Healthcare Cyberattacks Now Threaten Patient Care

For years, healthcare security leaders have been told a cyberattack is a financial event. The newest research says it is a clinical one. In the 2026 study from Proofpoint and the Ponemon Institute, 97 percent of surveyed healthcare organizations were hit by at least one cyberattack in the past 12 months, and 74 percent of those reported disruption to patient care.

Average attack volume climbed to 51 per organization, up from 43 the year before. The cost of the single most expensive attack rose nearly 8 percent, from $3.9 million to $4.2 million. Those are survey responses from 705 IT and security practitioners at U.S. healthcare organizations, so they describe a signal, not a census. They are still the clearest signal the sector has had on how attacks translate into delayed procedures, longer stays, and complications.

Here is the whole argument. Every one of those attacks ends in the same place for a CISO or a privacy officer. A regulator, an auditor, or a plaintiff’s lawyer asks you to prove what happened to protected health information and who touched it. Detection matters. Evidence decides the outcome. Kiteworks secure data exchange exists for that second problem, and the sections below explain why the second problem is the one most organizations are least ready for.

Key Takeaways

1. Attacks are now a patient care problem.

Of the healthcare organizations hit in the past year, nearly three in four reported disruption to patient care, which moves the conversation from budget exposure to clinical exposure.

2. Two cost datasets can both be right.

One measures the average cost of a breach and the other measures the cost of an organization’s single worst attack, so a falling average can sit beside a rising ceiling.

3. Supply chain attacks hurt most.

Nine in ten affected organizations reported care disruption from supply chain attacks, which means third-party data exchange belongs on the clinical risk register.

4. HIPAA does not wait for the final rule.

The proposed Security Rule overhaul is still a proposal, but unique user identification, audit controls, and breach notification already apply today.

5. Proof beats posture.

Half of surveyed organizations in one 2026 survey cannot produce a complete AI data access record within one business day, so the evidence gap is where the next finding will come from.

What the 2026 Study Found

The headline numbers deserve a slower read than most coverage gave them. Start with the care impact, because it changed the story. Among organizations reporting disruption across the four attack types studied (cloud and account compromise, ransomware, supply chain, and business email compromise), 53 percent cited more complications from procedures, 52 percent cited longer patient stays, and 52 percent cited delays in tests or procedures.

That is a different kind of loss. A clinic can budget for a $4.2 million incident. It cannot budget for a delayed test.

The cost structure points the same way. Operational disruption was the largest category at an average of $1.39 million, and idle time and lost productivity averaged $1.05 million. Ransom payments are shrinking as a share of the pain. Among ransomware victims, 31 percent paid, down from 33 percent, and the average costliest payment fell from $1.2 million to $1.1 million. Organizations are paying attackers less and paying for downtime more.

Data loss adds a layer that is easy to miss. Organizations averaged 21 data loss or exfiltration incidents involving sensitive healthcare information over two years. Of the respondents who said those incidents disrupted patient care (54 percent), 56 percent reported increased mortality rates. These are self-reported perceptions from practitioners, not clinical outcome data, so hold them loosely. Still, it is striking that security professionals are writing them down at all.

Employee negligence was the leading reported cause of data loss. Ordinary failure outruns the dramatic kind here, as it does in most sectors.

Two Datasets That Look Like They Disagree

Here is where the contrarian read starts. IBM’s 2026 Cost of a Data Breach Report found healthcare was still the costliest industry for breaches at $6.64 million, but that figure fell 10.5 percent from $7.42 million in 2025, according to Becker’s Hospital Review.

A falling average beside a rising worst case sounds like a contradiction. It is a measurement difference. IBM, working with the Ponemon Institute, studies organizations that suffered a breach and averages the cost across them. The Proofpoint and Ponemon study asks each organization for the cost of its single most expensive attack, then adds frequency, operational disruption, and patient outcomes. One instrument describes the middle of the distribution. The other describes the tail, and the tail is where hospital boards live.

So do not let anyone tell you that costs are falling and the problem is easing. Do not let anyone tell you the opposite on the strength of one survey either. The honest summary is narrower and more useful. Healthcare is expensive to breach in both datasets, and the second dataset shows the harm is migrating from the ledger to the bedside.

