By Sabina Kotelnik

Personal health information (PHI) is among the most sensitive data an organization can hold. Details about preexisting medical conditions, treatment plans, payment information, and other data points that can identify individuals are critical for healthcare organizations to effectively administer services. But those qualities also make PHI a high-value target for threat actors and a risk for organizations that fail to properly secure it.

As one of the most targeted sectors for ransomware and data breaches, healthcare organizations must be aware of the data privacy and governance risks they face, as well as how artificial intelligence is compounding those risks.

Cybersecurity and PHI Protection Remain a Top Priority

According to the FBI’s 2025 Internet Crime Report, healthcare ranks as the most targeted sector for ransomware and third most targeted for data breaches. The consequences of a data breach or ransomware attack are immense, with the potential to cause financial damage to healthcare institutions and patients alike. Additionally, the consequences of these events can cause patient safety risks by preventing providers from administering care because of delayed access to information and disabled equipment.

Regulators Are Increasingly Going Beyond Policy

Written policies and incident response plans alone were once enough to satisfy regulators that an organization was prepared for a cyber incident — but those days are gone. Healthcare regulators and enforcement agencies increasingly expect organizations to demonstrate operational preparedness through activities such as tabletop exercises, network segmentation, access-permission discipline, and rapid detection and isolation capability.

Demonstrating resilience and response capabilities is increasingly important in mitigating cybersecurity and privacy incidents. Cybercriminals can lurk inside a system for weeks or even months before acting, making early detection essential to reducing the damage incurred.

Third-Party Risk Continues To Be a Focus

Outsourcing a function does not outsource its risk. Healthcare organizations must conduct proper due diligence when contracting with third-party vendors to verify compliance with privacy regulations and best practices. Privacy issues resulting from third-party vendors ultimately fall back on the healthcare organization, making due diligence an ongoing process rather than a one-time exercise approach to risk.

AI Risks Are Evolving Rapidly

Like so many other industries, healthcare is leveraging AI’s potential to deliver enhanced patient care and operational capabilities. But, AI tools require data, which for healthcare organizations often means personal information. To safeguard data and meet regulatory standards, organizations must establish effective controls rooted in transparency and explainability, meaning they understand what data AI has access to and how it’s making decisions using that information. Furthermore, healthcare organizations need to verify that a purpose of use exists for the data.

Designing Processes With Privacy in Mind

Privacy and security should be embedded into healthcare technology, services, and products from their inception rather than being added after the fact. By taking a proactive approach, healthcare organizations can establish actions that prepare employees to handle privacy rather than simply focusing on missteps to avoid.

Balancing Functionality and Privacy

Integrated healthcare platforms can provide patients with greater convenience and care options, allowing their information to move among different providers. That convenience isn’t without risk. When personal information moves across a range of networks, providers, and systems, access controls can become challenging. Healthcare organizations must balance the benefits patients receive through shareable information with privacy considerations and compliance obligations. As new platforms and technology break down silos that once restricted data movement, real-time monitoring and enhanced visibility into who can access personal data have become a significant priority.

The Need for Training Is as Important as Ever

Privacy and security incidents aren’t just caused by external cyberthreats and system control issues. Inappropriate and unauthorized access, whether intentional or not, by those within healthcare organizations presents risks as well. Organizations should focus on continuous employee training while monitoring emerging technology and tools they may need to integrate into those sessions. Organizations also need to be aware that enforcement bodies are using the same advanced analytics tools as the industries they monitor, enabling enhanced audits and anomaly detection.

The regulatory landscape is evolving to keep pace with these advances placing a spotlight on the healthcare industry’s compliance with new privacy, security, and AI-related regulatory requirements.

Sabina Kotelnik, Assurance Principal, BDO, can be reached at (954) 989-7462 or skotelnik@bdo.com.

 Contact:    

Angelo Pirozzi, Managing Director, The BDO Center for Healthcare Excellence & Innovation    

(561) 909-2100 / apirozzi@bdo.com    

 Sabina Kotelnik, Assurance Principal    

(954) 989-7462 / skotelnik@bdo.com