Then you have to match that number back
12:44
to a current patient record to find... a valid
12:46
contact address. It is entirely manual, contextual
12:49
verification, and it takes an agonizing amount
12:52
of time. I see the mechanical difficulty there.
12:55
But for three months, the victims are completely
12:58
flying blind. That is the core tension. The clinic
13:01
argued that they wanted to avoid causing undue
13:03
panic. Undue panic. Yeah, if you notify too early.
13:07
Before the audit is finished, you might needlessly
13:09
terrify thousands of veterans who actually had
13:12
no data exposed. Or you might give people inaccurate
13:16
information about what specific data of theirs
13:18
was stolen, which causes a different kind of
13:20
panic. Regulators generally prefer accuracy to
13:23
prevent a wave of false alarms. I understand
13:26
the desire for accuracy. Yeah. But put yourself
13:29
in that veteran's shoes. For three months, you
13:31
are using your credit card, you are logging into
13:33
your government porters, completely unaware that
13:36
a cyber criminal might possess the exact documentation
13:39
needed to open a line of credit in your name
13:41
or intercept your medical benefits. It's a scary
13:44
thought. The veteran patient argued exactly this
13:46
to the ABC. By choosing to wait for perfect accuracy,
13:50
the clinic actively robbed the patients of the
13:52
time they needed to defend themselves. It is
13:54
a devastating critique, and it points to a flaw
13:56
in how organizations interpret these rules. The
13:59
statutory 30 days is often treated as the timeline
14:01
for all communication. Right. But there is a
14:04
practical solution to this dilemma that balances
14:06
the need for regulatory accuracy with the moral
14:08
duty of care. There has to be a middle ground.
14:11
I mean, if... The law encourages you to take
14:13
weeks to be accurate, but the victim needs to
14:16
know on day one to protect their bank account.
14:18
Why not just send a preliminary heads up immediately?
14:21
What would that look like? A message that essentially
14:23
says, hey, we have detected a breach. We're still
14:27
auditing to find out exactly what happened, but
14:29
be on high alert and then follow up later with
14:32
the specific details. You have just outlined
14:34
exactly what the cybersecurity industry calls
14:36
a two stage notification strategy. Oh, so it's
14:40
a real thing. It is, and it solves the friction
14:42
entirely. Stage one is early, broad, and prioritizes
14:46
vigilance over precision. You inform your community
14:49
that an incident occurred and tell them what
14:51
generic phishing attempts or scams to watch out
14:54
for. Giving them the heads up. Then stage two
14:57
arrives weeks later after the painstaking e -discovery
15:00
is complete. Providing highly precise details
15:03
to the specific individuals affected, you get
15:05
the benefit of early warning without the liability
15:07
of long -term inaccuracy. And most importantly,
15:10
you don't end up on the national news as the
15:12
clinic that hid a data breach for three months.
15:16
Exactly. But let's say it is finally July 16th.
15:19
You get the delayed notification email. You would
15:21
think the waiting was the hard part. Unfortunately,
15:24
no. Right, because receiving that notification
15:27
just kicks off a completely different and arguably
15:30
worse... nightmare regarding what data was actually
15:33
inside that inbox. This transitions us to a massive
15:36
liability for businesses that hold third -party
15:38
data. The compromised information didn't just
15:41
belong to the clinic. No. The sources detailed
15:45
that the exposed data included Medicare numbers,
15:48
concession cards, and DVA numbers. Which are
15:50
government identifiers. Exactly. You cannot just
15:53
click a link and reset a DVA number the way you
15:55
reset a Netflix password. Imagine if I borrowed
15:58
your wallet. And then I lost it on the subway.
16:01
I can apologize profusely, but I can't call your
16:03
bank and cancel your credit cards for you. Right.
16:06
You have to do all that heavy lifting yourself.
16:08
And when you ask me for the phone number for
16:10
your bank, I just shrug and say, I don't know.
