The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Hospitals protect patient data by doing three things at once: closing the weaknesses attackers most often use, making phishing and stolen logins less useful, and keeping clinical systems restorable when a network is locked or corrupted. No combination of controls makes a hospital unattackable. HHS presents its healthcare cybersecurity performance goals as voluntary practices meant to improve preparedness, resilience, and the protection of patient health information and safety. HHS describes them as a way to prioritize work, not as a guarantee against attack.
The seven defenses below are an editorial grouping of safeguards that HHS supports. HHS does not publish this exact list. The order in which your organization applies them should come from its own risk analysis, because systems, suppliers, device fleets, and recovery needs differ from one hospital to the next.
Why hospital data is a target, and what “prime target” does and does not mean
“Prime target” is editorial framing. It is shorthand for a practical combination: hospitals hold large volumes of sensitive patient records, depend on networked systems to deliver care around the clock, and run large fleets of connected medical devices alongside many outside suppliers. HHS’s Health Industry Cybersecurity Practices (HICP) 2023 Edition names social engineering, ransomware, loss or theft of equipment or data, insider or accidental data loss, and attacks against network-connected medical devices among the threats facing the healthcare sector.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The phrase does not mean hospitals have been measured as more attractive than other industries. The HHS sources cited here do not rank hospitals against other sectors, and they do not give a current annual count of attacks. Use the framing to set priorities, not as a statistic.
#1 Best Overall
What happens to patient care during a hospital cyberattack?
The clinical effect can be immediate, even when the attack is technically a data problem. Electronic health records, order entry, laboratory, imaging, pharmacy, and scheduling systems depend on shared networks and identity services. When they stop, clinicians switch to downtime procedures. Those procedures are slower and make it harder to confirm allergies, active medications, and prior results at the bedside. The main patient-safety risks fall into a few groups:
- Delayed orders and results. Medication orders, lab values, and imaging reads may wait until systems return or paper workflows catch up.
- Harder verification. Staff may be unable to check code status, dosing history, or allergy records quickly, which raises the chance of error during handoffs.
- Disrupted transfers and capacity decisions. When bed-tracking and records systems are down, moving patients safely between units or facilities becomes slower and more error-prone.
- Connected devices that cannot be trusted. HHS names attacks against network-connected medical devices as a threat, and clinicians may have to take equipment out of service until it is verified.
- Altered records. Data that is changed rather than locked is harder to detect, and it can lead clinicians to act on wrong information.
HHS Deputy Secretary Andrea Palm put the issue in these terms when HHS proposed updates to the HIPAA Security Rule in December 2024: “The increasing frequency and sophistication of cyberattacks in the health care sector pose a direct and significant threat to patient safety.” (HHS HIPAA Security Rule proposal)
How large is the problem? What HHS’s breach figures show
The figures below come from the HHS Office for Civil Rights (OCR) 2024 proposed-rule page. They cover large breaches as HHS tracks them, not hospitals alone, and the first two cover 2018 through 2023. They are not current totals.
- From 2018 to 2023, reports of large breaches increased by 102 percent.
- The same page reports that individuals affected by large breaches increased by 1002 percent over that period.
- In 2023, over 167 million individuals were affected by large breaches.
Source: HHS OCR, HIPAA Security Rule proposed rule page.
How do hospitals protect patient data from hackers? Seven defenses
Each defense below pairs the control with an illustration and the trade-off that usually decides whether it works. The illustrations show how these controls play out in practice. They are not reports of specific incidents.
1. Find and fix exposed weaknesses
HHS treats mitigation of known vulnerabilities as an essential goal and asset inventory as an enhanced goal in its performance goals. You cannot patch, scan, or close what you have not listed. The work therefore starts with an inventory that includes servers, workstations, medical devices, web applications, and systems that vendors reach through remote access.
Illustration: an asset inventory reveals an older imaging server that still answers on a public address because a vendor set up remote support years ago. Restricting that service to a vendor VPN with individual accounts closes a route that a review limited to the main network would miss.
