Healthcare leaders should rank cyber risk by clinical consequence. Which failure delays care, which exposes patients, and which does both? Spend follows that ranking, not the count of systems or the size of the audit finding.
Where the trade-off sits
In most industries a security control that slows people down is an annoyance. In a hospital it can be a clinical risk. A clinician who cannot reach a record in an emergency will find a way round the control. Shared logins on ward workstations are the usual result.
The same tension shows up with devices. Imaging systems, infusion pumps and monitoring equipment have long service lives and run software that cannot always be patched on the vendor’s timetable. Taking a device offline to secure it may be unacceptable. Leaving it as it is may be unacceptable too.
Security leaders who treat these as technical problems tend to lose the argument with clinical leadership. Treat them as shared risk decisions, with clinicians in the room.
Where exposure concentrates
| Exposure | What makes it a healthcare problem | Decision to settle |
|---|---|---|
| Clinical system availability | Electronic records, laboratory, imaging, pharmacy and emergency systems support care in progress. Downtime means diversion, delayed procedures and paper charting. | Tier systems by how quickly their loss harms patients. Set recovery targets from that tiering, not from IT convention. |
| Connected medical devices and clinical technology | Long lifecycles, limited patching, vendor-controlled configuration, and links to the clinical network. | Maintain an inventory, segment the network, and agree compensating controls for devices that cannot be updated. |
| Third-party dependencies | Hosted records, billing and claims clearing, pathology and laboratory services, telehealth and pharmacy supply chains. | Identify the providers whose outage stops care or cash flow, and test the fallback with clinical staff. |
| Patient data and access | Records are needed fast, by many roles, across shared devices, with emergency access routes. | An access model for shared workstations and break-glass use, with monitoring that does not slow care. |
| Ransomware and extortion | Attackers can disrupt operations and threaten to publish patient data, so recovery alone does not end the incident. | A pre-agreed position on data theft, regulators and patient communication. |
What the evidence shows
The Change Healthcare ransomware incident is the clearest documented case of concentration risk. Disruption to a single claims and payments provider reached pharmacies, providers and payers across the US health system. UnitedHealth Group first estimated about 190 million people. The figure it later submitted to the US Department of Health and Human Services Office for Civil Rights, in July 2025, was 192.7 million.
The lesson for a hospital or health system is not specific to that vendor. The organization you depend on may be several steps removed from your contract. Ask what stops if the clearing house, the hosted record or the laboratory network goes down, and who in your organization could keep working.
Priorities, in order
1. Keep clinical services running. Define downtime procedures for the tier-one clinical systems and rehearse them with clinical staff. A procedure nobody has practiced is a document, not a capability.
2. Know what is connected. A reliable inventory of medical and clinical technology is the base for every other device control. Passive discovery suits environments where active scanning could disturb equipment.
3. Map the dependencies behind the dependencies. Billing, supply, laboratory and hosted systems often share a few providers. Concentration is the risk, not any single contract.
4. Make access fit clinical work. Choose controls that work on shared devices and in emergencies, such as badge-based sign-in, rather than controls clinicians will bypass.
5. Prepare for the data theft decision. Decide in advance who handles regulators, patients and the press, and what the position on extortion will be.
Who decides when care and security conflict
Settle this before an incident. If ransomware is spreading, someone must be able to take a clinical system offline, and someone must decide when it returns. Those are clinical decisions as much as security ones. Agree the authority, the clinical advisers on call, and the order of restoration in writing, then test them.
Regulatory context
| Regime | What it asks that affects priorities |
|---|---|
| HIPAA Security Rule (US) | A documented risk analysis and risk management, plus a contingency plan covering backup, disaster recovery and emergency mode operation. |
| HIPAA Breach Notification Rule (US) | Notice to affected individuals without unreasonable delay and within 60 days of discovery. |
| FDA, section 524B of the FD&C Act (US) | Manufacturers of cyber devices must supply a vulnerability management plan and a software bill of materials in premarket submissions. This improves new devices. The installed base remains the hospital’s responsibility. |
| EU NIS2 Directive | Health sector entities fall within scope, with risk management measures and incident reporting duties. |
| UAE health data law | Federal rules on the use of ICT in health fields restrict storing and transferring health data outside the country, with defined exceptions. Check the current text and emirate-level health authority requirements. |
Indicators worth reporting
-
Share of tier-one clinical systems with a rehearsed downtime procedure.
-
Share of connected medical devices inventoried, and how many run with compensating controls.
-
Number of providers whose failure would stop care, with a tested fallback for each.
-
Time to restore a tier-one clinical system in an exercise.
| **** |
|---|
Sources
-
U.S. Department of Health and Human Services, Office for Civil Rights, Change Healthcare cybersecurity incident FAQ. hhs.gov hhs.gov
-
U.S. Department of Health and Human Services, HIPAA Security Rule and Breach Notification Rule (45 CFR Parts 160 and 164). hhs.gov hhs.gov
-
Health Sector Coordinating Council and HHS 405(d) Program, Health Industry Cybersecurity Practices. 405d.hhs.gov 405d.hhs.gov
-
U.S. Food and Drug Administration, Cybersecurity in Medical Devices and section 524B of the FD&C Act. fda.gov fda.gov
-
European Union, NIS2 Directive on measures for a high common level of cybersecurity. eur-lex.europa.eu eur-lex.europa.eu
-
National Institute of Standards and Technology, Cybersecurity Framework 2.0. nist.gov nist.gov
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionManage Cyber Risk & ExposureKnow what attackers can reach and what it would cost.See how we work →Related service
Cyber Risk & Governance
Use this industry view to prioritize Healthcare cyber-risk decisions.