Strengthening Healthcare Cybersecurity in an Era of Disruption

Strengthening healthcare cybersecurity in an era of disruption

Understanding the healthcare threat landscape 

Cybersecurity in healthcare is no longer a traditional IT function but a mission-critical enterprise capability that impacts patient safety, clinical continuity and organizational resilience. Today, healthcare leaders face a risk environment defined less by isolated threats and more by systemic operational exposure. The value of sensitive health data remains high, while expanding supply chain dependencies and IoT-dense clinical environments continue to widen the attack surface. The complexity and technical debt accumulated in the 24/7 healthcare operating model has made healthcare an obvious — and lucrative — target.

Adversaries are capitalizing on these conditions, favoring high-impact disruption through ransomware, credential-based compromise and third-party weaknesses. Frontier AI is accelerating that pressure across the threat spectrum. Models can now autonomously discover and exploit previously unknown vulnerabilities in a matter of hours. And the barrier to entry has dropped sharply. With agentic AI and simple prompts, less sophisticated attackers can surface unpatched systems and misconfigurations, establish a foothold and move laterally across the environment.

Proposed HIPAA Security Rule changes

Regulators are raising the bar, too. In January 2025, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published proposed updates to the HIPAA Security Rule, the first major revision since 2013. For the first time, the rule names specific technologies healthcare organizations must deploy. The proposal centers on five core mandates:

• Mandatory means mandatory: The proposal eliminates the "addressable" classification, making nearly every implementation specification required. Documenting why a control was skipped will no longer be enough.
• Encryption and core cyber controls: Encryption of electronic protected health information (ePHI) at rest and in transit, multi-factor authentication (MFA), network segmentation and anti-malware protection become baseline requirements, along with dedicated ePHI backup and recovery controls.
• Evidence-based risk analysis: At least annually, organizations must assess risk using a complete technology asset inventory and a network map showing how ePHI flows through the environment.
• Continuous testing and assurance: Annual penetration tests and compliance audits, with vulnerability scans every six months.
• Tighter proof from business associates: Shorter timelines, verification of technical safeguards and far more documentation.

Final action on the rule is currently projected for 2027, and organizations would have a finite window to comply once it is published. Nothing is binding yet, but the direction is clear. The bar is moving from reasonable effort to demonstrable proof. Each priority below calls out where the proposed rule applies.

For a deeper look at the mandates, watch our webinar, From recommended to required: Preparing for HIPAA's new segmentation mandate. 

The path forward is not simply acquiring the latest technology or tool, but rather rigorously integrating security into core clinical and business operations. Healthcare leaders must establish foundational security priorities that reduce risk, strengthen resilience and align with evolving regulatory expectations.

The priorities outlined below reflect how broader security imperatives manifest within healthcare delivery systems, translating enterprise strategy into the realities of clinical operations, regulatory scrutiny and interconnected care ecosystems.

Priority 1: Make downtime survivability a core cyber resilience capability

Across industries, cyber resilience and rapid recovery have become board-level expectations rather than technical afterthoughts. In healthcare, resilience extends beyond financial continuity to clinical survivability, where downtime directly affects care delivery and patient outcomes.

Ransomware has hit the healthcare industry particularly hard. Outages and third-party disruptions not only interrupt operations but can also cost human lives. Prevention alone is no longer sufficient. Operational resilience and downtime survivability must now function as a core enterprise competency that impacts quality, safety and financial metrics.

The proposed HIPAA Security Rule reinforces this shift. It calls for separate technical controls for backup and recovery, documented restoration priorities and written procedures to restore certain systems and data within 72 hours of a disruption.

Key actions to build resilience and recovery 

• Invest in immutable, isolated backups capable of rapid recovery: Deploy immutable, off-site or air-gapped backup architectures that prevent modification, encryption or tampering. Pair them with validated, automated restore processes to ensure clean, trustworthy data and systems are available for rapid recovery.
• Define recovery expectations based on patient safety impact, care-delivery dependencies and the proposed 72-hour restoration requirement, so technology decisions reflect the true urgency of clinical operations.
• Mature clinical downtime playbooks through realistic, cross-department simulations: Move beyond theoretical plans to hands-on exercises that validate role clarity, communication paths, manual workarounds and clinical continuity under stress.

