Rev. Bolívar Flores Urges Hospitals to Act Immediately on a Critical Gap in Patient Data Protection

NEW JERSEY — The Rev. Bolívar Flores is calling on hospitals, health systems and other healthcare organizations to immediately evaluate and implement technology capable of protecting electronic protected health information, or ePHI, from the moment it is entered into a computer or mobile device.

His recommendation comes amid increasing scrutiny of cybersecurity vulnerabilities across the American healthcare system and the longstanding requirements of the HIPAA Security Rule.

Federal standards require covered entities and business associates to safeguard the confidentiality, integrity and availability of ePHI that they create, receive, maintain or transmit. The regulatory framework is technology-neutral, meaning that it establishes the security obligation rather than prescribing one particular commercial product.

Janosek Keystroke Encryption Healthcare 2026.pdf

“The question for hospital leadership is no longer whether cybersecurity deserves investment,” Flores said. “The question is whether we are protecting patient information throughout its entire lifecycle — including the first moment that information is created.”

That distinction is significant.

Traditional cybersecurity architectures have historically concentrated heavily on information at rest and in transit. But sensitive information can temporarily exist in readable form as clinicians and employees type patient information, usernames, passwords and authentication codes. According to the cybersecurity analysis provided by Dr. Diane M. Janosek, malicious keylogging software can exploit precisely this point of entry and potentially circumvent conventional encryption controls.

Janosek Keystroke Encryption Healthcare 2026.pdf

Flores is therefore recommending that healthcare executives evaluate the immediate deployment of EndpointLock, a patented keystroke-encryption technology designed to encrypt information beginning at keyboard entry.

The technology uses what its developer describes as Keystroke Transport Layer Security, or KTLS, encrypting keystrokes before network transmission and routing them through an AES-256-bit encrypted pathway.

Product-Overview-EndpointLock.pdf

The broader policy argument is straightforward: protecting information at creation does not establish a new federal obligation; rather, according to Janosek’s analysis, it provides a technological means of addressing an existing lifecycle-based obligation under 45 C.F.R. §164.306(a)(1).

Janosek Keystroke Encryption Healthcare 2026.pdf

“This should be treated as a governance issue, not merely an IT issue,” Flores said. “Hospital presidents, chief executives, compliance officers and boards have a fiduciary and institutional responsibility to understand where sensitive patient information remains vulnerable. When technology exists that can materially strengthen protection at the point of creation, leadership should evaluate and implement appropriate safeguards without unnecessary delay.”

EndpointLock has also been added to GovSmart’s GSA Schedule, according to materials supplied by the companies, providing a federal procurement channel for agencies and prime contractors.

GovSmart and Advanced Cybersecurity Corp.pdf

Flores said his recommendation extends beyond hospitals to behavioral-health organizations, laboratories, physician practices, long-term-care organizations and other entities handling protected electronic health information.

“The protection of patient information is ultimately a matter of public trust,” Flores said. “Compliance establishes the floor. Responsible leadership should determine how we build above it.”

For Flores, the emerging cybersecurity principle is concise:

Protect healthcare data not only after it has been stored or transmitted, but from the first keystroke.