Healthcare Cybersecurity Is a Patient Safety Problem
Healthcare cybersecurity is a patient safety discipline: when ransomware takes down electronic health records, scheduling or connected devices, care slows, shifts to neighboring hospitals or stops. A JAMA Health Forum study of 374 US ransomware attacks on care providers between 2016 and 2021 found that 44.4% disrupted care delivery (Neprash et al., 2022). Related reading: Patient AI in 2026.
That is why strong healthcare cybersecurity programs rank systems by clinical harm, not by IT habit. This healthcare cybersecurity guide covers the evidence on ransomware and patient safety, where the HIPAA Security Rule update stands in October 2026, and a tiering model you can use this quarter. If you want a partner for the build, our cyber security services team works on programs like this. If you want a partner for this work, see our DevOps services.
What Healthcare Cybersecurity Means for Patient Safety
Healthcare cybersecurity is the set of controls, processes and rehearsed fallbacks that keep clinical systems, patient data and connected devices available and trustworthy while care is being delivered. The goal of healthcare cybersecurity is not a clean audit. The goal is that a nurse can still check an allergy and a physician can still read a lab result when something breaks. Read next: Cybersecurity.
HHS frames it the same way. When it proposed updating the HIPAA Security Rule, Deputy Secretary Andrea Palm described cyberattacks as “a direct and significant threat to patient safety.” That changes the healthcare cybersecurity budget conversation. You stop asking whether a control is compliant and start asking what happens at the bedside if it fails. Related reading: Why Ethical Hackers Are the Unsung Heroes of Cybersecurity.
The classic security triad looks different in healthcare cybersecurity:
- Availability: can clinicians reach the record, orders, imaging and pharmacy systems right now?
- Integrity: can they trust that what they see is correct and unaltered?
- Confidentiality: is protected health information (PHI) kept from people who should not see it?
Most healthcare cybersecurity programs were built around the third item. Care delivery depends on the first two, and ransomware attacks availability directly, which makes it a patient safety problem first and a privacy problem second.
How Healthcare Cybersecurity Failures Reach the Bedside
Healthcare cybersecurity failures reach patients through downtime, diversion and delay, and ransomware is the usual trigger. In the Neprash study of ransomware attacks, 166 of 374 attacks disrupted care. The recorded disruptions included electronic system downtime (41.7%), cancelled scheduled care (10.2%) and ambulance diversion (4.3%). Yearly attacks more than doubled, from 43 in 2016 to 91 in 2021.
Healthcare Cybersecurity Spillover to Neighboring Hospitals
Patients near an attack can pay too. A 2024 cohort study in Critical Care Explorations looked at two untargeted academic hospitals beside a ransomware-hit health system in 2021. Cardiac arrests rose from 21 in the four weeks before the attack to 38 during it, and out-of-hospital arrest survival with a favorable neurologic outcome fell from 40.0% to 4.5% before returning to 41.2% afterward (Pham et al., 2024).
It is a small observational study of one event, so treat it as a warning, not a forecast. The plausible mechanism is simple: ransomware at one system sends diverted ambulances and extra patients to its neighbors, which hurts patient safety well beyond the victim. For healthcare cybersecurity planning, it means your ransomware downtime also becomes your neighbor’s patient safety problem.
Change Healthcare and Third-Party Healthcare Cybersecurity Risk
Change Healthcare is the systemic version. HHS says Change Healthcare told OCR on July 31, 2025 that approximately 192.7 million individuals were affected, and OCR’s director has called it the largest breach in US health care history. HHS describes the attack as being of unprecedented magnitude. Details are in the HHS Change Healthcare FAQ.
The lesson for healthcare cybersecurity is uncomfortable. Your own network can be free of ransomware while a vendor outage stops claims, eligibility checks or pharmacy flow.
The Cost and Detection Gap in Healthcare Cybersecurity
Healthcare cybersecurity incidents are the costliest breaches of any industry in IBM’s data, and they take longer to detect than the global average. IBM’s 2025 Cost of a Data Breach report, run by the Ponemon Institute across 600 organizations between March 2024 and February 2025, put the average healthcare breach at $7.42 million and 279 days to identify and contain.
| Measure (IBM, 2025) | Healthcare | Global average |
| Average breach cost | $7.42 million | $4.44 million |
| Days to identify and contain | 279 | 241 |
| Change from 2024 | Down $2.35 million | First decline in five years |
Two readings matter for healthcare cybersecurity. First, the cost fell from 2024, but healthcare still ranked first. Second, 279 days is 38 days longer than the global average, which leaves a lot of time for an intruder to find your backups, your domain controllers and your vendor connections. For a wider view of why ransomware and other attacks keep rising, see our guide on why cyber attacks are increasing in 2026.