The trade-off is clinical. Many medical devices cannot be patched on the hospital’s schedule. Prioritization has to account for vendor approval, device validation, and the compensating controls, such as segmentation or restricted access, used while a fix is pending.
2. Harden email and reduce phishing risk
HHS names email spoofing, phishing, and fraud among the threats its goals address, and social engineering appears in the HICP 2023 threat list. Email reaches almost everyone in an organization, which makes it a practical place to start. The defense combines technical controls with staff who know what to do:
- Configure email authentication and filtering to reject spoofed sender domains, using email authentication standards such as SPF, DKIM, and DMARC for outbound domains.
- Require multifactor authentication for email access, as described in defense 3.
- Give staff a one-click route for reporting suspicious messages, and confirm that reports reach a team that responds.
- Run tailored phishing exercises and follow up with coaching. A single yearly awareness module does not reliably change how people handle a convincing message.
Aggressive filtering can delay legitimate clinical messages. Review false positives with the departments that depend on outside correspondence, such as referrals and billing.
3. Use multifactor authentication where it is safe and technically possible
HHS describes multifactor authentication (MFA) as an additional layer for internet-accessible assets and accounts, and its performance goals refer to phishing-resistant MFA. Start with remote access, email, privileged administrator accounts, and vendor access, because those accounts give the widest reach if a password is stolen.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Two qualifications matter. First, what is technically possible depends on the system. Some legacy applications and clinical systems cannot accept a second factor without vendor changes or workflow redesign. Where MFA cannot be applied, document the exception, the reason, and the compensating control, and set a date for review. Second, MFA is one layer. A hardware token or authenticator app does not secure a compromised endpoint or a misconfigured system by itself.
4. Train staff for their actual roles
HHS recommends training users to detect and report malicious software, and its performance goals include basic cybersecurity training. Generic training fails when it does not match the work people do. Build scenarios around the situations staff actually encounter:
- Billing and claims staff receiving payment-change requests or remittance attachments from unfamiliar senders.
- Clinicians and remote workers using home networks, personal devices, or unfamiliar remote-support tools.
- Anyone who finds a lost or unlabeled USB drive, laptop, or badge.
- Front-line staff who notice unexpected prompts, unusual screen behavior, or slow systems, and who need to know whom to call at night.
The last scenario matters most during an incident. A reporting route that is slow or feels risky to use tends to be used late, and late reports cost response time. Source: HHS ransomware and HIPAA fact sheet.
5. Protect data with encryption and access controls
HHS lists strong encryption as an essential goal and recommends limiting access to electronic protected health information (ePHI) to the users and programs that need it. Access controls matter as much as encryption. A valid password on a stolen account can give an attacker the same view as an authorized user, and encryption does not change that.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Encryption reduces exposure in some scenarios, but it does not prevent every breach. HHS notes that whether PHI is rendered unreadable to unauthorized people depends on how the safeguard is implemented, so an encryption setting should be verified rather than assumed. Check that full-disk encryption is enabled on laptops and removable media, that encryption keys are managed separately from the data they protect, and that access reviews remove former staff and unused accounts on a schedule you can document.
Illustration: a stolen laptop with full-disk encryption that also stores a logged-in EHR session token gives less protection than the encryption setting suggests, because the stored token could still open the record system. Sources: HHS Cybersecurity Performance Goals and HHS ransomware and HIPAA fact sheet.
6. Keep backups that can actually be restored
HHS recommends frequent backups, periodic restoration tests, and consideration of offline backups that are not reachable from the network, because some ransomware disrupts online backups. A backup that has never been restored is an assumption, not a recovery plan. Testing should cover:
- Restoring the EHR database, one representative clinical application, and one file share in a test environment, with the time each restoration took recorded.
- Keeping at least one copy that production systems and ordinary administrator credentials cannot write to or delete.
