Cybersecurity in healthcare: How HIPAA updates aim to protect patient data

Cybersecurity threats in the healthcare industry have escalated in recent years, making it a top priority for regulators and industry leaders. Healthcare facilities store vast amounts of sensitive patient data, making them prime targets for cybercriminals. To address these risks, the U.S. Department of Health and Human Services (HHS) is updating the Health Insurance Portability and Accountability Act (HIPAA) Security Rule with new cybersecurity requirements.

Beyond regulatory updates, healthcare organizations are being urged to adopt cybersecurity best practices, as data breaches and ransomware attacks continue to rise. Recent cyber incidents have forced hospitals to divert patients, delay medical procedures, and suffer financial losses. As the industry grapples with increasing digital threats, the need for robust cyber defenses has never been more critical.

The rising threat of cyberattacks in healthcare

Cyberattacks targeting healthcare organizations have surged, with data breaches growing in both frequency and severity. HHS’s Office for Civil Rights (OCR) reported a 93% increase in large breaches from 2018 to 2022, with ransomware-related incidents skyrocketing by 278% in the same period. These breaches not only compromise patient privacy but also disrupt essential medical services, creating life-threatening situations.

Why health care is a prime target

Healthcare facilities are prime targets for cybercriminals due to the valuable and sensitive data they store. Electronic health records (EHRs) contain personal details such as Social Security numbers, financial information, and medical histories, making them highly attractive for identity theft and fraud. Additionally, many hospitals and clinics still rely on outdated security infrastructure, using legacy systems that lack modern cybersecurity protections, leaving them vulnerable to breaches.

Another significant risk comes from third-party vendors and partners, as hospitals often work with multiple external providers, increasing the chances of cyber threats through third-party breaches. Unlike other industries, cyberattacks on healthcare institutions can have immediate and severe consequences, including delayed critical surgeries, disrupted emergency response systems, and compromised patient care.

Real-world impact of healthcare cyberattacks

Recent cyber incidents have highlighted the severe consequences of security breaches in health care. Ransomware attacks have forced hospitals to divert ambulances, postpone treatments, and even shut down entire health networks. These disruptions not only cost millions of dollars in recovery efforts but also put patient lives at risk.

Dotty Bollinger, a healthcare compliance consultant, emphasizes the growing threat: “Hackers are getting wiser. Cyberattacks are a greater threat than they’ve ever been, and unfortunately, many organizations still believe ‘it won’t happen to us.’”

HIPAA security rule updates

To combat rising cyber threats, HHS is updating the HIPAA Security Rule with new requirements. These updates aim to enhance data protection and ensure healthcare organizations implement stronger security measures.

Key changes in the HIPAA security rule

The upcoming updates will introduce several significant changes aimed at improving data access and security in health care. One key update focuses on enhanced patient data access, allowing patients to inspect their protected health information (PHI) in person, take notes, or even photograph their records.

Additionally, the response time for providing patient access to PHI may be reduced from 30 days to just 15 days, ensuring quicker availability of critical health information. Alongside these accessibility improvements, stronger cybersecurity standards will also be implemented, requiring healthcare organizations to adopt stricter security measures to better protect against cyber threats.

These changes align with broader efforts to improve data security while maintaining patient rights and accessibility. However, some experts worry about the implications of increased data collection and AI-driven analytics in health care. Bollinger warns that aggregated patient data, combined with AI in health care, poses a heightened risk to individual privacy.

Healthcare cybersecurity goals

Beyond HIPAA updates, HHS has introduced the Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals (HPH CPGs) to help organizations prioritize critical security measures. These voluntary guidelines offer a framework for strengthening cyber defenses and reducing vulnerabilities.

Financial support for cybersecurity upgrades

Recognizing that many hospitals lack the resources to invest in advanced cybersecurity measures, HHS has proposed two financial assistance programs.

Funding for low-resourced hospitals: This program will provide upfront financial assistance to help smaller hospitals implement essential cybersecurity practices.

Incentives for broader adoption: A second initiative will offer financial incentives for all hospitals to invest in advanced cybersecurity protections.

Over time, these cybersecurity performance goals may become mandatory, with HHS integrating them into enforceable regulations. The goal is to create a more resilient healthcare sector that can withstand evolving cyber threats.

Ryan Witt, vice president of Industry Solutions at Proofpoint, emphasizes the urgency of adopting stronger security measures: “Healthcare organizations store large amounts of sensitive data and often must retain it for extended periods, expanding their attack surface.” He recommends that providers align with HHS’s 405(d) program, which outlines best practices for strengthening cybersecurity.

Addressing healthcare’s cybersecurity challenges

Despite increased awareness of cyber risks, many healthcare providers struggle to implement effective security strategies. Several key challenges continue to hinder progress.

Lack of cybersecurity expertise: Many healthcare organizations, particularly smaller providers, lack dedicated cybersecurity teams. Instead, IT departments must juggle multiple responsibilities, often prioritizing compliance over proactive security measures. This reactive approach leaves institutions vulnerable to sophisticated attacks.

Budget constraints: Cybersecurity investments can be costly, especially for smaller hospitals and clinics. While large health systems may have the resources to implement cutting-edge security solutions, many facilities operate on tight budgets, making it difficult to allocate funds for cyber protection.

Third-party risks and remote work challenges

Healthcare organizations increasingly rely on third-party vendors for services like cloud storage, billing, and telemedicine. These partnerships introduce additional security risks, as a breach in a third-party system can compromise multiple health networks.

Additionally, the rise of remote work in health care has expanded the attack surface. Clinicians accessing patient data from personal devices or unsecured networks pose new security challenges. Witt emphasizes that the industry’s reliance on third-party workers and remote employees, many of whom use personal devices, increases cybersecurity risks by expanding the attack surface.

Strengthening cyber defenses

To address these challenges, healthcare organizations must adopt a proactive cybersecurity approach. The following steps can help strengthen defenses.

Implement multi-factor authentication (MFA): Requiring multiple forms of verification reduces the risk of unauthorized access.

Regularly update and patch systems: Keeping software and security tools up to date helps prevent known vulnerabilities from being exploited.

Conduct cybersecurity training: Educating staff on recognizing phishing attacks and best security practices can prevent common breaches.

Adopt zero-trust security models: Restricting access based on user roles minimizes the impact of potential breaches.

Invest in threat detection and response: Deploying advanced security tools to monitor and respond to threats in real-time can significantly improve resilience.

Cyberattacks in the healthcare sector are not slowing down, making it imperative for organizations to act now. “The risk is as great as it has ever been, and the resulting detrimental impact on patient care is a significant area of concern,” Witt warns.

As cyber threats continue to evolve, healthcare organizations must take urgent steps to strengthen their defenses. The updates to the HIPAA Security Rule, along with HHS’s cybersecurity performance goals, are designed to strengthen the resilience of the healthcare system. However, meaningful progress will depend on collaboration among providers, policymakers, and cybersecurity professionals.

Investing in cybersecurity is no longer optional—it is essential for protecting patient data, maintaining trust, and ensuring the continuity of medical services in an increasingly digital world.