Priority 2: Establish identity, human and non-human, as the perimeter

Enterprise security strategy increasingly centers on identity as the new control plane, with continuous verification replacing assumed trust. In healthcare environments characterized by shared workstations, third-party access and urgent clinical workflows, identity discipline becomes foundational to both security and safety. As healthcare organizations expand AI investment and adoption, managing AI agents' identities and access is becoming a critical security priority.

Credential‑based attacks remain a top driver of healthcare breaches, fueled by advanced phishing techniques and inconsistent access controls across clinical, operational and third‑party environments. As remote work, vendor connectivity and AI adoption expand, disciplined access provisioning and revocation become among the most effective security controls available. Non-human identities — service accounts, API keys, connected devices and, increasingly, AI agents — multiply that exposure and rarely get the same scrutiny as human users. When attackers compromise identity, lateral movement can accelerate quickly, and healthcare organizations need the ability to respond to keep patients safe and clinical operations running.

The proposed HIPAA Security Rule turns identity best practices into requirements. MFA for system access and encryption of ePHI at rest and in transit would become mandatory, and documentation alone would no longer justify a gap.Credential‑based attacks remain a top driver of healthcare breaches, fueled by advanced phishing techniques and inconsistent access controls across clinical, operational and third‑party environments. As remote work, vendor connectivity and AI adoption expand, disciplined access provisioning and revocation become among the most effective security controls available. Non-human identities — service accounts, API keys, connected devices and, increasingly, AI agents — multiply that exposure and rarely get the same scrutiny as human users. When attackers compromise identity, lateral movement can accelerate quickly, and healthcare organizations need the ability to respond to keep patients safe and clinical operations running.

The proposed HIPAA Security Rule turns identity best practices into requirements. MFA for system access and encryption of ePHI at rest and in transit would become mandatory, and documentation alone would no longer justify a gap.

Key actions to strengthen identity controls

• Bring non-human identities into scope: Inventory service accounts, API keys, device credentials and AI agents, assign each an accountable owner, and apply the same least-privilege, rotation and review discipline you apply to clinicians and staff.
• Implement phishing‑resistant multi-factor authentication (MFA) throughout the organization. It's among the most effective investments for any organization and a named requirement under the proposed HIPAA Security Rule. It should be supported by conditional access policies that balance security enforcement with clinical usability and user experience.
• Strengthen access management by enforcing least-privilege access across clinical and business systems, ensuring users and service accounts receive only the access required and only for the time it is needed.
• Establish continuous access reviews and accountability by regularly validating access against current roles, clinical responsibilities and risk context, and invoking policies that grant temporary access or just-in-time access.

Priority 3: Rethink vulnerability management for the speed of AI

Vulnerabilities are inevitable. Security leaders are shifting from reactive patching models to risk-informed exposure reduction. For healthcare systems operating complex clinical, legacy and vendor-managed environments, this shift demands continuous visibility across distributed assets and supply chain dependencies.

Healthcare organizations must focus their resources on the highest‑risk exposures, especially those introduced across their supply chain. Distributed clinical environments — legacy electronic health record (EHR) components, medical IoT and OT, third‑party systems and vendor‑maintained assets — create blind spots traditional programs miss. As frontier AI compresses exploit cycles, leaders must prioritize rapid reduction of real‑world, exploitable risk, focusing on the most urgent operational and clinical safety needs.

In April 2026, Anthropic announced Claude Mythos, a frontier AI model it withheld from public release because it could autonomously discover and exploit zero-day vulnerabilities across major operating systems and browsers. For an industry running decades-old medical device software on long patch cycles, AI-speed exploitation turns known gaps into immediate risk. Mythos is one model. The class of capability it represents will keep advancing, and healthcare security programs need to be built for it.

The proposed HIPAA Security Rule adds structure and cadence to the discipline. Risk analysis would become evidence-based, built on a complete technology asset inventory and a network map of how ePHI flows, refreshed at least every 12 months. Organizations would also need vulnerability scans every six months, annual penetration testing and annual compliance audits. For many, the challenge is less about running the tests and more about operationalizing them and acting on what they find.

