Cybersecurity Risk Shifting

The Change Healthcare cyberattack of 2024 paralyzed the health care system for months, creating an exceedingly far reaching and devastating impact on providers, suppliers, and patients across the country. While the scope of the attack was unprecedented, the cyberattack itself was not new, unique, or isolated. Indeed, this attack came just months after the close of a year in which the United States’ Department of Health and Human Services’ Office for Civil Rights (OCR) recorded the highest number of reported breaches of protected health information and the highest number of breached records. With a medical record fetching nearly four times the cost of a Social Security number and nearly twenty times the cost of a credit card number on the dark web, hackers have turned an increased focus to health care companies that store, maintain, or process protected health information for their activities. As a result, ransomware attacks and other phishing scams now account for the highest cause of data breaches under the Health Insurance Portability and Accountability Act (HIPAA), with OCR realizing a 239 percent increase in hacking-related data breaches since 2018 and 278 percent increase in r