The Change Healthcare breach: What changed, what didn’t, and what must

The 2024 Change Healthcare breach marked a turning point for the healthcare industry. It exposed critical vulnerabilities in current data governance and security practices, underscoring that no organization — regardless of size or resources — is immune to cyber threats. A year later, it’s clear that while some progress has been made, there is still much to be done to protect patient data and ensure continuity of care.

Lessons learned from the breach

The breach served as a wake-up call for the healthcare industry. It shattered the illusion of security that many organizations held and reinforced a hard truth: no one is 100% safe from cyberattacks. To address this reality, organizations must adopt a resilience mindset, focusing not just on prevention but also on preparation for inevitable incidents.

This requires more than just technology — it demands a cultural shift. A truly secure organization educates its workforce to recognize and respond to threats, maintains transparency in data practices, and constantly monitors access to sensitive systems.

Persistent vulnerabilities

Despite heightened awareness, significant challenges persist in healthcare cybersecurity. Many organizations rely on disaster recovery plans that prove insufficient against ransomware attacks, leaving them vulnerable to permanent data loss without robust offline backups. Additionally, cybersecurity failures directly impact patient care, as operational disruptions prevent providers from accessing critical records, delaying care and causing patient harm. Compounding the issue, attackers continuously refine their methods, requiring healthcare organizations to stay ahead through ongoing education and adaptive security measures.

Progress over the past year

The breach catalyzed meaningful discussions about data security, leading to advancements in several areas. Among them is the push for government mandates to improve cybersecurity across the healthcare ecosystem. Proposed measures include requirements for comprehensive data backups and stricter oversight of third-party vendors.

While these initiatives represent progress, their implementation varies widely. Financially robust organizations may adapt quickly, but smaller institutions face significant hurdles. This disparity highlights the urgent need for funding and incentives to ensure compliance across the industry.

What still needs to change

The Change Healthcare breach exposed systemic issues that remain unaddressed. Chief among them is the lack of financial support for organizations struggling to meet cybersecurity requirements. Without adequate resources, many smaller hospitals and clinics are forced to make difficult choices — prioritizing security at the expense of other critical services or, in some cases, merging with larger systems to stay afloat.

Staffing shortages further compound the problem. The healthcare industry faces a dwindling workforce as baby boomers retire and younger professionals gravitate toward more flexible careers. This shortage leaves organizations ill-equipped to manage the increasing demands of cybersecurity.

A path forward

To strengthen data security and governance, the healthcare industry must take a multi-faceted approach:

• Adopt a resilience mindset: Organizations need to expand their focus from just avoiding breaches to ensuring they can recover swiftly and maintain continuity of care when incidents occur. Comprehensive, offline backups and disaster recovery plans are essential.
• Invest in education and training: Cybersecurity is everyone’s responsibility. Regular training helps employees recognize threats and respond appropriately, creating a culture of vigilance.
• Enhance third-party oversight: Vendors often represent weak links in the security chain. Robust monitoring and clear accountability are critical to minimizing risk.
• Advocate for financial support: Government funding and incentives are necessary to level the playing field, enabling smaller institutions to meet cybersecurity standards without compromising patient care.
• Prioritize patient-centric security: At its core, healthcare cybersecurity is about safeguarding patients. Maintaining uninterrupted access to critical data is non-negotiable, even during an attack.

Looking ahead

The 2024 breach underscored that cybersecurity is not just a technical challenge but an existential one for healthcare. The path forward requires bold action and sustained commitment.

Every organization, regardless of size, must recognize that cybersecurity is a continuous process. By embracing resilience, prioritizing education, and advocating for equitable resources, leaders can create a safer and more reliable healthcare system.

This breach wasn’t just a wake-up call for a single company — it was a call to action for an entire industry. The stakes are too high to ignore. The collective responsibility is to ensure that patient safety and data security remain at the forefront of everything that is done.