Notifications
Clear all
Topic starter
12/07/2026 12:17 pm
TL;DR: Healthcare accounts for 24.2% of all data breaches globally in SecurityScorecard’s 2025 Global Third-Party Breach Report, while healthcare-specific third-party relationships account for 15.75% of all third-party breach incidents, underscoring how vendor exposure, medical devices, and ransomware now affect patient safety as well as compliance. The operational question is no longer whether to secure healthcare systems, but how to govern ecosystem access, downtime tolerance, and incident response across the full care chain.
NHIMG editorial — based on content published by SecurityScorecard: cybersecurity in healthcare, third-party risk, and patient safety
By the numbers:
- Healthcare organizations face 24.2% of all data breaches globally, according to SecurityScorecard’s 2025 SecurityScorecard Global Third-Party Breach Report.
- Healthcare-specific relationships account for 15.75% of all third-party breach incidents, according to SecurityScorecard’s analysis of third-party breaches.
Questions worth separating out
Q: What breaks when healthcare vendors keep access after the business need changes?
A: Access drift creates hidden entry points into protected health information, clinical systems, and administrative platforms.
Q: Why do third-party relationships make healthcare cybersecurity harder to govern?
A: Because every vendor may bring its own users, service accounts, APIs, and support channels into the environment.
Q: What do security teams get wrong about protecting connected medical devices?
A: They often focus on patching while leaving device access too broad.
Practitioner guidance
- Map third-party accounts to business owners Maintain a live inventory of every vendor account, remote support path, and shared integration touching protected health information.
- Segment medical devices by access class Separate connected devices into tightly defined network zones and limit them to the minimum systems they must reach.
- Use break-glass access instead of standing privilege Design emergency access paths that activate only for clinical continuity events and log every use for post-incident review.
What's in the full article
SecurityScorecard's full article covers the operational detail this post intentionally leaves for the source:
- Third-party breach breakdowns by healthcare sub-sector, including pharmaceutical distribution, clinical trial support, and healthcare software services.
- The article's discussion of medical device vulnerabilities, default passwords, and network segmentation trade-offs in clinical environments.
- Incident response considerations for patient safety, including coordination with administrators, IT teams, and regulatory bodies.
- The compliance framing around HIPAA, GDPR, and sector guidance for healthcare data protection.
Healthcare cybersecurity risk, third-party exposure, and patient safety?
Explore further
12/07/2026 12:30 pm
Third-party access is the dominant governance fault line in healthcare cybersecurity. The article correctly frames vendors as part of the attack surface, but the deeper issue is lifecycle control over external identities. Healthcare teams often know who the vendor is, but not which accounts remain active, which privileges are still necessary, or how quickly access is removed after a contract changes. That turns vendor management into a standing exposure problem, not a periodic review exercise. Practitioners should treat every third-party credential as a governed identity with an owner, expiry, and audit trail.
A question worth separating out:
Q: How should healthcare organisations respond when a cyber incident affects clinical operations?
A: They should contain the attack without losing sight of patient safety. That means preserving essential monitoring, isolating affected systems in a controlled way, coordinating with clinical staff, and activating third parties or regulators only through a predefined playbook. The response plan must assume care continuity is non-negotiable.
👉 Read our full editorial: Healthcare cybersecurity is now patient safety and third-party risk