- Documenting which systems are restored first and who has authority to start a restoration.
- Repeating restoration tests on a schedule and after major system changes.
Offline copies can be kept on media such as encrypted external hard drives. An external drive alone is not an enterprise backup architecture, though. It needs encryption, controlled access, rotation, labeling, and tested restoration steps to be useful, and a drive that has never been tested offers little assurance during an incident.
7. Prepare and rehearse incident response and recovery
HHS’s ransomware guidance lays out a response sequence that hospitals can rehearse as a set of decisions and owners:
Best Value
- Used Book in Good Condition
- Detect and analyze: confirm what is affected and how far the activity has spread.
- Contain propagation: isolate affected systems and network segments to stop the spread.
- Eradicate malware and remediate the weaknesses that enabled the attack.
- Recover from backed-up data, in the priority order set for clinical systems.
- Conduct post-incident analysis, including any notification duties.
Two additions make the sequence usable in a hospital. Continuity planning should cover critical clinical applications and data, with downtime procedures that clinical leaders have practiced. Communications should name a route for affected partners and regulators, and the people who will make those calls should be identified before an incident. HHS’s performance goals also call for incident planning and preparedness. Sources: HHS ransomware and HIPAA fact sheet and HHS Cybersecurity Performance Goals.
Rehearse the plan with the people who would run it at 2 a.m., not only with the security team. A tabletop exercise that includes nursing supervisors, pharmacy, laboratory, facilities, and the communications office will expose gaps that an IT-only walkthrough will miss.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing among implementation options
This article does not compare vendors or products, and it does not recommend any specific product for these controls. When you compare ways to implement a control, five questions separate workable options from options that only look good on paper:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Axis | Questions to answer before choosing |
|---|---|
| Coverage | Which accounts, endpoints, clinical devices, locations, supplier connections, and data flows does the control reach, and which does it miss? |
| Clinical compatibility | Can it run safely alongside legacy systems and network-connected medical equipment, and who approves changes to those devices? |
| Recoverability | Are backups isolated from the network, is restoration tested, and are critical clinical applications ranked in recovery order? |
| Operational ownership | Who watches alerts, applies patches, revokes credentials, and leads response at night and on weekends? |
| Evidence and governance | Can you show the risk analysis, control operation, exercise results, and remediation records to leadership, auditors, or OCR? |
What enforcement shows: Guam Memorial Hospital Authority
On April 17, 2025, OCR announced an enforcement action against Guam Memorial Hospital Authority, a hospital authority in the U.S. territory of Guam. OCR said the organization had failed to conduct an accurate and thorough risk analysis of ePHI. The corrective plan addressed:
- Risk analysis and management
- Activity-log review
- Workforce training
- Access management
- Breach assessments
OCR Acting Director Anthony Archeval said in the same announcement: “Ransomware and hacking are the primary cyber-threats to electronic protected health information within the health care industry.” (HHS OCR announcement on Guam Memorial Hospital Authority)
This is one case involving one organization, not a measure of compliance across hospitals. It shows that OCR treats an inaccurate risk analysis as a compliance failure in its own right, and that the corrective plan reached beyond technology into training and access management.
Breach notification duties and the proposed Security Rule update
HHS’s FAQ on the Change Healthcare cybersecurity incident reminds covered entities and business associates to maintain business associate agreements and to meet timely breach-notification obligations. Change Healthcare filed an OCR breach report on July 19, 2024. The initial report listed at least 500 affected individuals at the time. HHS’s FAQ presents that number as an early minimum, not a final total.
Recommended Free Tools
HHS proposed updates to the HIPAA Security Rule on December 27, 2024. The proposal would update protections for electronic protected health information and apply them to covered entities and business associates. It is not a final rule, and HHS states that the current Security Rule remains in effect while rulemaking proceeds. Because the proposal is nearly two years old, check the Federal Register for whether a final rule has been issued before treating any proposed requirement as binding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