Where the HIPAA Security Rule Update Stands in 2026
As of October 2026, the proposed HIPAA Security Rule update is neither finalized nor withdrawn, so the existing HIPAA Security Rule, unchanged since 2013, still governs healthcare cybersecurity compliance. OCR published the HIPAA Security Rule proposal on January 6, 2025. The federal regulatory agenda (RIN 0945-AA22) now lists final action for July 2027 under long-term actions, after an earlier May 2026 target.
The comment period closed on March 7, 2025 with 4,747 comments. The proposed compliance date is 180 days after the final rule’s effective date. The main proposals for ransomware resilience, per the HHS Security Rule NPRM fact sheet, include:
- No more “addressable” loopholes: nearly all implementation specifications become required.
- Asset inventory and network map: a record of technology assets and ePHI flows, updated at least once a year and after relevant changes.
- MFA and encryption: multi-factor authentication and encryption of ePHI at rest and in transit, with limited exceptions.
- Testing cadence: vulnerability scans at least every six months and penetration tests at least every 12 months.
- Recovery: restoration procedures within 72 hours, plus written, tested incident response plans for ransomware.
- Business associates: annual verification of technical safeguards and notice within 24 hours of activating a contingency plan.
What to Do About Healthcare Cybersecurity While the Rule Is Pending
Treat the proposal as a free healthcare cybersecurity checklist. OCR has already told the market what good looks like, and the HIPAA Security Rule in force today already requires a risk analysis and a contingency plan (45 CFR 164.308(a)(7), per HHS ransomware guidance). Waiting for the final HIPAA Security Rule text only delays work you will do anyway, and ransomware crews do not wait for rulemaking.
Congress is also moving on healthcare cybersecurity. AHA reported on October 5, 2026 that the Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent. It would direct HHS to develop a cybersecurity incident response plan and improve coordination with CISA. House action had not been confirmed in AHA’s report.
A Clinical Impact Tier Model for Healthcare Cybersecurity
A clinical impact tier model for healthcare cybersecurity ranks every system by how fast its loss can harm a patient, then sets recovery and security targets by tier, which keeps patient safety in the driver’s seat. It is Techverx practitioner judgment, not a published standard, and the targets below are design starting points to tune with your clinical leaders.
For each system, ask four patient safety questions. Can care continue safely without it? How many minutes until a patient is at risk? Is there a tested manual fallback? What else depends on it? Then place it in a tier.
| Tier | Typical systems | Time to patient risk | Recovery target (illustrative) | Healthcare cybersecurity emphasis |
| 0 | Infusion pumps, monitors, medication dispensing, read-only patient snapshot | Minutes | Keep running offline; no dependence on recovery | Segmentation, vendor access control, local fallback |
| 1 | EHR, lab, imaging, pharmacy, identity provider, network core | Under 1 hour | Within 24 hours | MFA, immutable backups, restore tests |
| 2 | Scheduling, claims, eligibility, patient portal | Hours to days | Within 72 hours | Vendor continuity, manual workarounds |
| 3 | Marketing, analytics, HR, training | Days or more | Within one week | Standard hygiene and patching |
One rule makes the healthcare cybersecurity model work: a system inherits the tier of the most critical system that depends on it. Identity providers, DNS, network switches and backup consoles are Tier 1 or higher, even though no clinician ever opens them. In our experience, healthcare cybersecurity plans often miss this inheritance, so ransomware recovery stalls on identity, and teams find out mid-incident that the EHR is up but nobody can log in.
Medical Device Security Without Stopping Care
Medical device security, a core part of healthcare cybersecurity, means protecting equipment you often cannot patch on your own schedule: inventory it, segment it, control vendor access, and hold manufacturers to FDA rules for new products. For devices already in service, medical device security depends on compensating controls more than patches, and ransomware that reaches a device network is a patient safety event.
FDA now has statutory hooks for new devices, which helps healthcare cybersecurity at purchase time. Section 524B of the FD&C Act, added by the Consolidated Appropriations Act of 2023, took effect on March 29, 2023, and FDA’s updated final premarket cybersecurity guidance of June 27, 2025 added a section on 524B that supersedes the September 2023 version. FDA also points to a MITRE report on managing legacy device risk. Practical medical device security steps for your fleet:
- Inventory first: you cannot secure devices you cannot list, and the HIPAA Security Rule proposal would require an inventory anyway.
- Segment by function: keep devices off the general clinical and guest networks.
- Control vendor remote access: require MFA, time-limited sessions and logging for every support connection.
- Put medical device security in procurement: ask each vendor how they meet section 524B, how they disclose vulnerabilities and how long patches will be supported.
- Scan carefully: in our experience, active scanning can disrupt fragile devices, so ask the manufacturer first and prefer passive monitoring.
