Erik Kangas: Publications & Writing
LuxSci - Secure Healthcare Communications
Erik founded LuxSci in 1999 and led the company as CEO for 24 years before shifting focus to product and technology as Founder and Chief Technology Officer. Along the way he wrote hundreds of blog posts and spoke at numerous webinars, podcasts, and industry events; below is a small selection of that writing, grouped by topic.
›Artificial Intelligence
Click to expand
Click to collapse
The Future of Protected Health Information in the Age of AI
HIPAA's definition of protected health information hasn't changed since 1996, but AI is making it far easier to convert ordinary, unregulated data into something that functions as health information -- and regulators are extending HIPAA's reach to match. Argues for treating PHI as both valuable and sensitive at once, rather than picking one framing over the other.
›HIPAA & Regulatory Compliance
Click to expand
Click to collapse
Online Tracking Technologies & HIPAA Data Collection
Explains how tracking pixels and cookies on healthcare websites can constitute PHI under HHS's 2022 guidance, citing the study that found 99% of hospitals used trackers and the 2023 FTC/OCR enforcement action against 130 hospital systems, and lays out BAA and data-minimization steps for healthcare marketers.
What is HITRUST Certification and Why Does It Matter?
Explains HITRUST CSF as a third-party certification framework, established in 2007, that folds HIPAA, ISO/IEC 27000, NIST 800-53, and PCI-DSS into one assessment across 19 control areas, arguing that its external verification and biennial reassessment cycle is what makes it more meaningful than a vendor's self-attested compliance claim.
The HIPAA Safe Harbor Bill Has Passed the Senate
Reports on the HIPAA Safe Harbor bill (H.R. 7898) requiring HHS to credit recognized security frameworks like HITRUST when calculating breach fines and audit scope, and notes LuxSci's own HITRUST CSF certification.
GDPR & Email: 10 Critical Questions & Answers for Compliance
A Q&A with a HIPAA/compliance consultant published just ahead of GDPR's enforcement date, working through how the 'right to be forgotten,' consent, and archival retention apply to email marketing -- and where GDPR and HIPAA's retention requirements directly conflict.
The HIPAA Breach Notification Rule: What it Really Means to Providers and Insurers
Walks through the HITECH-era Breach Notification Rule's mechanics for covered entities and business associates -- the 60-day notification clock, the 500-record threshold for HHS/media reporting, the encryption safe harbor, and why not every unauthorized access counts as a reportable breach -- with penalties running up to $1.5 million per violation.
Opt-In Email Encryption Is Too Risky for HIPAA Compliance
Argues that opt-in email encryption is incompatible with the HIPAA Omnibus Rule's stricter breach-reporting threshold, and that organizations should default to encrypting everything and requiring an explicit opt-out instead.
How the HIPAA Omnibus Rule Affects Email, Web, FAX, and Skype
Breaks down the 2013 HIPAA Omnibus Rule's business-associate liability chain and lowered breach-reporting threshold channel by channel, including the advice that Microsoft would not sign a BAA for Skype -- years ahead of Teams/Skype facing the same HIPAA scrutiny.
›Security & Risk
Click to expand
Click to collapse
What End-to-End Email Encryption Really Means
A clear-eyed explainer distinguishing true end-to-end encryption from TLS and portal-based 'secure pickup' email, arguing that full end-to-end encryption is neither required for HIPAA compliance nor usually desirable once its costs to backup, archival, and content filtering are considered.
Will Email Ever Be Truly Secure?
A synthesizing essay arguing that absolute security is impossible, illustrated with contemporaneous breaks in the security stack -- the Efail flaw in PGP/S/MIME, Spectre/Meltdown CPU flaws, a Secure Boot bypass, and SHA-1 collisions -- concluding that the practical goal is 'secure enough,' not perfect.
SIM-Swapping: Why SMS Authentication Is a Bad Idea
Explains the SIM-swapping attack mechanics with real cases (the $24M Michael Terpin theft, the $5M Joel Ortiz ring) to argue that SMS-based two-factor authentication should be replaced with authenticator apps or hardware tokens -- well ahead of SIM-swapping becoming mainstream security news.
Cyber Espionage Infiltrates American Small Business
Argues that small businesses, not just large healthcare and retail targets, faced a rising and under-covered cyber-espionage threat -- citing that a fifth of 2016 breaches involved espionage and most hit companies under 1,000 employees -- and critiques HIPAA's flexible, weakly-enforced standard as a structural vulnerability; foreshadows the supply-chain/vendor-targeting wave that became a major theme by 2019-2022.
Why Should You Bother with Information Security? Isn't Everything Hackable Anyway?
An extended home-security analogy making the risk-based case for investing in security controls even though no system is unbreakable -- 'everything is hackable, but not everyone can hack everything.'
