Healthcare leaders see a fatal cyber incident as inevitable

Healthcare practices run on a chain of outside vendors. An EMR system holds clinical records, a billing platform processes claims, a telehealth tool supports remote visits, and a cloud provider stores data. Every one of those connections gives an outside company a path into the practice, and any one of them can break.

That is what happened across the sector over the past year. According to Omega Systems’ 2026 Healthcare IT Landscape Report, the large majority of practices dealt with at least one operational disruption that traced back to a vendor or a vendor’s own supplier. The disruptions ranged from brief outages to repeated failures that froze patient intake and slowed cash flow.

Confidence runs ahead of visibility

Most leaders said they trust their vendors’ security. At the same time, a majority admitted they do not continuously monitor their networks or the digital supply chains feeding into them. That combination leaves practices feeling secure about connections they cannot see. Attackers understand the dynamic and target vendors precisely because their healthcare clients tend to extend trust and skip verification.

Recovery readiness lags the threat

Leaders increasingly believe the danger is serious. A growing share now expect a cyberattack to cause a fatal patient incident at a U.S. healthcare facility within five years, up from the year before. Their preparation has moved more slowly. Only a small minority described themselves as well prepared to recover from an attack, and the rest acknowledged gaps.

Those gaps become concrete the moment an EMR goes down. Practices report that billing and scheduling would stop, access to patient histories and medication lists would vanish, and some would consider temporary or permanent closure. Many rely on aging systems, lack regular incident response training, and have no independent way to restore service if a vendor stays offline.

A leadership question

The report points to a root cause that sits above any single tool. A majority of leaders said their organizations treat cybersecurity as a technical expense, and that view filters down into staffing and spending. Teams describe themselves as understaffed and underfunded. Many practices operate with no managed security partner, run legacy software, skip vulnerability assessments, and forgo basic controls.

Chris Knotts, CEO of PEAKE Technology Partners, an Omega Systems company, said the practices that close the gap between confidence and readiness share one trait. They have “moved security out of the IT department and into a regular leadership conversation.” His own survey work found that 67% of healthcare leaders say they prioritize cybersecurity in executive-level decision-making, with nearly 1 in 5 still lacking a current or effective incident response plan and almost a quarter acknowledging that detecting and containing a breach could take up to a month. The confidence is there, and the operational infrastructure often trails it.

What changes the picture, Knotts told Help Net Security, is a shift in how leadership engages. The practices getting this right hold structured, at least semi-annual reviews of their security posture and turn the findings into a prioritized action plan. They ask harder questions of their IT provider about readiness for the updated HIPAA Security Rule, the last time they tested incident response, and how long a breach would take to detect. “The speed and specificity of those answers tells you a lot,” he said.

He also pointed to something harder to measure. “Physician anxiety around cyber risk is real,” Knotts said, and practice owners who have lived through an incident carry a level of concern that formal planning rarely captures. Stronger practices tend to have a trusted partner who puts that risk in plain language and ties it to what leadership cares about most: keeping the practice operational, protecting patients, and staying on the right side of compliance. “That translation layer matters enormously,” he said.

Compliance deadlines tighten

Compliance follows the same logic as budgeting. Six in ten leaders said they signed off on HIPAA attestations knowing their own risk assessments had flagged unresolved problems. For many, the calculation was practical: limited budgets, stretched staff, and a prior framework loose enough to make deferral feel manageable. The proposed 2026 HIPAA Security Rule removes that flexibility. The new requirements are specific and time-bound, covering written recovery procedures, regular vulnerability scans, multi-factor authentication, and yearly verification of business associates. Only about a quarter of practices described themselves as ready for them.

AI arrives faster than the safeguards

AI has become common across the sector, with nearly all practices using it for tasks like scheduling, patient communication, and clinical documentation. Leaders see real money in it, estimating that even modest gains in patient volume from AI-assisted scheduling could add thousands of dollars in monthly revenue.

Knotts said the most consistent gains come from what already sits inside the EMR. He estimates that “roughly 80% of what a practice is trying to accomplish with AI can and should happen within the practice management and EMR platform,” through embedded clinical prompts, documentation assistance, and billing support. The throughput math drives the case. “If optimizing a workflow allows a provider to see one additional patient per day, that can translate to a 10% or greater impact on revenue,” depending on specialty and procedure mix.

One example he cited is the after-hours EMR problem. Physicians extending their workday into evenings to finish documentation “is now being treated as a solvable operational problem,” with AI-assisted note generation targeting that time drain. At least one practice he is aware of made eliminating after-hours EMR work a formal 2026 operational goal. Implementations fall short when practices chase individual features and pick tools in isolation. The healthcare AI marketplace holds thousands of options, and Knotts said the practices seeing consistent results rely on a partner who can filter that landscape by specialty, patient volume, and existing systems.

Where practices go next

A share plan to bring in a managed security provider over the coming year, a sign the model is starting to change. The practices closing their gaps treat security, compliance, vendor risk, and AI as a single managed program with one party accountable for the whole picture, supported by continuous monitoring and outside expertise. The ones still managing these problems reactively remain the most exposed to the threats the report documents.

CIS: Secure healthcare with trusted standards, mapped to HIPAA