Article
The good news in the 2025 numbers
Preliminary federal breach data reviewed by Modern Healthcare shows about 46 million individuals’ records were compromised in 2025, an 84% drop from 2024. That earlier year was distorted by the Change Healthcare attack, which alone affected 192.7 million people. Reported incidents also declined by about 10.6%. Security leaders at the American Hospital Association reported no incident of that magnitude in 2025 and credited more attention to vendors and business associates for part of the improvement.
Two caveats apply. Hacking and IT intrusions still accounted for roughly 80% of reported breaches. And last fall’s federal shutdown delayed postings to the Office for Civil Rights portal, so HHS could not yet confirm that every large 2025 breach had been logged.
The less comforting view
A separate industry report from Fortified Health Security, released Jan. 13, counted twice as many breaches in 2025 as in 2024, even as the number of exposed records fell. The difference reflects different data sets and definitions, but the direction matters: smaller, more frequent events that disrupt operations rather than single catastrophic data thefts. Fortified described the shift as a move from headline events toward constant disruption.
The survey results are what should concern executives. Only 4% of organizations said they were highly confident in their vendor risk assessments, and nearly 30% were not confident at all. Just 6% were very confident they could quickly identify, contain and recover from an incident.
Questions for the next board meeting
- Which vendors could stop care? Rank third parties by operational dependency, not by contract value, and confirm each critical vendor’s recovery commitments in writing.
- How long would downtime last? Ask for a tested recovery time for clinical systems, revenue cycle and communications, not a target.
- Does the program survive turnover? Security teams are thin. Make sure playbooks and system knowledge are documented and not held by one or two people.
- Are lessons turning into changes? After each incident or exercise, track which process fixes were actually completed.
Lower record counts are welcome, and they may reflect real progress on vendor oversight. But a smaller number of exposed records does not mean a smaller operational risk, especially for systems that depend on a handful of outside platforms for scheduling, claims and clinical documentation.
Archive entry for Jan 24, 2026, added Nov. 11, 2026.