How Secure are Password-Protected Files?
Walks through password protection in Office, Adobe Acrobat, and WinZip to make the durable point that cipher strength (e.g. AES) is wasted if the password itself is weak, since modern computers can check millions of candidate passwords against an encrypted file in short order.
›Email Authentication & Transport Security
Click to expand
Click to collapse
Stronger Email Security with SMTP MTA STS: Strict Transport Security
Details the then-new SMTP MTA-STS draft standard for enforcing TLS between mail servers, backed by LuxSci's own measurement that only 82.3% of domains its customers emailed had even minimally sufficient SMTP TLS support.
ARC and SMTP MTA-STS: The State of Domain-based Email Authentication (Part 3)
Closes a three-part series by explaining the (then still-draft) ARC standard for preserving SPF/DKIM/DMARC results through mailing-list forwarding, and MTA-STS for enforcing TLS between mail servers -- both years ahead of their eventual mainstream adoption.
DMARC: The State of Domain-based Email Authentication (Part 2)
Explains DMARC's alignment mechanics and reporting loop, and flags that healthcare had the lowest DMARC adoption of any industry sector two years running -- years before Google and Yahoo made DMARC a hard requirement in 2024.
SPF and DKIM: The State of Domain-based Email Authentication (Part 1)
Opens a technical series on SPF and DKIM, explaining why both are widely deployed but weakly enforced (soft-fail policies, mailing-list breakage) -- a fragility that anticipated the 2024 Gmail/Yahoo authentication mandates.
Neutralizing and Protecting Against Rogue TLS Certificates in the Wild
Surveys CAA, Certificate Transparency, HPKP, and HSTS as defenses against mis-issued TLS certificates, published right as CAA and CT became mandatory baseline requirements for certificate authorities.
How to Tell Who Supports SMTP TLS for Email Transmission
A hands-on technical guide to independently verifying SMTP TLS support -- querying DNS MX records and using telnet/EHLO to check for STARTTLS on every server in a mail delivery chain -- alongside a clear-eyed list of what opportunistic TLS still does not guarantee.
Bounce Back & Backscatter Spam: Who Stole My Email Address?
Explains how spammers forging your address causes 'backscatter' bounce floods, and gives an honest pros-and-cons comparison of SPF, DKIM, and challenge/response as mitigations -- including their real failure modes, such as DKIM breaking under filter rewriting and challenge/response causing mail loops.
How Does Secure Socket Layer (SSL or TLS) Work?
Explains how SSL/TLS combines public-key cryptography (via certificate authorities) for identity verification with symmetric encryption for the actual data transfer, and why its real-world security depends on key length, cipher strength, and trust in the issuing certificate authority -- a weak implementation or an unvetted certificate provides little real assurance.
Enhanced Security: AES-256 Encryption for SSL and TLS
Explains AES-256's role as the cipher used within an SSL/TLS session once the handshake completes, why it is considered secure enough for classified government data, and how to force email clients and browsers to use only AES-256 rather than weaker alternatives like RC4.
SSL versus TLS: What is the difference?
Clarifies that SSL and TLS are generally equally secure, differing mainly in how the connection begins (SSL secures immediately; TLS starts insecure and upgrades via a handshake), and that TLS's separate benefit is letting a single port serve both secure and insecure connections.
›Foundational & Early Era
Click to expand
Click to collapse
Understanding Domain Name Service (DNS)
A foundational infrastructure explainer covering domain registration, MX record priority, TTL/propagation, and SPF/DKIM DNS TXT records, aimed at demystifying how email and web hosting actually connect a domain name to a server.
The Case for Email Security
A comprehensive primer on how SMTP/POP/IMAP actually move mail, the core email security threats (eavesdropping, identity theft, message modification/replay, unprotected backups, repudiation, and more), and the tradeoffs between TLS, PGP/S/MIME, and portal-based secure pickup. Originally published in 2005 and substantially revised many times since (most recently March 2025), it has served as one of LuxSci's foundational technical references for two decades.
Email and Text Messaging Security in the Wired and Wireless Worlds
An invited international lecture (Helsinki Institute for Information Technology, August 2002) surveying the shared security vulnerabilities of email, instant messaging, and GSM SMS, and proposing extensions to secure SMS across a multi-vendor mobile environment.
Written for an invited lecture delivered August 27, 2002; the blog post preserving it was itself last touched in 2020.
›Computational and Mathematical Biophysics
Articles published in peer-reviewed journals and elsewhere from Erik's PhD research in Bruce Tidor's computational biophysics lab at MIT.
