Hospitals hold large volumes of sensitive patient data and run clinical systems that cannot simply pause while staff investigate. That combination makes hospitals a frequent target for attackers. The most useful response is a prioritized set of controls rather than a long checklist. The seven defenses below group safeguards backed by HHS guidance into a sensible starting order: find weaknesses first, reduce how attackers get in, limit what they can reach, and make sure you can recover. Your own risk analysis should set final priorities, because systems, suppliers, device fleets and recovery needs differ from one hospital to the next. HHS presents its cybersecurity performance goals as voluntary practices that help hospitals prioritize controls and improve preparedness and patient protection. They are not a guarantee against attack.
What an attack does to patient care
A cyberattack on a hospital is first a patient-care problem and only second an IT problem. When the electronic health record, order entry, pharmacy, laboratory, imaging or scheduling systems become unavailable or untrustworthy, clinicians lose the information they use for routine decisions: medication lists, allergy alerts, recent results and the notes that tell the next shift what has happened. Delays in those workflows can ripple into treatment timing, transfers and discharges.
As an Amazon Associate I earn from qualifying purchases.
Network-connected medical devices add a second layer. HHS includes attacks against them among the threats facing the health sector. A compromised device, or one cut off from the systems it reports to, can change how a clinical team gets the data it depends on. Hospitals that have rehearsed downtime procedures, such as paper orders and manual medication checks, are better positioned to keep care safe while systems are down. Those that have not rehearsed them end up improvising under pressure.
Free tools Windows power users keep installed
One-click scans. No signup required.
HHS Deputy Secretary Andrea Palm described the stakes in December 2024, when HHS proposed updates to the HIPAA Security Rule: “The increasing frequency and sophistication of cyberattacks in the health care sector pose a direct and significant threat to patient safety.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why hospital data draws attackers
The headline’s “prime target” framing is best read as a description of exposure, not a measured ranking. HHS identifies several recurring threats to the health sector, but its guidance does not rank hospitals against other industries as targets. What the sources support is a list of threats and a set of trends in breach reporting.
Threats HHS names
HHS’s Health Industry Cybersecurity Practices (HICP), 2023 Edition names these healthcare-sector threats:
- Social engineering, including phishing and fraud
- Ransomware
- Loss or theft of equipment or data
- Insider or accidental data loss
- Attacks against network-connected medical devices
Breach trends in HHS data
The following figures come from the Office for Civil Rights section of HHS’s 2024 proposed-rule page. They describe large breaches as HHS counts them across the entities it regulates, not hospitals alone. The trend figures compare 2018 with 2023, and the 2023 count is a single year. They do not describe 2024 through 2026.
- Reports of large breaches rose 102 percent from 2018 to 2023.
- The number of individuals affected rose 1,002 percent over the same period.
- More than 167 million individuals were affected by large breaches in 2023.
The seven defenses
Each defense pairs an HHS-backed practice with a plain explanation and an illustrative scenario. The scenarios are examples to adapt to your own environment, not reports of specific incidents.
1. Find and fix exposed weaknesses
You cannot protect systems you have not counted. Start with asset visibility: a current inventory of servers, workstations, medical devices, network equipment and cloud services, including systems that departments bought or vendors added. Scan systems and web applications, rank known vulnerabilities by how exposed and clinically important the affected system is, and reduce internet-facing services that do not need to be public. HHS lists mitigation of known vulnerabilities as an essential goal and asset inventory as an enhanced goal, as set out in its performance goals.
Illustrative scenario: An external scan finds a remote-support portal for an imaging vendor on a public address, running a web component with a known flaw. The fix sequence is to confirm the inventory entry, patch or disable the component, and restrict the portal to the vendor’s approved addresses behind multifactor sign-in.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Harden email and reduce phishing
Social engineering often arrives by email: a fake invoice, a spoofed message that appears to come from an executive, or a link that harvests credentials. HHS’s performance goals name email spoofing, phishing and fraud. Address them with three layers working together: technical email controls that filter and authenticate messages, multifactor protection on every email account, and a staff habit of verifying unusual requests through a channel that is already on record.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Education matters, but a single annual video is unlikely to be enough on its own. Training works better when it is repeated, short and tied to the messages people actually receive. The HICP 2023 Edition identifies social engineering as a core threat, which is why the control needs more than one layer.
Illustrative scenario: A billing office receives an email that appears to come from a known supplier, asking it to change the bank details on file. The rule is that any change requires a call to a number already in the vendor master file, never a number in the email.
3. Use multifactor authentication where it is safe and technically feasible
Multifactor authentication (MFA) adds a second proof of identity on top of a password. HHS describes it as an additional layer for internet-accessible assets and accounts, and its performance goals reference phishing-resistant MFA, which is designed to resist sign-in attacks that trick users into handing over a one-time code. Apply it first to remote access, email, administrative accounts and any internet-accessible system.
The technical-capability qualifier matters. Some legacy systems and clinical devices cannot support MFA, and forcing it onto a device that cannot accept it can disrupt care. Where MFA is not technically possible, document the gap and use compensating controls selected through risk analysis. An authenticator app or token is one part of identity protection, not a complete security solution.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Illustrative scenario: Vendor engineers reach a device through a remote-access gateway. The gateway requires MFA, sessions expire, and access is logged. The device itself cannot run MFA, so it is reachable only from the gateway’s network segment rather than by password alone.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Train staff for their actual roles
HHS recommends training users to detect and report malicious software, and its ransomware guidance focuses on that skill. The performance goals also include basic cybersecurity training. The most useful training uses situations staff actually face: a billing message that asks for an urgent payment change, a vendor requesting remote access, a lost badge or laptop, or a suspicious USB drive found in a clinical area.