16:12
That analogy perfectly captures the frustration
16:14
of the victims here. A deeply telling detail
16:17
emerged in the ABC report. The affected patient
16:21
actually reached out to GO2 Health after receiving
16:23
the notification. Oh, really? What did she ask?
16:26
She explicitly asked them, do I need to replace
16:28
my DVA card? And what did they say? She received
16:31
no reply. Wow. No reply at all, which, again,
16:34
I really doubt was licious on the part of the
16:37
clinic. They were probably drowning in thousands
16:40
of panicked emails from other veterans. It wasn't
16:43
malice, no. It was a profound lack of peacetime
16:47
preparation. Nobody at the clinic knew the answer
16:49
to her question because nobody had ever needed
16:51
to find out the mechanism for replacing a compromised
16:54
DVA card en masse. But if your psychologist's
16:57
office just informed you that your most sensitive
16:59
data is in the hands of criminals, and then they
17:02
completely ignore your basic question about how
17:04
to fix it, that lack of preparation feels an
17:06
awful lot like abandonment. Which is exactly
17:08
why the operational solution has to happen long
17:11
before a breach ever occurs. If your business
17:14
requires you to hold government identifiers,
17:17
you must document the remediation pathways in
17:20
peacetime. What does that entail? It takes a
17:22
single afternoon on a random Tuesday to call
17:25
Medicare. or the Department of Veterans Affairs
17:27
or the passport office and just ask if our clients
17:31
cars are compromised in a cyber incident, what
17:33
is the exact step by step process for them to
17:36
replace it? Right. What specific phone number
17:38
do they call? Is there a replacement fee? Because
17:40
doing that kind of bureaucratic research on day
17:43
three of a cyber crisis, while the media is calling,
17:46
the lawyers are drafting statements, and patients
17:48
are demanding answers, is structurally impossible.
17:51
Exactly. But if you already have that remediation
17:54
document drafted and sitting on your server,
17:56
you simply attach it to your notification letter.
17:58
Oh, that makes so much sense. Suddenly, the communication
18:01
shifts from a panic -inducing, we lost your data,
18:04
good luck, to a reassuring, we experienced an
18:07
incident. Here is the exact verified action plan
18:11
you need to follow to protect yourself. It changes
18:13
the entire relationship with the victim. We are
18:16
dissecting the failures of this clinic pretty
18:19
intensely. But I want to zoom out and look at
18:21
the broader context of the sources because this
18:24
brings us to a structural reality of the modern
18:26
economy. Right. Why was all of this so incredibly
18:29
difficult for GO2 Health to navigate? I mean,
18:32
they aren't a massive tech conglomerate with
18:34
a dedicated floor of cybersecurity analysts monitoring
18:37
threats around the clock. No, they're a relatively
18:39
small operation. And the academic sources from
18:42
Murdoch University, RMIT, and UNSW highlight
18:45
that this incident is a symptom of a much larger
18:47
structural mismatch. A structural mismatch. Yes.
18:50
Across the economy, small businesses are holding
18:52
massive amounts of highly sensitive data, but
18:55
their internal capabilities do not match the
18:57
risk profile of that data. Let's think about
18:59
the mechanics of a small clinic's IT infrastructure
19:02
for a second. They likely don't have a chief
19:05
information security officer. Very unlikely.
19:07
They probably just contract a local external
19:10
IT provider whose primary job is making sure
19:13
the Wi -Fi works, the printers connect, and the
19:16
Office 365 licenses are paid. Yet they hold data
19:19
that is just as sensitive as a major hospital
19:22
network. The academics argue that smaller operators,
19:25
whether they are allied health professionals,
19:27
local law firms, or suburban accounting practices,
19:30
simply lack the capacity to defend against modern
19:33
cyber threats. And the statistics from the OAIC
19:36
bear this out aggressively. Let's look at those
19:39
numbers, actually. The OAIC's own figures from
19:41
last year show there were 1 ,205 notified data
19:44
breaches. Wow. And of those, 715 were the result
19:48
of malicious or criminal activity. And the sector
19:50
most heavily affected, health service providers,
19:53
accounting for 19 % of all notifications. 19%.