Key actions to reduce exposure

• Prioritize reduction of internet-facing exposure and unmanaged assets: Immediately shrink the external attack surface by eliminating shadow systems, decommissioning stale endpoints, and enforcing governance over devices and workloads that fall outside traditional IT ownership.
• Implement continuous discovery across clinical, operational and vendor ecosystems: Deploy automated discovery tools that map every connected asset — including medical IoT/OT, cloud workloads, remote sites and third‑party systems — to surface unmanaged, unknown or misconfigured endpoints. Continuous visibility allows teams to identify drift, new exposures and orphaned systems that traditional inventory or vulnerability scans routinely miss.
• Build the asset inventory and ePHI network map now: These are the foundation of the proposed rule's evidence-based risk analysis and often the longest lead-time item in the entire rule. Start with the systems that store, process or transmit ePHI.
• Operationalize testing on a fixed cadence: Meet the proposed rule's testing requirements by scheduling vulnerability scans at least every six months and penetration tests annually, and route findings into a remediation workflow with clear owners and deadlines.
• Narrow the gap between exploit speed and patch cycles: Frontier AI can weaponize vulnerabilities faster than traditional patch cycles respond. Pair agentic AI for monitoring, correlation and prioritization with deterministic automation for deployment, verification and rollback to shrink remediation windows, starting with the exposures that matter most to clinical operations.

Priority 4: Hold third parties to a higher standard of proof

Governance priorities across sectors are expanding to address supply chain exposure and vendor accountability as systemic risk drivers. In healthcare, where interconnected technology partners underpin clinical and administrative functions, third-party resilience must be treated as an extension of internal security architecture.

Third‑party incidents — from software supply chain attacks to outages among clinical and operational technology providers — remain a leading cause of disruption across healthcare. Large health systems often rely on hundreds to thousands of interconnected vendors, meaning a single compromise can cascade rapidly across clinical, financial and administrative functions. Healthcare organizations need to set clear security criteria for vendor onboarding, including audits, penetration tests and liability agreements. Healthcare leaders should assume that vendor compromise is possible and architect environments so that external failure will not automatically become their own.

The proposed HIPAA Security Rule raises the stakes. Health systems would be accountable for verifying business associates' technical safeguards at least annually, with 24-hour notification requirements when a business associate activates its contingency plan and far more documentation across the relationship.

Key actions to reduce third-party risk

• Establish clear boundaries and perimeters: Apply zero trust segmentation, which the proposed HIPAA Security Rule would make mandatory, to isolate high-risk or externally managed systems and treat vendor-provided or cloud-hosted solutions as untrusted by default, enforcing least privilege access paths, network isolation and strict boundary controls to prevent lateral movement.
• Shift to continuous monitoring and integrated risk signals: Replace slow, point-in-time vendor reviews with continuous visibility into external risk posture, attack surface changes, dark web exposure, credential leaks and software integrity signals.
• Formalize incident response and collaboration channels with critical vendors before an incident occurs: Establish clear escalation pathways, shared playbooks, coordinated downtime procedures and expectations for evidence sharing, forensic support and communication timelines.
• Require proof from business associates: Move from questionnaires to evidence. Require annual written verification of technical safeguards, contract for 24-hour contingency notifications and keep documentation audit ready.

Priority 5: Evolve data security and governance to enable AI at scale

As organizations move from AI pilots to AI at scale, enterprise security programs increasingly emphasize lifecycle governance, data integrity and model oversight from development through deployment. In healthcare, where AI intersects with regulated data and clinical decision-making, these guardrails must be embedded early to preserve safety and trust.

Unfortunately, adoption often outpaces security and governance maturity. For successful AI initiatives, data must be accessible, so organizations cannot simply lock it down. Without the right data security foundations and visibility, organizations are left vulnerable to AI-specific risks, including model manipulation, data leakage and hallucination. Leaders must advance AI responsibly, ensuring data environments are prepared without compromising safety or trust.

Shadow AI makes the gap visible. In one recent survey, 58% of frontline healthcare workers reported using unauthorized AI tools for work in the previous month. Once protected health information (PHI) enters an unvetted tool, it may be stored indefinitely or used for model training, with no reliable path to delete it. Many health systems are responding by treating AI governance as an operational control system with centralized AI registries, ethics review committees, real-time monitoring for PHI leaving the environment, and secure sandboxes where staff can experiment safely.