That matters for how you brief a board. A board that hears “average breach cost fell” will relax. A board that hears “our worst day is getting worse, and it now touches patient care” will ask for controls. The second statement is the accurate one for a security program, because your exposure is set by your worst day, not by the industry average.

Supply Chain, Ransomware, and Email Attacks Reach the Ward

Not every attack type reaches patients with equal force. Supply chain attacks had the greatest impact in the Proofpoint and Ponemon data. Ninety percent of affected organizations reported care disruption, up from 87 percent in 2025. That is the single most concentrated finding in the study.

It also lines up with what outside researchers see in the wider market. Black Kite’s 2026 Third-Party Breach Report counted 136 verified third-party breach events in 2025 and a median public disclosure lag of 73 days. A vendor can be compromised for ten weeks before you hear a word, and during that window your patients’ records move through a partner you do not control.

Ransomware attacks show the care link most directly. Among healthcare organizations that experienced ransomware, 72 percent reported patient care disruption, up from 67 percent the previous year, and 70 percent of those cited longer patient stays. Business email compromise carries a different clinical signature. Of the organizations reporting disruption, 68 percent tied it to delayed procedures and tests that led to poor outcomes.

Cloud adoption complicates all three. The study found 35 percent of organizations have moved clinical applications to the cloud, up from 30 percent, and another 44 percent plan to within two years. Cloud and account compromises averaged up to 20 per organization and disrupted care for 65 percent of respondents.

Read those four findings together and the structure shows. Ransomware, email compromise, and cloud account takeover are different entry points into the same place, which is sensitive data exchanged between your organization and someone else. If you cannot see and control that exchange across email, file sharing, transfer, forms, and APIs from one place, you are defending four perimeters with four sets of logs. A single policy engine and a single audit log, which is what Kiteworks secure data exchange provides across those channels, shrink the number of places an evidence request can go wrong.

Why Evidence Matters More Than Detection

Consider what happens after an attack hits a regional health system. The security team contains it. Clinical operations recover. Then the other clock starts. HIPAA’s breach notification requirements set an outer limit of 60 days from discovery for individual notice, and a regulator’s questions arrive on their own schedule.

This is the part of the job that never makes the incident dashboard. The question is not whether you found the intrusion. The question is whether you can reconstruct, from records you trust, which patients’ data was reachable, who accessed it, and whether controls worked as documented.

It helps to be exact about what is law today. The HIPAA Security Rule already requires unique user identification and audit controls, and treats encryption of electronic protected health information as an addressable specification, according to the text of 45 CFR 164.312. The sweeping overhaul that would tighten those requirements was proposed in a notice of proposed rulemaking published in January 2025, and it has not been finalized. The OMB regulatory agenda now lists a final rule for July 2027, according to The HIPAA Journal.

Some organizations read that delay as a reprieve. It is not. Current obligations already ask you to prove access control and audit capability, and enforcement is happening under the current rule. The HIPAA Journal reports that OCR imposed a $450,000 penalty on a company in 2026 for failure to conduct a proper risk analysis, which tells you the regulator is looking at the basics.

Regulators regulate data, not models, and not mood. HIPAA does not care whether a human or an automated tool read the record. It asks whether access was authorized, logged, and defensible.

The AI Layer Most Programs Have Not Governed

The Proofpoint and Ponemon study adds a finding that belongs in every healthcare CISO’s next board deck. Among respondents, 45 percent have embedded AI in cybersecurity or in both cybersecurity and patient care, and 60 percent lack controls for sensitive data used in AI systems. Only 32 percent report full visibility into employees’ use of unsanctioned AI tools, and AI agents operating without guardrails were named as a leading cause of data loss by 24 percent.

Put plainly, the sector is adopting AI faster than it is governing the data AI touches. In healthcare that data is PHI, which raises the stakes, but the gap is the same one showing up everywhere. The Kiteworks research points the same way, as the next section shows.

The governance principle is simple to state and hard to implement. An AI tool or agent that reaches patient data must be bound to a human’s authority, scoped to the minimum necessary data, and logged in a record that survives an audit. The HIPAA Minimum Necessary Rule applies to the data, not to who or what is asking. A shared service account sitting between an AI tool and a record store can be hard to square with unique user identification, because the log shows the account and not the person whose authority was used.

