Article
What the report found
Fortified Health Security’s 2026 Horizon Report, released Jan. 13, draws on federal breach filings and the firm’s own assessments of provider security programs from 2024 through 2025. Its central finding is that breach frequency more than doubled year over year while records exposed declined significantly. Ransomware and third-party exposure drove much of the increase, and email-based breaches, fed by phishing, stolen credentials and staff errors, more than doubled.
The firm summarized the change as a move away from occasional headline events toward a steady state of disruption. For hospital leaders, that framing matters: smaller incidents may not make national news, but each one can take systems offline, delay care and pull clinical and IT staff away from their work.
The confidence gap
The survey results are the most telling part of the report for boards. Only 6% of organizations said they were very confident they could quickly detect, contain and recover from an incident. On vendor risk, just 4% were highly confident their assessments reflected actual exposure, nearly two-thirds were somewhat confident and almost 30% were not confident at all. Given how many hospital functions now run through outside vendors, from revenue cycle to imaging to pharmacy, that gap is a direct operational exposure.
What executives should do
- Measure recovery, not just defenses. Ask how long it would take to restore the EHR, lab, pharmacy and billing systems, and when downtime procedures were last tested under realistic conditions.
- Map critical vendors. Identify which third parties could halt clinical or financial operations if they went down, and confirm contract terms for notification, recovery support and backup access.
- Harden email and identity. With email-driven breaches rising, multifactor authentication, privileged access controls and recurring phishing training are baseline requirements.
- Plan for staff turnover. The report urges programs that preserve institutional knowledge, so response playbooks do not depend on a few individuals.
- Fund security as patient safety. Security budgets compete with clinical priorities, but an outage that diverts ambulances or delays medications is a clinical event.
Boards do not need to become technical experts. They do need regular, plain-language reporting on how fast the organization can recover and which dependencies could stop care.
Archive entry for Jan 17, 2026, added Nov. 11, 2026.