Every industry says its data is sensitive. Healthcare is the one where a federal regulation says so in statutory text, names the safeguards, sets a deadline for telling people when it goes wrong, and publishes the name of every organization that lost 500 records or more. That combination of a legal floor and a public list is what makes defending a hospital, a physician group or a billing company a different problem from defending a law firm, and it is why the honest answer to "what should we buy" starts with the rule rather than with a product.
Why Cyber Security for Healthcare Is Different
Three things separate this sector, and every sensible spending decision follows from them.
The first is that the data carries a named legal standard. Most companies decide for themselves what "reasonable security" means. A covered entity does not: 45 CFR Part 164 tells it what to do, and the Office for Civil Rights at HHS reads that text back to it after an incident.
The second is that the systems treat patients. An outage in a retailer is lost revenue. An outage in a hospital is a scheduling system that cannot confirm an appointment, a lab interface that cannot return a result and, at the sharp end, ambulances going somewhere else. Availability is written into the rule for that reason, alongside confidentiality.
The third is money, and it is the one the sector's own trade body raises loudest. The American Hospital Association told the Senate HELP Committee in July 2025 that the number of individuals affected by health care data breaches rose from 27 million in 2020 to 259 million in 2024, and that 590 million Americans have been affected since 2020, in a sector where 48 percent of rural hospitals were operating at a financial loss in 2023. The threat grew on a curve. The budget did not.
CISA classifies healthcare and public health as critical infrastructure that is heavily digitized and works with HHS and the Health Sector Coordinating Council to publish voluntary performance goals for it. Voluntary is the operative word, and it is the fault line the whole sector is currently arguing over.
What HIPAA Requires of Healthcare Providers
The Security Rule is short, and almost nobody who cites it has read it. It is worth twenty minutes, because it is written as a set of obligations rather than a product list, and that structure is what gives a provider room to spend sensibly.
Under the general rules sit three families of standards, each with implementation specifications marked either Required or Addressable.
Two details in that structure decide most of a provider's spending.
The first is that risk analysis is the very first Required implementation specification, at 164.308(a)(1)(ii)(A): an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI. Not a questionnaire, not a vendor scan, an assessment of your systems. Every enforcement story in this sector eventually comes back to an organization that never did one, or did one in 2019 and filed it.
The second is genuinely surprising to most people who work under this rule. Encryption is not required. At 45 CFR 164.312 both encryption specifications, encryption and decryption at (a)(2)(iv) and transmission encryption at (e)(2)(ii), are marked Addressable. So are automatic logoff and integrity controls.
There is also no HIPAA certificate. No federal body certifies a provider as compliant, no registry exists, and any vendor selling a "HIPAA certification" is selling their own opinion. What exists is your documented risk analysis, your implemented safeguards, and your ability to show both when OCR asks. Encrypting records at rest and in transit is the single control that does the most work in this sector, for a reason the notification section below makes clear.
What Patient Data Is Worth to an Attacker
A stolen payment card is cancelled within hours and reissued within days. A patient record cannot be reissued. It carries a name, a date of birth, an address, a phone number, an insurance member number, often a Social Security number, and clinical detail that is accurate for life.
That mix is why healthcare records support fraud that runs for years rather than weeks: insurance claims filed in someone else's name, prescription fraud, and highly credible phishing that quotes a real appointment or a real plan number back at the recipient. It is also why the data classes listed in a healthcare breach notice are worth reading closely. The two largest healthcare incidents on our own breach desk this year, at a dental benefits administrator and a cancer diagnostics company, both exposed names, dates of birth, contact details, insurance information and health data together, which is the full set.
The Cyber Attacks That Actually Hit Healthcare Providers
Vendor pages tend to list every threat that exists. The regulator publishes what actually happened, and the shape is narrower than the lists suggest.
In the January 2025 proposed update to the Security Rule, HHS set out its own breach portal numbers: between 2018 and 2023 the number of reported breaches of unsecured PHI grew 100 percent while the number of individuals affected grew 950 percent, with hacking up 260 percent and ransomware up 264 percent over the same period. In 2022, approximately three-fourths of breaches affecting 500 or more individuals were the result of hacking of electronic equipment or a network server. In 2023, more than 160 million individuals were affected by large breaches, a record at the time.
Three-fourths from hacking a server is the sentence to take away. Lost laptops and misdirected faxes still happen and still get reported, but they are no longer where the volume is.
The AHA adds the second half of the picture: most PHI breaches reported to OCR came from hacking incidents targeting non-hospital providers, including third-party service and software providers. The hospital is frequently not the organization that was broken into. It is the organization that has to notify.
