From Our Data Team: Healthcare Cybersecurity–Protecting Patients Means Protecting Data
Ransomware doesn’t just lock files–it locks lives
When healthcare systems go offline, the consequences are immediate. Electronic health records become inaccessible. Prescriptions are delayed. Care teams shift to manual processes. Operations slow down, and patient safety may be affected.
Cyberattacks are no longer isolated events. They are an escalating threat across the healthcare ecosystem, impacting hospitals, behavioral health providers, public health agencies, community-based organizations and managed care entities alike.
As healthcare becomes increasingly digital, cybersecurity is inseparable from patient safety and operational continuity.
The Growing Threat of Cyberattacks in Healthcare
Healthcare remains one of the most targeted sectors for cybercrime. In 2024, healthcare organizations reported 444 cyber incidents, including ransomware attacks and data breaches.1 The healthcare sector has consistently ranked among the most targeted industries in national cybercrime reporting.2 The Change Healthcare cyberattack exposed data from nearly 193 million individuals, underscoring the scale of vulnerability across interconnected systems.3 Large healthcare data breaches have steadily increased in recent years, according to the U.S. Department of Health and Human Services.4
The Cybersecurity and Infrastructure Security Agency have warned that ransomware attacks against healthcare providers create real-world patient safety risks.5
Why Cybersecurity Maturity varies Across Healthcare
The 2023 HIMSS Healthcare Cybersecurity Survey found that 74% of healthcare organizations struggle to hire cybersecurity professionals, 57% struggle to retain them and only 55–60% report having a fully implemented cybersecurity program.6
Rapid adoption of telehealth, cloud platforms and connected medical devices has expanded the digital footprint of healthcare delivery.7
The Office of the National Coordinator for Health IT notes that increased digitization improves care coordination, but can increase exposure when governance does not evolve alongside technology adoption.8
Cybersecurity as a Patient Safety Responsibility
The HIPAA Security Rule requires covered entities to implement administrative, physical and technical safeguards to protect electronic protected health information.9
The American Medical Association has acknowledged that cyberattacks increasingly interfere with physician operations and clinical workflows.10
When digital systems are compromised, appointment scheduling, medication management, laboratory reporting and care coordination are disrupted. Protecting health data supports continuity of care, operational stability and public trust.
Family Health Initiative’s Approach to Cybersecurity Governance
Family Health Initiatives (FHI) integrates cybersecurity into its broader governance and risk management framework. In its 2025 independent HIPAA Security Risk Assessment, FHI received an overall Low Risk rating, reflecting alignment with required administrative, physical and technical safeguards and documented monitoring and response processes.
Foundational practices include comprehensive data encryption, role-based access controls with multi-factor authentication, continuous monitoring, independent risk assessments, tested incident response planning, disaster recovery procedures and structured vendor risk oversight.
Cyber threats will continue to evolve. Strengthening governance, workforce capacity, monitoring capabilities and compliance practices help reduce exposure and improve resilience. Protecting data is a fundamental component of protecting patients.
The Time to Act Is Now
The next attack isn’t a question of if, it’s when.
Organizations that prioritize cybersecurity today safeguard not only their systems, but also the families, communities and patients who depend on them every day.
Author: Bhagyarathi Raman, MS, CQSP, Data Project Management & Innovation Leader, Information Strategy and Analytics, Family Health Initiatives
References:
1. American Hospital Association. Healthcare had the most reported cyberthreats in 2024. Published 2025.
2. Federal Bureau of Investigation Internet Crime Complaint Center. 2023 Internet Crime Report.
3. HIPAA Journal. Change Healthcare responding to cyberattack.
4. US Department of Health and Human Services. Office for Civil Rights Data Breach Portal.
5. Cybersecurity and Infrastructure Security Agency. Ransomware Guide.
6. Healthcare Information and Management Systems Society. 2023 Healthcare Cybersecurity Survey.
7. Health Sector Cybersecurity Coordination Center. Healthcare Threat Landscape Overview.
8. Office of the National Coordinator for Health Information Technology. Health IT and cybersecurity guidance.
9. US Department of Health and Human Services. HIPAA Security Rule, 45 CFR Part 164 Subpart C.
10. American Medical Association. Cybersecurity in Healthcare Report.