Clear reporting paths matter as much as recognition. Staff should know whom to call at any hour when something looks wrong, and reporting should be easy enough that people report a mistake quickly rather than hiding it.
Illustrative scenario: A nurse finds an unlabeled USB drive in a medication room. The script is simple: do not plug it in, note the location, and report it through the security hotline.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute5. Protect data with encryption and access controls
Encryption and access control work at different points. Encryption makes stored or transmitted data unreadable to anyone without the key, and HHS lists strong encryption as an essential goal. Access control limits who and what can reach electronic protected health information (ePHI) in the first place. HHS recommends limiting ePHI access to users or programs that need it. Together they reduce what a stolen device or compromised account can expose.
Encryption is not a universal shield. HHS notes that whether PHI is rendered unreadable to unauthorized people depends on the circumstances of implementation, as described in its ransomware and HIPAA fact sheet. Data encrypted at rest does not stop an attacker who signs in with valid credentials, and keys stored beside the data offer little protection. Treat encryption as one control among several.
Illustrative scenario: A laptop used for clinic visits is stolen from a car. If its disk was encrypted and the device was locked, the thief cannot read the data, and that fact is the first question in any breach assessment. If the laptop was unencrypted, the assessment is considerably harder to resolve.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Keep backups that can actually be restored
Backups are useful only if they can be restored within a time your clinical services can tolerate. HHS recommends frequent backups, periodic restoration tests, and consideration of offline backups that are unavailable from the network, because some ransomware disrupts online backups. A backup on a network share that ransomware can reach may be encrypted along with everything else.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOffline copies are a recovery option, not a shortcut. A consumer external drive can hold an offline copy in a small setting, but it does not meet HIPAA requirements on its own and does not provide hospital-grade resilience. Hospital architecture should define how many copies exist, where they sit, who can access them, how they are encrypted, and how quickly each critical application can be restored.
Illustrative scenario: A restoration test loads last night’s copy of a scheduling database into an isolated test environment, records how long the restore takes, and checks whether the data is complete. The test repeats on a set schedule, and the results feed the recovery plan.
7. Rehearse incident response and continuity
HHS’s guidance calls for procedures to detect, analyze, contain, eradicate, recover and learn after ransomware, as described in the ransomware fact sheet. HHS’s performance goals also call for incident planning and preparedness. For a hospital, the plan must cover continuity for critical clinical applications and data, and a communications route for affected partners and regulators.
Those elements need rehearsal, not only documentation. A tabletop exercise that includes clinical leaders, the communications team and the vendors who support critical systems is more likely to expose gaps than a document review is.
Illustrative scenario: At night, the on-call engineer sees mass file encryption on a file server. The runbook names who can disconnect network segments, who declares an incident, who calls the clinical operations lead, and who decides whether to move units to downtime procedures.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recovering after ransomware: the HHS sequence
HHS outlines ransomware response as a sequence. Used as a checklist for the first days of an incident, it looks like this:
- Detect and analyze. Confirm which systems and accounts are encrypted or disrupted and whether data appears to have been taken.
- Contain propagation. Isolate affected systems and accounts so the malware cannot spread, while preserving the evidence analysts need.
- Eradicate malware and remediate enabling weaknesses. Remove the malware and fix what let it in, such as an unpatched service or a compromised credential.
- Recover from backed-up data. Restore systems from known-good backups, validate the restored data, and bring critical clinical applications back in priority order.
- Conduct post-incident analysis and notify. Review what happened and complete notification duties, including breach notification where it applies.
Regulatory context and what it means for planning
The HIPAA Security Rule proposal
HHS issued a proposed update to the HIPAA Security Rule on December 27, 2024. The proposal would update protections for electronic protected health information for covered entities and business associates. It is not a final rule. HHS’s proposal page states that the current Security Rule remains in effect while rulemaking proceeds. Rulemaking can move past the stage described there, so confirm the current status on that page before relying on it.
Breach notification and business associates
HHS’s FAQ on the Change Healthcare cybersecurity incident reminds covered entities and business associates to maintain business associate agreements and to meet timely breach-notification obligations. Change Healthcare filed an OCR breach report on July 19, 2024. The count in that initial report was a minimum at the time, not a final total, so do not treat early figures as settled.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Enforcement signals
In an April 17, 2025 announcement, OCR said Guam Memorial Hospital Authority had failed to conduct an accurate and thorough ePHI risk analysis. The corrective plan addressed risk analysis and management, activity-log review, workforce training, access management and breach assessments. The lesson for any hospital is that an accurate, current risk analysis is the foundation for every other control on this list.
In the same announcement, OCR Acting Director Anthony Archeval said: “Ransomware and hacking are the primary cyber-threats to electronic protected health information within the health care industry.” The statement reflects OCR’s view in an enforcement context. It is not a new threat measurement.
Setting your own priorities
Before adding, replacing or buying any control, score it against five questions:
- Coverage: Which accounts, endpoints, clinical devices, locations, suppliers and data flows does the control reach, and which does it miss?
- Clinical compatibility: Can the safeguard run safely alongside legacy systems and network-connected medical equipment?
- Recoverability: Are backups isolated appropriately, restores tested, and critical applications prioritized?
- Operational ownership: Who monitors alerts, applies patches, revokes credentials and leads response at night and on weekends?
- Evidence and governance: Can the organization document its risk analysis, show that controls operate, record exercises and track remediation?
This article does not compare products or vendors. Any specific tool, service or training program should be validated against current capabilities, your architecture and the provider’s terms.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