Key actions to secure AI 

• Identify and classify sensitive data so you can establish visibility and governance into how AI is ingesting, manipulating and sharing your data. The map of ePHI flows required for the proposed HIPAA Security Rule's annual risk analysis is a natural starting point.
• Start the post-quantum transition now: PHI stays sensitive for a patient's lifetime, which makes it a prime target for "harvest now, decrypt later" attacks — data stolen today and decrypted once quantum computing matures. Migrating to post-quantum cryptography is a multiyear program. Begin by inventorying where and how encryption protects ePHI, then prioritize the long-lived data and systems most exposed.
• Stand up an integrated AI governance structure: Bring clinical, operational, legal, cybersecurity and compliance leaders into a single governance framework that defines how AI is evaluated, approved, deployed and monitored across the enterprise, backed by a centralized registry of every AI tool and use case.
• Embed security and assurance controls directly into the AI lifecycle: Treat AI models like any other high‑risk digital asset. Enforce access controls, auditability, change‑management discipline and safeguards against data leakage or model manipulation from development through deployment.
• Raise enterprise literacy around AI risk: Equip clinical, operational and administrative staff with pragmatic guidance on AI limitations, responsible use and data protection expectations to reduce accidental misuse and shadow AI adoption.
• Give staff a safe place to experiment: Create secure sandboxes with approved tools so innovation continues while patient data stays protected and usage stays observable.

Priority 6: Segment now, on your terms

Network segmentation has long been a best practice. Under the proposed HIPAA Security Rule, it becomes a requirement, and it is the mandate many health systems are least prepared for.

The intent is clear boundaries between systems that handle ePHI and those that do not. That means separating clinical from administrative systems, isolating connected medical devices and IoT, restricting vendor access to only the systems they need and keeping guest Wi-Fi fully isolated. Done well, segmentation contains the blast radius of a breach and protects critical systems from peripheral vulnerabilities. Connected medical devices make the work urgent, since many run outdated firmware, cannot be patched and were never designed with security in mind.

Treat the delay in the final rule as a window. Segmentation in a hospital is a multiyear clinical program that spans device discovery, clinical workflow mapping, biomedical engineering sign-off and phased enforcement. Organizations that wait for the final rule risk doing emergency segmentation on a compressed compliance timeline in live clinical environments.

The broader regulatory picture strengthens the case. Healthcare cybersecurity oversight is tightening at both federal and state levels, and aligning to established frameworks now does more than satisfy auditors. It demonstrates competence, reduces liability, protects reimbursement and accelerates recovery funding. Organizations that build to a unified control framework won't be thrown off course if the final rule's timing shifts in either direction.

Key actions to segment with confidence

• Start with one protect surface: You cannot segment everything at once. Name the data, applications, assets and services the organization cannot lose, and put controls close to them. Most health systems begin with patient records and the systems that read them, imaging, connected medical devices, or remote and third-party access.
• Map transaction flows before you enforce anything: Document how the protect surface actually communicates, observed rather than assumed. The written inventory and network map also satisfy two of the proposed rule's requirements, so the work pays back whether the rule lands, softens or goes away.
• Enforce where you can make changes: In the data center, policy can live on the workload and travel with it. For imaging, biomedical and bedside devices that cannot run an agent, enforce around the device using device identity, and bring clinical engineering in early.
• Simulate before you enforce: Write policy from observed traffic and run it in simulation or dry-run mode first. The most common way segmentation breaks production is enforcing against an assumed traffic pattern instead of an observed one.
• Make compliance continuous: Consolidate federal, state and sector-specific requirements into a single control baseline, and embed automated evidence collection and standardized reporting into daily operations so you can demonstrate segmentation, identity, resilience and third-party controls on demand.

Final thoughts: Securing healthcare's next phase of digital transformation

The next 18 months will accelerate a generational shift in healthcare cybersecurity from fragmented controls to integrated, enterprise-wide risk management. For the first time, healthcare leaders have a specific federal standard to build toward, one that names the controls, the cadences and the proof regulators expect. Organizations must rethink their processes for business continuity, compliance and third-party risk, and evolve foundational security competencies such as data security, identity security, vulnerability management and network segmentation. Finally, they must prepare to scale AI by establishing the right data foundations and cross-functional AI governance.

Healthcare's mission is too critical, and the threat landscape too aggressive, for incremental approaches. Leaders who act decisively now will create safer, more resilient and more digitally empowered health systems for the years to come.