This is where Kiteworks Compliant AI and the Secure MCP Server fit. They apply the same RBAC and ABAC policies and the same audit logging that govern human access, so an AI integration reads patient data inside the same guardrails and leaves the same evidence. Kiteworks was not part of the Proofpoint and Ponemon study, and nothing here is a claim that any platform would have prevented the attacks it measured.

What the Kiteworks Survey Says About Proving It

The sharpest evidence for the evidence gap comes from a different instrument. Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report surveyed 459 security, compliance, and technology professionals across industries in the second quarter of 2026. It is self-reported, global, and not specific to healthcare. Within it, 63 percent of organizations experienced at least one compliance consequence in the past 12 months, such as an audit finding, a remediation plan, a board escalation, a contractual penalty, or a regulatory investigation.

The audit-readiness figures are the ones that should keep a privacy officer up at night. Half of organizations cannot produce a complete AI data access audit record within one business day, and 67 percent lack tamper-evident audit trails. Tamper-evident trails are what an investigator examines to confirm that records were not altered after the fact. An audit trail that cannot prove its own integrity is a diary, not evidence.

The healthcare slice of the survey is small, about 8 percent of respondents, so treat it as directional. It is still interesting. Healthcare organizations scored above the survey mean on security controls, with a mean Data Security Maturity Score of 42.3 against 39 overall. The sector’s dominant profile was what the report calls Fortified, at 1.84 times its expected rate. That profile means strong security infrastructure that has not yet been extended into AI-specific governance.

Money does not close that gap. In the 2026 Annual Survey Report, the 54 percent of respondents who devote a quarter or more of their IT budget to cybersecurity averaged a maturity score of 39.7, statistically indistinguishable from the 39.2 average for everyone. Spend followed intent. Controls followed architecture.

That is the thread connecting the two studies. The attacks in the Proofpoint and Ponemon data are the cost of exposure. The audit gaps in the Kiteworks data are the cost of being unable to prove what happened afterward. Healthcare organizations pay both bills, and only one of them shows up in a vendor’s headline.

What to Do Before the Next Audit Request

Stop asking whether your organization could survive an attack. Ask a harder question. If OCR or a plaintiff asked for the access record for one patient’s data across every channel by Friday, who would produce it, and how long would it take?

Here is the work, in the order I would do it.

Start with the channels. Map every path through which PHI leaves or enters the organization, including secure email, file sharing, managed file transfer, web forms, APIs, and AI tools. The Kiteworks survey found 54 percent of organizations use four or more platforms for sensitive data exchange, and 73 percent have no technical enforcement of which channels employees can use. Every extra platform is a separate log, a separate policy, and a separate gap. A tool like DSPM for healthcare helps with discovery, but discovery is not enforcement.

Then consolidate evidence. Feed one consolidated record of audit logs into your SIEM in real time, and test whether an investigator could trust it. The question is not whether you log. The question is whether the log is complete, tamper-evident, and attributable to a named person.

After that, rewrite the third-party playbook. A 90 percent care-disruption rate for supply chain attacks means vendor data exchange is a clinical risk, not a procurement footnote. Require partners to exchange PHI through channels you govern, apply zero trust data protection principles to what they can see, and rehearse your incident response plan with those vendors in the room, not just in a document.

Finally, put AI on the same footing as people. Bind AI tools to authorized users and minimum necessary data, log what they touch, and test your ability to cut them off. Organizations that ask for this evidence before an auditor does are the ones that have it when it counts. Kiteworks offers a Business Associate Agreement and HIPAA-aligned audit trails for healthcare organizations that exchange PHI, and its double encryption at rest, single-tenant architecture, and consolidated audit log are built for the evidence problem described above.

None of this requires waiting for a final rule. It requires deciding that proof is a design requirement, not a scramble.

To learn more about producing audit-ready evidence for PHI exchange under HIPAA, schedule a custom demo today.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video Microsoft GCC High: Disadvantages Driving Defense Contractors Toward Smarter Advantages
• Blog Post How to Secure Classified Data Once DSPM Flags It
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video The Definitive Guide to Secure Sensitive Data Storage for IT Leaders