Healthcare remains one of the most attacked sectors, and the end of 2025 offered another reminder that ransomware isn’t letting up. Independent tracking shows 445 ransomware attacks on hospitals, clinics, and other direct‑care providers in 2025, with a pronounced 50% jump in Q4 versus Q3—after a mid‑year lull that tempted some organizations to think the worst was over. The same dataset recorded nearly 200 additional attacks against healthcare‑related businesses like billing providers and medical manufacturers, underscoring how adversaries increasingly compromise vendors to impact care delivery. Healthcare associations observed that most stolen protected health information in recent mega‑breaches was taken from third‑party vendors and business associates, not hospitals’ EHRs—an uncomfortable but critical insight for 2026 planning. [comparitech.com] [aha.org]
The pattern is clear: as providers shore up in‑house systems, attackers exploit interconnections—portals, billing services, integrations—to reach the same data with less resistance. Health‑ISAC’s 2025 sector review similarly called out ransomware and third‑party breaches as the year’s defining risks, noting how crews like LockBit and RansomHub blended double‑extortion with supply‑chain tactics to maximize pressure. That threat geometry is why your program should now treat third‑party risk as a first‑class control domain—on par with endpoint protection and email security. [health-isac.org]
Regulatory momentum is also building. On January 6, 2025, HHS/OCR published a Notice of Proposed Rulemaking to overhaul the HIPAA Security Rule—and as of early 2026, the rulemaking remains on OCR’s regulatory agenda for potential finalization around May 2026. If adopted largely as proposed, the update would remove “addressable” implementation specs, require written documentation of all policies and plans, and compel organizations to maintain a technology asset inventory and a network map illustrating how ePHI moves across systems—reviewed at least annually or after material changes. The compliance timeline (if finalized as proposed) could be tight, with a 240‑day window from publication to effective date, and 180 days thereafter for compliance. [federalregister.gov], [hhs.gov], [alston.com]
What to prioritize now
Third‑party risk management (TPRM). Create a critical‑vendor tier, require contractual incident notification SLAs, least‑privilege connectivity, and quarterly attestations of patching and backup segregation. Many 2025 breaches propagated through business associates; right‑sizing due diligence and continuous monitoring is the most leveraged risk reduction available. [aha.org]
Governance artifacts. Even before the Security Rule update is finalized, start the lift on asset inventories and ePHI data‑flow maps. These are foundational for accurate risk analysis and almost certainly will be scrutinized in future enforcement. [hhs.gov]
Resilience over prevention alone. CISA’s #StopRansomware guidance continues to emphasize immutable, offline backups and regular restore testing to meet real RTOs—because modern crews try to corrupt backups once inside. Rehearse restores for identity, EHR, imaging, and revenue‑cycle apps so downtime is measured in hours, not weeks. [cisa.gov]
Vendor blast‑radius reduction. Enforce network segmentation and conditional access for vendor accounts; log and review privileged actions. Supply‑chain exploitation and vendor credential abuse were common threads in late‑2025 incidents. [aha.org]
What “good” looks like in 2026
- Board‑level visibility into top vendor risks with remediation ownership and timelines. [aha.org]
- A living asset inventory + network map of systems affecting ePHI, revisited after M&A, EHR upgrades, or cloud migrations. [hhs.gov]
- Quarterly restore drills for clinical and back‑office systems, documented RTO/RPO performance, and immutable copy verification. [cisa.gov]
How we help
Our healthcare‑focused Managed Security, vCISO, and BCDR programs combine vendor risk scoring, HIPAA‑aligned asset inventories, and recurring restore rehearsals. We’ll help you reduce exposure now and be ready if/when the Security Rule update lands. [hhs.gov], [alston.com]