19:56
And as the OAIC spokesperson pointed out in the
19:59
sources, health data is categorized as one of
20:02
the most sensitive types of information under
20:04
the Privacy Act. The damage potential is astronomically
20:07
higher than a simple credit card leak. So what
20:10
does this all mean for you, the listener? Even
20:12
if you don't run a medical clinic or a law firm,
20:15
This structural mismatch directly impacts your
20:19
life. Absolutely. Think about the local tax accountant
20:21
who has your entire financial history on their
20:23
server. Think about the migration agent who requested
20:26
high resolution scans of your passport and birth
20:29
certificate. Think about the small disability
20:31
provider coordinating your care. Right. You are
20:34
constantly handing your most sensitive, hard
20:36
to replace data to small operators. And their
20:39
biggest vulnerability isn't some complex firewall
20:41
configuration that requires a hacker to crack
20:44
a mainframe. It's the fact that their front reception
20:46
email inbox is an unmanaged database. If we connect
20:50
this to the bigger picture, the overarching takeaway
20:53
from these sources is that in our current digital
20:55
landscape, cybersecurity is no longer just an
20:57
IT question about software. It is a fundamental
21:00
duty of care question. That's a great way to
21:03
put it. If a business takes on the responsibility
21:05
of holding someone's sensitive data, they take
21:08
on the non -negotiable duty to protect it, even
21:11
if they are only a three -person operation. Let's
21:13
pull all of this together and look at the major
21:15
actionable takeaways from the deep dive. First.
21:18
Audit your shared mailboxes. That admin address
21:21
is a database. You have to treat it like one.
21:24
Yep. Essential. Second, implement retention limits.
21:27
AutoArchive isn't just to save space. It is your
21:29
best tool for limiting the blast radius of a
21:32
breach. Third, if the worst does happen, you
21:35
need a two -stage communication strategy so you
21:37
aren't leaving your clients flying blind for
21:39
three months. Exactly. Fourth, figure out the
21:42
ID replacement pathways for your specific industry
21:45
before an incident occurs. And finally, treat
21:48
that 30 -day regulatory notification clock as
21:51
the absolute floor of your obligations to the
21:53
government, not the ceiling of your obligations
21:55
to your clients. If an organization implements
21:58
those five steps, a boring technical failure
22:01
like a clicked phishing link remains a boring
22:03
technical failure rather than escalating into
22:06
a national scandal. I know I am certainly going
22:09
to think twice the next time I casually attach
22:11
a sensitive PDF to an email bound for a general
22:14
admin address. I now know that document might
22:17
just sit in their digital junk drawer waiting
22:19
for a spray and pray phishing attack for the
22:21
next 10 years. It absolutely will sit there.
22:24
And if we connect all these threads, it leaves
22:26
us with a provocative question to mull over.
22:29
We've established that standard email infrastructure
22:32
is inherently an unmanaged database. And we've
22:35
seen how... government compliance regulations
22:38
like the 30 -day rule can unintentionally incentivize
22:42
businesses to remain silent while they conduct
22:44
painstaking e -discovery. Right, prioritizing
22:47
perfect accuracy for the regulator over immediate
22:49
warning for the victim. Exactly. It creates a
22:52
scenario where you can do everything by the book,
22:53
follow the regulatory timeline perfectly, and
22:56
the patients still suffer the most damage. Which
22:58
is a terrible outcome. Which raises the ultimate
23:00
question, are we regulating the wrong part of
23:04
the incident timeline? Should the law perhaps
23:06
focus less on the exact deadline for when the
23:10
government receives a perfectly accurate forensic
23:12
report and focus much more heavily on mandating
23:15
when the victim gets the necessary immediate
23:17
heads up to actually defend themselves? It really
23:19
makes you wonder. If you follow the fire drill
23:22
perfectly, but you don't tell the people inside
23:24
the building that there's smoke until you know
23:27
exactly which room the fire started in, did the
23:29
manual really work? Thanks for joining us on
23:32
this deep dive. We'll catch you next time.