Why Cybersecurity is Critical for Modern Health IT Solutions

The rapid advancement and adoption of telehealth, digital scheduling, and clinical communication and collaboration software has redefined care delivery—but it has also widened the attack surface for cyber threats. 

PerfectServe Chief Technology Officer Bob Hackney sums it up well: “The landscape for healthcare right now is just progressively, year over year, getting more intense.” 

In fact, healthcare is now among the most targeted industries for cyberattacks, rivaling the financial sector. 

In 2024, 67% of healthcare organizations worldwide said they experienced ransomware attacks in the past 12 months, which was up significantly from just 34% in 2021.¹ In the US alone, ransomware attacks caused nearly 19 days of downtime for healthcare organizations in 2024.² 

“Ransomware remains the most concerning threat, and attackers often target healthcare organizations due to the critical nature of their services,” Bob said. “It makes [the organizations] more likely to pay ransoms to restore operations quickly.” 

For example, when a trauma team loses access to patient records in the middle of a code blue because of a cyber-attack, cybersecurity resilience immediately becomes a patient safety issue. Unfortunately, real-world incidents like this happen more often than most realize, and downtime for EHRs and other critical systems is a common consequence. 

In 2024 alone, ransomware attacks cost healthcare systems over $14 billion.³ But the real price isn’t measured in dollars, it’s in delayed care, lost trust, and lives on the line. 

That’s why healthcare cybersecurity isn’t just an IT issue—it’s a patient safety issue. 

So how should hospitals prepare for threats without compromising patient safety?

Healthcare Cybersecurity: Understanding Today’s Landscape 

Bob notes that attackers have grown more sophisticated, employing advanced tactics, techniques, and procedures (known as TTPs) to exploit healthcare vulnerabilities. 

“The healthcare sector is particularly vulnerable due to a high volume of communication and the need for quick response.”

Besides ransomware, another common threat is phishing attacks, which are deceptive emails that trick recipients into revealing sensitive information or downloading malice software. 

Hacking is another high-level threat, and the culprits are getting smarter. According to Statistica, in the first half of 2024, “the share of health-related U.S. data breaches caused by hacking was 78 percent, which marked a two percent increase from 2023, reaching its highest rate since 2014.” 

Healthcare Regulatory Compliance: How to Build Resistance 

Ensure HIPAA and HITECH Compliance 

Some of the best ways to protect against growing cybersecurity threats are to maintain full alignment with HIPAA and HITECH, which set the standards for safeguarding patient data and securing electronic health records. That said, Bob emphasizes that the regulatory environment is moving fast—and so are cybersecurity demands.

The rise of AI in healthcare, plus evolving state and federal laws, are reshaping cybersecurity expectations almost monthly. 

AI itself could be used to strengthen cybersecurity in some cases. While it’s not unique to healthcare, many organizations are using AI to improve threat detection, block malicious traffic, send earlier alerts, and isolate compromised devices.⁴ AI can be trained to learn from past cyberattacks to be ready to minimize data breaches in the future.  

No matter what, healthcare organizations have to think beyond baseline compliance to stay protected. The climate has changed far too much for minimal effort to be sufficient. 

A Layered Approach to Defense 

Rather than relying on a single line of defense, Bob stresses the need for a multi-layered security strategy—known as “defense in depth”: 

• Governance, Risk, and Compliance (GRC): Policies, procedures, and communication
• Perimeter Protections: Firewalls, endpoint security, and zero trust
• Asset Security: Managing vulnerabilities in servers and endpoints
• Application Protection: Safeguarding the software itself
• Incident Response: Real-time detection, correlation, and remediation efforts 

Interoperability and Security: Not an Either/Or 

Despite the risks third-party vendors can introduce, modern vendors should maintain a strong commitment to interoperability because it improves patient care, team efficiency, and the optimization of EHR investments. 

“PerfectServe promotes interoperability. We have over 250 healthcare integrations, and because those interfaces are so controlled and monitored, it actually allows us to lean into supporting customers during cybersecurity events.” – Bob Hackney, Chief Technology Officer

Paul Warburton, Senior Market Research Analyst at KLAS Research, says it’s not uncommon for healthcare organizations to view interoperability as a gateway to less secure data, and it’s understandable.

However, taking a stance in favor of integration doesn’t have to mean opening your organization up to an endless barrage of cyberattacks, and these addressable concerns certainly don’t outweigh the benefits of prioritizing both interoperability and cybersecurity. When tackled correctly, strong cybersecurity processes don’t limit interoperability—they make it safer and more resilient. 

Proactive Preparation is Key 

Whether you’re a vendor or a provider organization, preparation is key to building a strong cybersecurity defense. 

For PerfectServe, this looks like tabletop exercises—realistic, scenario-based drills that simulate cyberattacks to strengthen incident response plans across all teams: internal, customer-side, and third-party vendors.

Healthcare Cybersecurity Solutions 

Cybersecurity as a Partnership 

More customers are asking deeper questions about healthcare cybersecurity during sales and RFP processes—and Bob sees that as a positive development.

Vendors should actively engage with customers in regular sessions focused specifically on cybersecurity. At PerfectServe, these conversations are built into ongoing business reviews and support meetings—not just to optimize platform use, but to help strengthen the customer’s overall cybersecurity posture. 

Topics in these meetings might include: 

• Discussing any recent patches, updates, or vulnerabilities and how they’re being addressed
• Reviewing how role-based access controls are configured and enforced
• Outlining or refreshing steps for incident response and downtime preparedness
• Ensuring ongoing alignment with evolving regulatory requirements like HIPAA and HITECH
• Discussing industry threat intelligence and other best practices 

Cybersecurity isn’t just a product feature—it’s a shared responsibility and an extension of care delivery. Carving out recurring time for these conversations helps ensure that both vendors and customers stay ready in a threat landscape that seems to change every day. 

Securing the Future of Healthcare 

The work of protecting healthcare organizations is never done, but as Bob makes clear, collaboration, preparation, and layered approach to defense are how we move forward. 

Bob quote: “We see our value in speed to care, and the closer we can get into how our customers are providing that—in all aspects—is really in our DNA.” 

But companies like PerfectServe can only modernize care team communication and bring physician scheduling into the 21st century if the technology powering that work is secure, resilient, and trustworthy. 

For vendors: Will you be the proactive partner your customers turn to when threats emerge? Or the silent bystander who waits for problems to escalate? 

For healthcare organizations: Are you treating vendor relationships as critical components of your cybersecurity posture? Or waiting to act after the damage is done? 

Healthcare isn’t going backward. And neither are the threats we face. That means every stakeholder has a role to play in building a safer, more connected future. 

Sources:

• 1: Share of healthcare organizations worldwide encountering ransomware attacks from 2021 to 2024, Statistica: https://www.statista.com/statistics/1537987/healthcare-ransomware-encounters-global/
• 2,3: Average downtime caused by ransomware attacks in U.S. healthcare organizations from 2019 to 2023 YTD, by number of days, Statistica: https://www.statista.com/statistics/1422159/us-healthcare-ransomware-attacks-downtime-average-by-days/
• 4: What Is the Role of AI in Cybersecurity? Excelsior University: https://www.excelsior.edu/article/ai-incybersecurity/#:~:text=AI%20enables%20cybersecurity%20software%20to,alerting%20employees%20to%20enhance%20security.