Many unpatchable devices are tied to ageing hosts, and healthcare cybersecurity gaps there invite ransomware. If that is your situation, plan retirement alongside legacy system modernization, because a segmented old system is still an old system.
Downtime Procedures and Backups That Survive Ransomware
Healthcare cybersecurity backups protect you only if they are offline or immutable, restore-tested and sequenced by clinical priority. HHS’s ransomware guidance tells covered entities to back up frequently, test restorations and keep backups offline, because some ransomware variants remove or disrupt online backups.
This matters because the trend runs the wrong way, and because ransomware recovery depends on downtime procedures that clinicians have rehearsed. The Neprash study found that organizations became less likely to restore data from backups over time. Healthcare cybersecurity teams should treat a successful restore of a Tier 1 system as a measured result, not an assumption.
What a Healthcare Cybersecurity Downtime Kit Contains
Good downtime procedures are boring and physical, and they are the last line of patient safety when ransomware wins. A kit that works at 3 a.m. includes:
- A printed or read-only offline snapshot of the census, allergies and active medications, refreshed on a schedule.
- Paper order sets, medication administration forms and labels, stored on every unit.
- A phone tree and a non-network communication method for clinical leadership.
- Downtime procedures for results: how labs and imaging deliver critical values when the interface is down.
- A decision rule for when to go on diversion, owned by a named clinical leader.
The AHA and the Joint Commission offer a free Cyber Resilience Readiness self-assessment covering clinical operations, operational continuity and crisis response, and organizational readiness. Use it to test whether your downtime procedures and healthcare cybersecurity plans exist beyond a binder.
What HIPAA Says When Ransomware Hits
Under HHS guidance on ransomware, ePHI encrypted by an attacker is presumed to be a breach unless you demonstrate a low probability of compromise using a four-factor risk assessment. For breaches affecting 500 or more individuals, notice goes to individuals and HHS without unreasonable delay and no later than 60 calendar days after discovery. Document every step.
A Healthcare Cybersecurity Priority List for This Quarter
You cannot fix everything at once, so sequence healthcare cybersecurity work by clinical risk and patient safety. This healthcare cybersecurity list suits a mid-size US or Canadian health system, and each item produces evidence you can show a board or regulator.
- Refresh the risk analysis: the HIPAA Security Rule requires one, and smaller organizations can use the ONC and OCR Security Risk Assessment Tool (version 3.7), which keeps entered data on your own computer.
- Tier your top 30 systems by patient safety impact: use the four questions and the inheritance rule above.
- Enforce MFA and train for phishing: remote access, email, privileged accounts and every vendor connection first, plus a one-click way for staff to report suspicious messages.
- Prove one restore: recover a Tier 1 system end to end from offline or immutable backup, as you would after ransomware, and record the time.
- List and segment devices: medical device security starts with the unit that cannot go dark, such as the emergency department or ICU.
- Map third parties: for each vendor whose outage would stop you, write the manual workaround.
- Run a ransomware tabletop with clinicians: assume the EHR is unavailable for 72 hours, rehearse your downtime procedures and see what breaks.
- Pre-wire ransomware incident response: contacts, retainers and the notification clocks, so nobody reads the rule during the crisis.
If clinical applications or integrations are the weak point, a partner for healthcare software development can help rebuild them with security and fallback modes designed in, not bolted on.
Common Healthcare Cybersecurity Mistakes
In our experience, these healthcare cybersecurity mistakes do the most damage:
- Treating compliance as the finish line: a HIPAA Security Rule audit says little about whether the ED can run for three days offline.
- Flat networks: one ransomware-infected workstation should not reach infusion pumps, and flat networks undermine medical device security.
- Backups on the same domain: if ransomware operators own the directory, they own the backups.
- Ignoring vendor concentration: one clearinghouse or EHR host can become a single point of failure.
- Security decisions without clinicians: controls that slow a code response hurt patient safety and get bypassed.
- Buying tools before inventory: you cannot monitor assets you have not counted.
- Training that ends at an annual video: staff who never practice reporting a suspicious email or working on paper will struggle when it counts.
- Untested plans: downtime procedures nobody has rehearsed are a hope, not a procedure, and patient safety depends on them.
When not to rush: do not scan or patch clinical devices on a Friday night without vendor guidance. Availability is the thing healthcare cybersecurity protects, and a patient safety incident caused by your own scan is still a patient safety incident.
The Bottom Line on Healthcare Cybersecurity
Healthcare cybersecurity succeeds when a hospital can keep treating patients while something is broken, which is the definition of patient safety under ransomware. Rank systems by clinical harm, prove your restores, rehearse downtime procedures, strengthen medical device security and map your vendors. The HIPAA Security Rule update may land in 2027, but the healthcare cybersecurity work it describes is worth starting now.
