Cybersecurity and Privacy Challenges in Healthcare Sector Compliance and M&A
Healthcare organizations are facing heightened scrutiny and risk management challenges related to cybersecurity and data privacy, particularly during mergers and acquisitions (M&As). Legal and technical experts emphasize the importance of thorough due diligence, including compliance with HIPAA and state privacy laws, robust risk assessments, and the implementation of comprehensive security programs. Sellers are advised to proactively address regulatory requirements, maintain up-to-date policies, and ensure the presence of designated security and privacy officers to mitigate potential compliance gaps that could impact transactions.
Simultaneously, the healthcare industry is pushing back against proposed updates to the HIPAA Security Rule, which aim to strengthen cybersecurity controls in response to increasing cyberattacks and data breaches. Industry groups have raised concerns about the feasibility of the new requirements, citing financial burdens and unrealistic implementation deadlines. A coalition of over 100 healthcare organizations has formally requested the withdrawal of the proposed rule changes, highlighting the sector's struggle to balance regulatory compliance with operational realities.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Healthcare industry coalition urges HHS to withdraw proposed rule
A coalition of 100 healthcare organizations led by CHIME pushed back against the proposed HIPAA Security Rule changes, arguing they would create major financial burdens and impose unrealistic implementation deadlines. The group urged HHS to withdraw the proposal.
HHS proposes overhaul of the HIPAA Security Rule
The US Department of Health and Human Services proposed updates to the HIPAA Security Rule to strengthen healthcare cybersecurity in response to rising cyberattacks and data breaches. The proposal includes measures such as patch management, asset control, compliance audits, multi-factor authentication, and network segmentation.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Reducing Cyber, Privacy Risks in Healthcare Sector M&As
bankinfosecurity.com
Open sourceReducing Cyber, Privacy Risks in Healthcare Sector M&As
govinfosecurity.com
Open sourceIndustry Continues to Push Back on HIPAA Security Rule Overhaul
databreaches.net
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI's Impact on Healthcare Data Breach Trends and Industry Response
Artificial intelligence is increasingly influencing the healthcare sector's cyber threat landscape, with both attackers and defenders leveraging AI tools. Experts warn that as larger healthcare organizations strengthen their defenses, cybercriminals are shifting focus to smaller medical practices, insurers, and third-party vendors, which often lack the resources and sophistication to counter advanced AI-driven attacks. The complexity of the healthcare ecosystem, with frequent data exchanges among various entities, further amplifies the risk of breaches, particularly among less mature organizations. In response to the surge in healthcare cyberattacks and data breaches, the US Department of Health and Human Services (HHS) proposed updates to the HIPAA Security Rule aimed at bolstering cybersecurity requirements. However, these proposed changes have faced significant pushback from industry groups, who argue that the new rules impose unrealistic financial and operational burdens, especially given the short implementation timelines. A coalition of over 100 healthcare organizations has called for the immediate withdrawal of the proposed rule, highlighting the tension between regulatory efforts to address AI-driven threats and the industry's capacity to comply.
Mar 21, 2026
Healthcare Sector Faces Escalating Third- and Fourth-Party Risk Management Challenges
Healthcare organizations are increasingly confronted with complex third- and fourth-party risks due to the widespread distribution of sensitive data across diverse vendor networks. Steven Adler, a partner at The Edmund Group, emphasized that data often resides not only with primary vendors but also with offshore, onshore, and even fourth-party entities, which significantly complicates compliance with HIPAA and emerging federal security regulations. The proliferation of vendors and subcontractors in the healthcare supply chain introduces new vulnerabilities, making it essential for organizations to adopt robust risk management frameworks. Adler recommends that healthcare entities maintain a patient-centric approach while ensuring that risk management strategies are closely aligned with overall business priorities. One critical step is the implementation of a vendor risk-tiering model, which ranks suppliers based on the sensitivity of the data they handle and their strategic importance to the organization. This model helps organizations prioritize oversight and allocate resources more effectively to the most critical relationships. Adler also highlights the importance of thoroughly vetting vendors, not just for their service capabilities but also for their ability to recover from disruptions. He advises that contracts with suppliers should clearly define recovery time objectives and maximum allowable downtimes to ensure business continuity in the event of an incident. Many healthcare organizations mistakenly assume that their suppliers have adequate recovery capabilities, which can lead to significant operational risks if not properly verified. The evolving regulatory landscape, including new federal mandates, further increases the pressure on healthcare providers to demonstrate due diligence in managing third-party risks. Business continuity management and disaster recovery planning are now integral components of vendor risk management programs. Organizations are encouraged to regularly evaluate the security posture of their vendors and to ensure that contractual agreements include enforceable security and recovery requirements. The growing complexity of healthcare supply chains necessitates a more proactive and structured approach to governance and risk management. By adopting these best practices, healthcare organizations can better safeguard patient data, maintain regulatory compliance, and ensure resilience against a rapidly evolving threat landscape. The insights provided by Adler at the Healthcare Security Summit in New York underscore the urgent need for stronger oversight and more sophisticated risk management strategies in the sector. As healthcare organizations continue to digitize and expand their vendor ecosystems, the ability to manage third- and fourth-party risks effectively will be a key determinant of their overall cybersecurity posture.
Mar 21, 2026
Healthcare Data Breaches and HIPAA Security Challenges
A cyberattack on NS Support LLC, a neurosurgical healthcare provider, resulted in unauthorized access to its network and the exfiltration of files containing protected health information (PHI) for nearly 93,000 patients. The compromised data included names and medical notes, but not Social Security numbers or financial information. In response, NS Support wiped and rebuilt affected systems, implemented additional security measures, and began reviewing and updating its data security policies. Notification letters were sent to affected individuals, and the incident was reported to the Department of Health and Human Services Office for Civil Rights (HHS OCR). The healthcare sector continues to face a surge in data breaches, with over 700 large incidents reported annually from 2021 to 2024, compromising the PHI of more than 595 million individuals. Hacking and IT incidents are the primary causes, often facilitated by employee errors or lapses in cyber hygiene. Experts highlight the growing complexity of healthcare data ecosystems, especially with the rise of telehealth, and emphasize the need for robust data classification, continuous monitoring, and adaptive security controls to protect sensitive patient information. Regulatory frameworks like HIPAA remain central, but organizations must go beyond compliance to ensure comprehensive data protection across diverse platforms and partners.
Mar 21, 2026