The chain itself is consistent enough to draw.
- Entry through a trusted routeA business associate's system, a stolen contractor login, or a phone call to a help desk
- Quiet movement toward the recordsDays or weeks inside before anything is taken
- Bulk copy of patient dataNames, dates of birth, insurance and clinical detail together
- Extortion demandIncreasingly without encrypting anything, so backups do not help
- Publication when payment does not comeLeak site listing, then the full data set
- Discovery starts the notification clockSixty calendar days from the date the provider discovers it
- OCR opens an investigationAutomatic for any breach affecting 500 or more individuals
Ransomware remains the label everyone uses, but the sector's recent large incidents increasingly skip the encryption stage entirely and go straight to data theft and extortion, which is why offline backups protect operations without protecting the notification obligation. Invoice fraud through business email compromise sits alongside it, aimed at accounts payable rather than at clinical systems.
How a Healthcare Data Breach Gets Reported
The notification rules are the part of HIPAA that most changes behavior during an incident, and the part most often discovered too late.
Start with what counts. Under 45 CFR 164.402, an impermissible acquisition, access, use or disclosure of PHI is presumed to be a breach unless the entity demonstrates a low probability that the information was compromised, based on a risk assessment covering at least four factors: the nature and extent of the PHI involved, who received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. The presumption runs against the provider. Silence is not a defense.
Then the safe harbor. The obligation attaches only to unsecured PHI, which the same section defines as PHI not rendered unusable, unreadable or indecipherable to unauthorized persons through a technology or methodology specified by the Secretary. Properly encrypted data that is stolen is, in the regulatory sense, not a reportable breach at all. That is the practical answer to why encryption earns its budget line even though the rule marks it addressable.
45 CFR 164.404 sets the individual notice at without unreasonable delay and in no case later than 60 calendar days after discovery. Breaches involving more than 500 residents of one state add notice to prominent media outlets in that state, and breaches of 500 or more individuals go to the Secretary at the same time as the individuals. The OCR breach portal states plainly that it investigates all breaches affecting 500 or more individuals, with smaller ones investigated as resources allow.
Two consequences follow for anyone writing an incident response plan in this sector. Sixty days is not sixty days of investigation, because the notice has to be drafted, reviewed and mailed inside it. And a business associate's breach starts your clock as well as theirs.
What Healthcare Cyber Security Costs and Who Pays for It
This is the section the vendor guides skip, and it is the one that decides whether anything on this page happens.
Set that against the AHA's figure of 48 percent of rural hospitals running at a financial loss in 2023, and the sector's central argument becomes visible. In its Senate testimony the AHA asked Congress to make the proposed cybersecurity requirements voluntary, argued that the documented source of risk is third-party technology rather than hospitals' own systems, and backed the voluntary performance goals instead of mandates.
Budget in tiers rather than as one number. Identity and email protection, patching, and tested offline backups are the first tier and cost little beyond time. Encryption of records at rest and on portable devices is the second, and it is what converts a future incident from a reportable breach into a non-event. Monitoring, a named security officer and a tested response capability are the third, and they are what a practice buys when it has more at stake than it can watch itself. The same order works for a small business outside healthcare, with encryption promoted because of the safe harbor.
Medical Device and Third Party Risk in Healthcare
Two exposures exist in this sector that do not exist in most others.
Connected medical devices are the first. The FDA now regulates their security directly: its guidance addresses section 524B of the FD&C Act for cyber devices, requiring manufacturers to design for security, document it in premarket submissions, provide a software bill of materials, and stay vigilant for postmarket vulnerabilities, because unpatched flaws could let an attacker access and issue commands to a compromised device. Useful, and prospective. An infusion pump bought in 2016 runs an operating system nobody patches and will stay in service for years, so the practical control is network segmentation and an inventory, not a firmware update that is never coming.
Business associates are the second. Since 2013 they have been directly liable under the Security Rule, not merely contractually bound, and 164.308(b) requires the written contract that documents their assurances. That contract is necessary and it is not protective.
How to Secure a Healthcare Practice
In order, cheapest and most effective first. Each item maps to a specification in the rule, which is what makes the spending defensible later.
When to Hire a Healthcare Cyber Security Firm
Hire when one of three things is true: nobody is watching the systems outside office hours, an insurer or a health system partner has asked a security question you cannot answer in writing, or something is happening now. Before that, the money goes further on the eight items above.
What to ask for specifically in this sector: experience with a HIPAA risk analysis that OCR has actually seen, medical device segmentation, and a response retainer that covers breach notification support rather than only technical containment. Managed detection and response is the service that covers the overnight gap without hiring a team.
