Healthcare continues to be one of the most targeted sectors by cybercriminals. Thus far in 2025, 33 attacks have occurred, as reported by the HIPAA Journal. Globally, ransomware associated with healthcare surged by over 31%. The U.S. is the most heavily targeted region, partly because of organizations’ propensity to pay ransoms to restore operations and reduce the risk to patients.
So, what are hospitals and other healthcare companies doing to protect themselves and their patients? Is the time quickly approaching when these actions will be a requirement? Here, we’ll explore the changing landscape of cybersecurity in 2025, the emerging threats, and the best practices for protecting patient information.
Emerging Cybersecurity Threats in 2025
The top cybersecurity risks for the healthcare sector include ransomware attacks, legacy systems, third-party vendors, phishing, and insider threats.
Phishing & Ransomware
According to the HIPAA Journal, over 90% of cyberattacks against the healthcare sector are phishing scams. The most common form this takes is email phishing, in which a seemingly innocuous email contains malicious links. Today, AI creates more convincing messages, enhancing phishing effectiveness.
These malicious links may inject malware into a network, infecting and encrypting sensitive data. Hackers then demand a ransom to release information.
The healthcare industry is a prime target because hackers know its critical nature and that many will pay the ransom to minimize operational disturbances. The FBI does not support paying ransoms as it does not guarantee that your data will be returned, and it incentivizes hackers.
Yet, with the following statistics provided by HIPAA on ransomware attacks, it’s easy to see why many organizations choose to pay.
- Almost 25% of healthcare IT staff said these attacks increased patient mortality rate
- 64% reported delayed procedures
- 48% saw an increase in medical procedure complications
Data Breaches
Hackers can sell healthcare data for a significant amount of money, up to 50 times more than financial information. This is yet another reason why the industry is a prime target.
To protect against data breaches, the HIPAA Privacy Rule established standards for protecting information. Mandated security measures for electronic protected health information (ePHI) include encryption, access controls, and risk assessments.
A significant number of data breaches are caused by third-party vendors, with estimates ranging from 50% to 60%. Increasing awareness of the security postures of all third-party vendors, particularly those involved with patient data, is essential in minimizing healthcare and cybersecurity risks.
Because of this, more healthcare organizations are using the HITRUST framework to assess, manage, and mitigate third-party risks. HITRUST certifications demonstrate the highest level of commitment to data privacy and security, going beyond basic HIPAA requirements and addressing a wider range of vulnerabilities and threats.
According to the World Economic Forum, 2025 will see increasingly sophisticated attacks using generative AI and social engineering. Additional concerns include supply chain challenges, visibility into suppliers’ security measures, geopolitical tensions, and regulatory challenges.
Shifting Privacy and Regulatory Compliance
Currently, the government is working to implement mandatory standards for cybersecurity in the healthcare industry. Backing the effort is the U.S. Department of Health and Human Services (HHS).
Introduced in the Senate in September 2024, the Health Infrastructure Security and Accountability Act imposes stricter accountability for healthcare providers, with those failing to meet specific minimum cybersecurity standards facing potential jail time.
If passed, the measure would direct the HHS to set minimum cybersecurity standards for healthcare providers, health plans, business associates, and clearinghouses. It also requires yearly audits and stress tests.
In December 2024, the Office of Civil Rights at the HHS issued a Notice of Proposed Rulemaking to modify the HIPAA of 1996 Security Rule, strengthening cybersecurity protections for ePHI. A few of the proposals include:
- Develop a risk analysis identifying possible threats and potential vulnerabilities
- Establish procedures for responding to and planning for contingencies and security incidents
- Yearly compliance audits
- Require encryption of ePHI
- Deploy anti-malware protection
- Require multi-factor authentication
- Require vulnerability scanning and penetration testing
- Require business associates and third parties to deploy technical safeguards to protect ePHI
Many of these potential requirements represent best practices when protecting patients’ health information. Essentially, the government’s intention to establish regulated cybersecurity standards addresses practices that should already be in place.
The Essential Nature of Secure Communication Channels
With the increasing use of digital platforms to enhance communications between healthcare staff and patients, it becomes essential to implement secure communication channels. This implementation ensures regulatory compliance while protecting patient confidentiality.
The basics of secure communications include encryption, which turns information into unintelligible coded messages. This data can only be accessed by authorized individuals, making it an essential tool in protecting organizations from cyberattacks and data breaches.
Ultimately, encryption should ensure that ePHI is unreadable and unusable by unauthorized individuals.
The National Institute of Standards and Technology (NIST) commonly recommends FIPS 140-2. This Federal Information Processing Standard incorporates the Advanced Encryption Standard (AES) into its protocols. The National Security Agency (NSA) uses AES, which is a sure sign that its encryption methods work.
NIST established AES as the new standard for encryption in 2001. Four years later, it withdrew its approval of the Data Encryption Standard (DES) because it had been compromised several times.
AES uses 128-bit, 192-bit, or 256-bit keys. It is considered highly secure and, though cryptographers have attempted to break it, no one has succeeded.
Keep in mind that AES is recommended for PHI at rest. For PHI in transit, NIST recommends OpenPGP, S/MIME, or TLS.
HIPAA-compliant communications and working with HITRUST-certified third parties set the standard for protecting and securing patient data. Secure messaging apps, email, and patient portals ensure that the only individuals to gain access to patients’ sensitive data are the intended recipients.
Emerging Cybersecurity Technologies
While AI is inherently challenging, it’s also enhancing the cybersecurity landscape. More healthcare organizations will be using AI and machine learning algorithms to detect threats in real time. By sifting through large amounts of data, it identifies patterns that may indicate a breach, enabling a rapid response. Automated incident responses immediately contain breaches by isolating affected networks, initiating cybersecurity protocols, and notifying security personnel.
Zero-trust architectures vigilantly address access, with every request undergoing intense verification protocols. Users only gain access to the required data and must use multi-factor authentication. Network segmentation further enhances isolation, limiting the damage should a breach occur. All connected devices meet security standards. Real-time monitoring immediately detects suspicious activity.
Staying Hyper-Vigilant On All Things Cybersecurity
The healthcare industry is becoming increasingly connected through medical devices that improve patient care and streamline operations. However, this interconnectivity possesses additional cybersecurity risks.
Staying updated on the changing cybersecurity landscape and addressing the required measures to secure patients’ data and safety is essential. These measures include enabling real-time detection, data encryption, regular software updates, and strong authentication protocols. Employee training on cybersecurity safeguards and internal and third-party audits also play a significant role in protecting those who put their trust in your healthcare organization.
Jodi Miller is a leading revenue strategist and recognized authority in patient access and healthcare communication. With over 15 years specializing in healthcare communications, Jodi has been instrumental in revolutionizing how medical practices and hospitals of all sizes engage with patients. As Senior Vice President of Sales at notifyMD, she champions the development and implementation of HIPAA-compliant and HITRUST-certified patient access solutions that address the complex needs of today’s healthcare providers.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.