Security for Healthcare Organizations
Healthcare is the most targeted, most breached, and most expensive industry for cybersecurity incidents.
Continue your mission
Healthcare is the most targeted, most breached, and most expensive industry for cybersecurity incidents.
# Security for Healthcare Organizations
Healthcare is the most targeted, most breached, and most expensive industry for cybersecurity incidents. The IBM Cost of a Data Breach Report has ranked healthcare as the highest-cost industry for 14 consecutive years, with an average breach cost of $9.77 million in 2024, nearly double the cross-industry average. Healthcare data is uniquely valuable on the black market: a health record containing diagnosis history, insurance information, Social Security numbers, and payment data sells for $250 to $1,000 per record (compared to $1 to $10 for a credit card number) because health data enables medical identity fraud, insurance fraud, and prescription fraud in addition to standard financial fraud.
The threat landscape is escalating. Ransomware groups specifically target healthcare because disruption creates urgency that increases the probability of payment: a hospital that cannot access patient records, operate medical devices, or process prescriptions faces patient safety consequences that make paying the ransom a faster path to operational recovery than rebuilding from backup. The Change Healthcare attack (2024) disrupted healthcare payment processing nationally, affecting over 100 million individuals and costing UnitedHealth Group over $1 billion. The attack exploited a remote access portal without multi-factor authentication.
Healthcare cybersecurity is uniquely challenging because it operates at the intersection of patient safety, regulatory complexity, legacy technology, and organizational complexity. A cybersecurity decision in healthcare is not just a security decision. It is a patient safety decision.
Ransomware. The dominant threat. Healthcare ransomware incidents increased 264% between 2018 and 2023 (HHS HC3). Ransomware groups that target healthcare include LockBit, BlackCat/ALPHV, Royal/BlackSuit, Rhysida, and their affiliates. These groups target hospitals, health systems, health plans, and healthcare technology companies.
The operational impact is severe. Hospitals operating under ransomware divert ambulances, cancel surgeries, revert to paper-based processes, and experience degraded patient care. Studies published in JAMA and Health Affairs have documented increased patient mortality at hospitals during and after ransomware events: patients who would have received timely care in a functioning digital environment experience delays that, in some cases, prove fatal.
State-sponsored espionage. Chinese state actors (APT41, APT10) target pharmaceutical companies, biotechnology firms, and research hospitals to steal drug development data, clinical trial results, and treatment protocols. The theft of COVID-19 vaccine research by Chinese and Russian actors during the pandemic demonstrated the strategic value of healthcare intellectual property.
Insider threats. Healthcare has the highest rate of insider-caused breaches of any industry (Verizon DBIR). Unauthorized access to patient records by curious employees ("snooping" on celebrity patients, relatives, or neighbors), intentional data theft by departing employees, and accidental PHI exposure through misdirected emails or faxes account for a significant portion of healthcare breaches.
Medical device vulnerabilities. Connected medical devices (infusion pumps, patient monitors, imaging systems, pacemakers, insulin pumps) run embedded operating systems with known vulnerabilities, limited patching capability, and network connectivity that creates attack surface. The FDA has strengthened premarket cybersecurity requirements (2023 guidance), but millions of legacy devices with no security update path remain in clinical use.
HIPAA compliance. The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI). The Security Rule is not prescriptive (it specifies required outcomes, not specific technologies), which gives healthcare organizations flexibility but also creates ambiguity that many interpret as permissiveness. The proposed HIPAA Security Rule update (2024 NPRM) would mandate specific controls: encryption of ePHI at rest and in transit (required, not addressable), MFA for all ePHI access, vulnerability scanning, penetration testing, and defined patch management timelines.
Clinical workflow integration. Security controls must not impede clinical workflow. A nurse who needs to access the EHR in an emergency cannot wait for a 60-second MFA timeout. A surgeon who needs imaging results during a procedure cannot navigate a complex authentication process. Security controls in healthcare must balance protection with usability in clinical contexts where seconds matter.
Approaches include: proximity-based authentication (tap-to-login badges that authenticate the user when their badge is near the workstation), fast user switching (the workstation switches to the current user's session when they badge in, without a full logout/login cycle), and risk-based authentication (MFA is enforced for remote access and administrative functions but streamlined for clinical workstation access within the facility).
Legacy technology. Healthcare organizations run technology that other industries retired years ago. EHR systems with 20-year deployment histories. Medical devices running Windows XP Embedded. Radiology PACS servers that cannot be upgraded without replacing the imaging hardware. Clinical applications with vendor-mandated configurations that conflict with security hardening. Legacy technology creates a persistent vulnerability surface that cannot be addressed through patching.
Defense for legacy systems: network segmentation (isolate legacy systems from the modern network), compensating controls (IPS rules that block exploitation of known legacy vulnerabilities), enhanced monitoring (log and alert on all traffic to and from legacy systems), and planned lifecycle replacement (budget for replacing legacy systems as they reach end-of-support, rather than extending support indefinitely).