Key takeaways
- HIPAA's Security Rule sets a legal floor: three safeguard families, flexible in method, not in whether you meet them.
- Risk analysis is the first Required specification and the first thing a regulator asks to see.
- Encryption is marked Addressable, which means implement it or document a reasonable alternative, never do nothing.
- Reported breaches of unsecured PHI grew 100 percent between 2018 and 2023 and the individuals affected grew 950 percent, per HHS.
- Roughly three-fourths of large breaches in 2022 came from hacking a network server or electronic equipment, not from lost devices.
- Individual notice is due within 60 calendar days of discovery, with media notice above 500 residents of a state and automatic OCR investigation at 500 or more.
- Encrypted data is not unsecured PHI, so the safe harbor can remove the notification obligation entirely.
- Business associates are directly liable, and their breach still starts your clock and carries your name.
- HHS estimated its proposed update at about $9 billion in first-year cost while 48 percent of rural hospitals ran at a loss in 2023.
Common questions
What is cyber security in healthcare?
It is the protection of patient information and the systems that deliver care, governed in the United States by the HIPAA Security Rule. In practice it covers three things at once: keeping records confidential, keeping them accurate, and keeping the systems available, because a clinical system that is down is a safety problem rather than only a data problem.
Is HIPAA compliance the same as cyber security?
No, and treating them as identical is how organizations end up with binders and no controls. HIPAA sets a minimum standard and a documentation burden. Cyber security is the actual work of keeping attackers out, which frequently goes further than the rule requires and occasionally solves a problem the rule never anticipated, such as extortion without encryption.
Does HIPAA require encryption?
Not literally. Both encryption specifications in the technical safeguards are marked Addressable, meaning a covered entity must implement them where reasonable and appropriate, or document why not and adopt an equivalent alternative. In practice most providers should encrypt anyway, because encrypted data falls outside the definition of unsecured PHI and therefore outside the breach notification requirement.
How long does a healthcare provider have to report a data breach?
Sixty calendar days from discovery for notice to affected individuals, and without unreasonable delay before that. Breaches affecting 500 or more individuals go to HHS at the same time. Breaches affecting more than 500 residents of a single state also require notice to prominent media outlets serving that state.
Why do attackers target healthcare providers?
Because the records are complete and permanent. A single file can carry identity, contact, insurance and clinical detail that stays accurate for decades and cannot be reissued the way a payment card can. Add the pressure a care disruption creates during a negotiation, and the sector looks unusually attractive to an extortion group.
What is protected health information?
Individually identifiable health information held or transmitted by a covered entity or its business associate. The electronic form of it, ePHI, is what the Security Rule governs. It is broader than diagnoses: an appointment record, an insurance member number or a billing address tied to a named patient is PHI too.
Who enforces the HIPAA Security Rule?
The HHS Office for Civil Rights. It receives every breach report, publishes the ones affecting 500 or more individuals on its public portal, and states that it investigates all of them. Smaller breaches are investigated as departmental resources and enforcement priorities allow.
Are business associates covered by the HIPAA Security Rule?
Yes. Since the 2013 changes, business associates must comply with the Security Rule directly, not only through their contract with the provider. A written business associate agreement is still required, and it allocates liability between the two organizations without changing who has to notify the affected patients.
What is the biggest cyber security threat to healthcare?
By reported volume, hacking of network servers and electronic equipment, which HHS put at roughly three-fourths of large breaches in 2022. By impact, third-party compromise, because one clearinghouse or software supplier can put hundreds of provider organizations into breach notification at the same time.
Do small medical practices need a cyber security firm?
Not immediately. A small practice gets most of the available protection from a documented risk analysis, multi-factor authentication, encrypted devices and tested backups, none of which needs a specialist. Bring in a firm when nobody is watching the systems overnight, when a partner organization asks a security question you cannot answer on paper, or when an incident is already under way.
Does cyber insurance cover a HIPAA breach?
Policies commonly cover notification costs, forensics and legal support, and many are written with this sector in mind. What they do not do is satisfy the rule: an insurer will still expect a current risk analysis and evidence of the controls you described on the application, and a gap between the two is where claims get argued.
On this page
- Why Cyber Security for Healthcare Is Different
- What HIPAA Requires of Healthcare Providers
- What Patient Data Is Worth to an Attacker
- The Cyber Attacks That Actually Hit Healthcare Providers
- How a Healthcare Data Breach Gets Reported
- What Healthcare Cyber Security Costs and Who Pays for It
- Medical Device and Third Party Risk in Healthcare
- How to Secure a Healthcare Practice
- When to Hire a Healthcare Cyber Security Firm
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.