Click to expand
Click to collapse
Optimizing molecular electrostatic interactions: Binding affinity and specificity
Develops a continuum-electrostatics formalism for deriving the charge distribution a designed molecule should carry to bind a target with high affinity and/or specificity, works out analytical solutions for idealized geometries, and applies the approach to the chorismate mutase enzyme family, including the catalytic antibody 1F7, to suggest improved inhibitors.
Electrostatic Complementarity at Ligand Binding Sites: Application to Chorismate Mutase
Applied electrostatic charge-optimization methods to the chorismate mutase active site from Bacillus subtilis, showing that its bound transition-state-analogue inhibitor is already highly complementary to the enzyme's electrostatics, especially at groups that form hydrogen bonds with the protein.
Electrostatic specificity in molecular ligand design
Showed that optimizing a ligand's charge distribution for binding affinity does not automatically confer binding specificity, and developed charge-optimization methods that increase specificity for a target receptor while preserving affinity.
Electrostatic Optimization in Ligand Complementarity and Design
A book chapter reviewing the authors' variational charge-optimization framework for ligand electrostatics, summarizing its theoretical basis and its application to protein-ligand binding problems.
Optimizing electrostatic affinity in ligand-receptor binding: Theory, computation, and ligand properties
Developed a continuum-electrostatics framework for optimizing a ligand's charge distribution to balance the desolvation penalty of binding against favorable intermolecular interactions, showing optimized ligands can achieve favorable electrostatic binding free energies unlike most natural ligands.
Charge optimization leads to favorable electrostatic binding free energy
A theoretical mathematical-physics paper: using variational calculus within continuum electrostatics, proves that the electrostatic free energy of association for an optimally charged molecule has a strict upper bound of zero -- so favorable binding is always achievable in principle, even in polar solvents -- by recasting the problem as a classical electrostatic inverse-source problem and studying the existence and non-uniqueness of its solutions via image-charge theory.
›High Energy Physics
Articles published in peer-reviewed journals and elsewhere from Erik's work as a collaborator on the Fermilab T-864 (MiniMax) high-energy physics experiment.
Click to expand
Click to collapse
A Search for Disoriented Chiral Condensate at the Fermilab Tevatron
Reports the MiniMax experiment's search for disoriented chiral condensate formation in proton-antiproton collisions at 1.8 TeV, finding that measured charged-to-neutral pion ratios are consistent with ordinary particle production rather than the disoriented-chiral-condensate phenomenon.
Analysis of charged-particle–photon correlations in hadronic multiparticle production
Introduces factorial-moment observables from charged-particle and photon correlations that are robust to detector efficiency and modeling assumptions, validated against Monte Carlo simulations of the MiniMax detector, for distinguishing disoriented-chiral-condensate signatures from ordinary pion production.
MiniMax: What has been learned thus far
Describes the MiniMax detector built at the Fermilab Tevatron's C0 interaction region to search for disoriented chiral condensates via the forward charged-to-neutral pion ratio, reporting successful detector operation over roughly 2.5 million events with the DCC analysis still in progress.
T864 (MiniMax): A Search for Disoriented Chiral Condensate at the Fermilab Collider
A MiniMax Collaboration status report on the T-864 search for disoriented chiral condensate at the Fermilab Tevatron, written by J. D. Bjorken on the collaboration's behalf.
Preliminary Results from a Search for Disoriented Chiral Condensates at MiniMax
An early progress report from the MiniMax experiment's search for disoriented chiral condensates at 1.8 TeV, describing the detector's measurement of the forward charged-to-neutral pion ratio and preliminary comparisons to theoretical predictions.
›Liquid Crystal Physics
Peer-reviewed articles from Erik's undergraduate research in Charles Rosenblatt's liquid crystal physics lab at Case Western Reserve University.
Click to expand
Click to collapse
Solitary Waves in an Antiferroelectric Liquid Crystal
Reports the discovery of solitary waves in an antiferroelectric liquid crystal: above a critical applied field, ferroelectric regions were observed to propagate rapidly through the antiferroelectric phase along the smectic layers.
Dynamics of helix deformation in a chiral smectic-C* liquid crystal: Optical experiments and modeling
Measured the optical response of a chiral smectic-C* liquid crystal's helix to weak AC electric fields applied perpendicular to the helical axis, finding a response linear in field strength that fell off roughly as inverse frequency, and modeled the behavior with a time-dependent Landau-Ginzburg theory coupling polarization and dielectric anisotropy to the field.
Reversible propagating fingers in an antiferroelectric liquid crystal
Observed reversible, fingerlike solitary waves propagating in an antiferroelectric liquid crystal above a threshold electric field, with wave velocity scaling with the field above threshold and matching the fastest propagation speeds reported for a liquid crystal, and presented a model with a layer-layer coupling term that reproduces much of the observed behavior.