Complex organizational environments. Health systems operate hospitals, clinics, physician practices, home health agencies, research facilities, and administrative offices, each with different technology environments, different user populations, and different security maturity. A health system CISO may be responsible for 50,000 endpoints across 200 locations with 30,000 clinical users, each accessing dozens of clinical applications through shared workstations that rotate users throughout the day.
DPS: Data Protection and Sovereignty. PHI protection is the core DPS mission in healthcare. Classification: all ePHI is Restricted by default. Encryption: ePHI must be encrypted at rest and in transit (the HIPAA encryption safe harbor exempts encrypted PHI from breach notification if the key was not compromised). DLP: monitor for PHI leaving the organization through email, cloud storage, USB, and printing. Backup: healthcare organizations are primary ransomware targets; immutable backups tested through Disaster Recovery Testing are not optional.
VSD: Vulnerability and Surface Defense. Medical device attack surface management: inventory every connected medical device, assess its vulnerability status, and segment it from the clinical and administrative network. Application security for EHR systems and patient portals. Patch management that accounts for clinical workflow constraints (patching during maintenance windows that do not affect patient care).
SPH: Security Posture and Hygiene. Endpoint hardening for clinical workstations (which present unique challenges: shared use, proximity authentication, clinical application compatibility). Security awareness training with healthcare-specific content (PHI handling, clinical social engineering scenarios, HIPAA requirements). Medical device configuration management. Physical security for clinical areas where devices containing PHI are accessible to patients and visitors.
IAT: Identity Access and Trust. MFA for all ePHI access (the proposed HIPAA update would mandate this). Identity governance for clinical users who frequently change roles, departments, and locations. Privileged access management for EHR administrators (who have access to every patient record). Vendor remote access management (medical device vendors require remote access for maintenance, which must be controlled, monitored, and time-limited).
TID: Threat Intelligence and Defense. Healthcare-specific threat intelligence through H-ISAC membership. Detection rules tuned to healthcare-targeting ransomware groups. Monitoring for insider access anomalies (a nurse accessing records for patients not in their unit). Incident response plans that address clinical continuity (how the hospital operates during and after a cyber event without degrading patient care).
RGA: Risk Governance and Assurance. HIPAA compliance program. Risk analysis (the foundational HIPAA requirement, and the most common enforcement finding when absent). Business Associate Agreement management (every vendor that handles PHI must have a BAA). Breach notification procedures (HIPAA: 60 days for individual notification, immediate for 500+ individual breaches to HHS and media). Cyber insurance with healthcare-specific coverage.
Healthcare cybersecurity is patient safety. A ransomware event that disables the EHR forces clinicians to prescribe, administer, and document medications on paper, increasing the risk of medication errors. An imaging system outage delays diagnosis. A medical device compromise can directly endanger the patient (a compromised infusion pump could theoretically deliver an incorrect dose, though documented clinical attacks remain rare).
CISA's Healthcare Cybersecurity Performance Goals recognize this relationship: they are explicitly designed to "protect patient safety" alongside protecting data and operations.
HHS OCR has imposed penalties exceeding $140 million in aggregate for HIPAA violations. Recent enforcement trends: larger penalties, more frequent enforcement, and specific citations for failure to conduct risk analysis, failure to implement MFA, and failure to address known vulnerabilities. The proposed Security Rule update signals that enforcement will become more prescriptive and more aggressive.
State attorneys general have concurrent HIPAA enforcement authority and have pursued their own actions. Class action lawsuits following healthcare breaches routinely cite HIPAA violations as evidence of negligence. The legal exposure from a healthcare breach includes federal enforcement, state enforcement, class action litigation, and individual patient lawsuits.
Healthcare will remain the most targeted industry because the combination of valuable data, operational urgency (patient care cannot stop), legacy technology (attack surface), and organizational complexity (many locations, many users, many systems) creates the ideal target profile for ransomware operators. The threat level is not cyclical. It is structural. Healthcare organizations that do not invest in cybersecurity are accepting a risk that increases every year.
CDA's Healthcare FRM (Foundational Recon Mission) variant adds healthcare-specific assessment components to the standard six-domain FRM:
ePHI inventory: where does ePHI reside across the organization's systems, cloud platforms, and vendors? Medical device inventory: what connected medical devices exist, what are their network connections, and what is their vulnerability status? HIPAA compliance assessment: when was the last risk analysis? Is it comprehensive and current? Are BAAs in place for every business associate? Breach notification readiness: does the organization have a tested process for HIPAA breach notification (60-day individual notification, immediate HHS notification for 500+ records)?
CDA's recommended first actions for healthcare organizations without a formal security program:
CDA's engagement model for healthcare: the Confidential tier ($5,000/month) covers 1 to 3 PDM domains and is appropriate for physician practices, clinics, and small healthcare organizations. The Secret tier ($15,000/month) covers 3 to 5 domains and is appropriate for community hospitals and mid-size health systems. The Top Secret tier ($45,000/month) covers all six domains and is appropriate for large health systems with complex environments and high regulatory exposure.
Word count: 2,068
CDA Theater missions that address topics covered in this article.
Written by Evan Morgan
Found an issue? Help improve this article.