Health insurance payers, healthcare providers, and their associated contractors who handle patient data have all been forced to reckon with heightened cybersecurity concerns. For the entire industry, a proactive approach — rather than a reactive approach — is more important than ever.

The recent ransomware breach at Episource, a business associate owned by UnitedHealth Group, underscores systemic weaknesses across the healthcare ecosystem. When a third-party provider, not a hospital or clinic, becomes the vector, the repercussions ripple outward. Between January 27 and February 6, 2025, cybercriminals infiltrated Episource’s systems, gaining access to protected health information and personally identifiable information tied to Sharp Healthcare and Sharp Community Medical Group. According to Sharp disclosures, this included names, contact information, health insurance plan details, medical diagnoses, lab results, and even medical images.

UChicago Medicine Medical Group has officially ended its relationship with Nationwide Recovery Services (NRS) after a cybersecurity breach compromised sensitive personal data tied to debt collection and recovery activities. The breach, which occurred between July 5 and July 11, 2024, enabled an unauthorized party to access data from NRS systems, including files containing patient names, birthdates, Social Security numbers, financial account information, and potentially medical-related financial data.

The U.S. Department of Health and Human Services Office for Civil Rights has announced a $75,000 settlement with Comstar, LLC, a Massachusetts-based billing and revenue cycle company serving emergency ambulance providers, following a ransomware breach that exposed the electronic protected health information of nearly 586,000 individuals.

The formal shift from World Password Day to World Passkey Day this May is more than symbolic. It signals a decisive break from a decades-old security architecture that has consistently failed to protect users at scale. For healthcare organizations, which remain among the most targeted sectors for data breaches and identity theft, this pivot from shared secrets to cryptographic keys is not a trend. It is a necessary reckoning.

The U.S. Department of Health and Human Services Office for Civil Rights has reached an $800,000 settlement with Florida-based BayCare Health System following a HIPAA Security Rule investigation into unauthorized access of a patient’s electronic protected health information.

While most healthcare executives fixate on state-sponsored cyberattacks from Russia or China, the more immediate and systemic threat is buried in their own legal files. The true weak point in the healthcare cybersecurity chain is not nation-state actors or malware. It is the vendor contract no one has read since go-live.

“The intent of the healthcare cybersecurity provision of the Cybersecurity Information Sharing Act of 2015 (6 USC 1533) was to establish a voluntary, consensus-based, industry-led approach so we can collectively strengthen our security posture and share meaningful threat intelligence within healthcare and, where appropriate, with other critical infrastructure sectors,” said Lee Kim, HIMSS senior principal, cybersecurity and privacy. “This law has had a significant impact not only on healthcare, but across other sectors by advancing collaboration and improving cyber resilience. I am happy to have contributed to the creation of this provision, which continues to strengthen cybersecurity across healthcare and beyond.”