Notifications
Clear all
Topic starter
18/08/2026 3:00 pm
TL;DR: Healthcare security failures are being amplified by cloud, device, and application sprawl, with OCR reporting a 239% increase in hacking-related data breaches in 2023 and average breach costs reaching $10.93 million, according to Probely’s analysis. The governance problem is no longer whether controls exist, but whether they are embedded early enough to protect patient data across the full delivery stack.
NHIMG editorial — based on content published by Probely: Protecting the Heart of Healthcare: Cybersecurity Strategies and Solutions
By the numbers:
- The Office of Civil Rights reported a 239% increase in 2023 in hacking-related data breaches in healthcare.
- The average cost of a healthcare data breach is $10.93 million.
Questions worth separating out
Q: How should healthcare teams secure APIs that connect EHRs, cloud services, and devices?
A: Treat each API as a trust boundary that needs authentication, authorisation, input validation, and continuous testing.
Q: Why do cloud and device controls need to be governed together in healthcare?
A: Because attackers often move through the weakest connected component, not the most obvious one.
Q: How do organisations know if shift-left security is actually working?
A: Look for fewer defects escaping into later stages, faster remediation of findings, and fewer manual exceptions during release.
Practitioner guidance
- Map patient-data access paths across systems Document how EHRs, telemedicine platforms, cloud storage, and connected devices exchange data, then assign owners and approval points for each access path.
- Gate releases on security test results Make static analysis, dynamic application testing, and API testing mandatory release criteria in CI/CD for healthcare applications.
- Harden cloud and device access controls Apply encryption, least privilege, continuous monitoring, and firmware update discipline to cloud workloads and connected devices that handle patient data.
What's in the full article
Probely's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames healthcare-specific application and API security testing in more operational terms.
- The article's product-oriented discussion of security tool quality, including how it positions false positive reduction for developer workflows.
- The source's broader treatment of cloud, device, and SDLC controls in the healthcare environment.
- The vendor's own explanation of how its platform is presented for healthcare security programmes.
👉 Read Probely's analysis of healthcare cybersecurity strategies and solutions →
Healthcare cybersecurity: are your API and cloud controls keeping up?
Explore further
18/08/2026 3:40 pm
Healthcare cybersecurity is now an identity governance problem as much as a tooling problem. The article describes cloud, device, application, and AI exposure as separate challenges, but the common failure mode is unauthorised access to sensitive systems and data. That makes access control, service-account governance, and API authorisation central to the security model, not secondary controls. Practitioners should treat healthcare security as a governed identity and workload problem across the delivery stack.
A question worth separating out:
Q: Who is accountable when HIPAA access controls fail?
A: Accountability usually sits with the covered entity or business associate that allowed the access path to persist, even if multiple teams were involved operationally. HIPAA expects organisations to define responsibility, document controls, and show that protective steps were actually implemented. Shared access does not equal shared accountability.
👉 Read our full editorial: Healthcare security depends on API testing and shift-left controls
