Topic starter
18/08/2026 2:42 pm
TL;DR: Healthcare now generates 30% of the world’s data, according to Probely, while hacking-related breaches in the sector rose 239% and ransomware attacks rose 278% between January 2018 and September 2023, according to Snyk’s analysis. The core lesson is that HealthTech security fails when development, monitoring, and staff readiness are treated as one-time tasks instead of continuous controls.
Editorial analysis by NHI Mgmt Group, based on content published by Probely: “From Innovation to Protection: Ensuring Data Security in Healthcare”.
By the numbers:
- The healthcare industry rapidly expands its technology stack, generating 30% of the world’s data volume.
- Between January 2018 and September 2023, hacking-related data breaches in healthcare increased by 239%.
- Ransomware attacks in healthcare increased by 278% between January 2018 and September 2023.
Key questions
Q: How should healthcare organisations implement continuous security in HealthTech systems?
A: They should build controls into the development and operating model, not bolt them on later.
Q: Why do annual security reviews fail in fast-changing healthcare environments?
A: Annual reviews assume the system stays stable long enough for findings to remain valid.
A: Common warning signs include teams relying on undocumented workarounds, inconsistent training, unclear ownership of new processes, and repeated friction when staff adopt new tools or workflows.
Practitioner guidance
- Embed security gates into delivery pipelines Add automated checks for misconfiguration, insecure dependencies, and exposed interfaces at build and deploy time so risky changes do not reach production unnoticed.
- Run continuous risk assessments on high-value systems Prioritise applications and data flows that process patient information, then reassess them whenever integrations, permissions, or usage patterns change.
- Operationalise real-time monitoring for healthcare workloads Instrument application, identity, and data-access telemetry so anomalous activity can be detected and triaged before it affects care delivery.
Bottom line: Healthcare data security fails when organisations rely on annual assurance in an environment that changes continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
Continuous control is now the correct security baseline for healthcare data. Annual reviews assume a predictable environment, but healthcare stacks change through new applications, telemedicine channels, wearables, AI workflows, and third-party integrations. That makes static assurance stale almost immediately. Practitioners should design for continuous validation of access, configuration, and exposure rather than periodic reassurance.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
A: Use security by design so controls are part of delivery rather than a late-stage blocker. That means automating checks, standardising assessment criteria, and making release readiness depend on evidence from testing and monitoring. The trade-off is not speed versus security, but unmanaged change versus controlled change.
👉 Read our full editorial: Healthcare data security needs continuous controls, not annual reviews