Stay updated with the latest healthcare cybersecurity trends, news, and tips to protect patient data and comply with medical industry security standards.
Search across headline titles and summaries.
Background for this topic.
Healthcare is the delivery of clinical care and related services through hospitals, clinics, laboratories, pharmacies, insurers, and connected medical devices. It depends on electronic health records (EHRs), patient identity systems, diagnostic and imaging platforms, medication and scheduling systems, and data exchanges between organizations. These environments hold sensitive health and payment information, while the availability and integrity of systems can affect treatment, diagnostics, and patient safety.
Security concerns include unauthorized access or disclosure of records, alteration of clinical data, and disruption of care through attacks on EHRs, connected devices, or third-party services. Defenses require risk-based access controls, strong authentication, network separation where appropriate, secure device and software maintenance, backups that support clinical continuity, and tested downtime and incident-response procedures. Vulnerability management must account for legacy systems and devices that cannot be patched quickly. Privacy and compliance obligations, such as HIPAA in the United States, shape how organizations collect, use, share, retain, and report health information.
Why Governance, Access Control and Vendor Oversight Now Define Patient SafetyHealthcare breaches do not start with a single technical failure. Digital risk has become clinical risk, driven by weak governance, excess access and unmanaged vendors. Resilience now depends on governance, not more tooling.
Key Challenges in the Proposed HIPAA Security Rule UpdateThe HIPAA Security Rule may soon undergo its first major overhaul in decades. Although finalization could come as early as May 2026, timelines remain uncertain as new requirements are grounded in modern cybersecurity practices and frameworks.
AI chatbots rank as the number-one health tech hazard in 2026, followed by "digital darkness" and legacy medical device cyber issues, said Rob Schluth and Scott Luney, technology and security experts at patient safety group ECRI Institute, which compiles an annual top 10 list. They explained why.
What often appears to be turf wars between healthcare technology management, facilities OT staff, IT departments and security teams are often the result of unclear ownership and accountability for device security. And that presents safety risks to patients, says Mohammed Waqas, CTO of Armis.
HIPAA Settlement Small Compared to Many OthersU.S. federal regulators fined a dental practice software vendor with a seemingly lowball financial penalty for a high-stakes 2020 hack affecting 15 million individuals that the company failed to report. Maryland-based MMG Fusion agreed to $10,000.
Compromise Affects Healthcare Clients of Co.'s Revenue Cycle Management ServicesBilling services vendor Trizetto Provider Solutions is notifying 3.4 million individuals of a hacking incident discovered in October 2025 that investigators have now determined started nearly a year earlier, when threat actors accessed the company's healthcare clients' insurance related data.
Also: Trojanized RedAlert App, Tycoon 2FA Takedown, CyberStrikeAI AttacksThis week, Cisco patches and hacks. Trojanized app targeted Israelis. Bye-bye, Tycoon 2FA. Also bye-bye LeakBase. A LexisNexis breach. Woman sentenced for trafficking Microsoft licenses. Silver Dragon targeted governments. Broadcom patch. A Mississippi medical clinic resumed operations.
Health Researchers Often Overlook Security of Historical DatasetsAn August 2025 ransomware attack on the University of Hawaii Cancer Center's epidemiology division has affected 1.2 million individuals, including personal information such as Social Security numbers of certain research study participants dating back more than 30 years.
CHIME, AHA, Others Contend Privacy, Security Burden Would Shift to ProvidersProposals to eliminate certain longstanding health IT certification criteria - including privacy and security related controls - will shift regulatory burden from health IT developers to healthcare providers, some industry groups contend in their public response to proposed federal rulemaking.
Fired Employee Illegally Downloaded 1M Patient RecordsA former Nuance Communications IT worker has pleaded guilty in a criminal case that alleged he downloaded and stored on a personal hard drive containing 1.2 million patient records of a client, Geisinger Health, two days after he was terminated from his job in 2023.
Experts Warn of DDoS, Ransomware, Proxy And Other Attacks on Health SectorThe escalating conflict emerging from the U.S. and Israel military strikes this weekend on Iran, which killed the country's top leadership and crippled its internet connectivity, could erupt into cyberattacks against the healthcare sector by Iranian sympathizers and proxies, experts warn.