Health care cybersecurity policy rests on a fundamental misunderstanding of what cybercriminals actually want. For years, regulators and providers have assumed that medical records — diagnoses, lab results, treatment histories — are the crown jewels hackers are after. This assumption has shaped everything from HIPAA compliance strategies to hospital security budgets.
But it’s wrong.
Cybercriminals targeting health care providers aren’t interested in your cholesterol levels or prescription history. They’re after your Social Security number, your insurance details, and your payment information. This isn’t just an academic distinction — it’s a policy blind spot that’s making health care both less secure and less collaborative than it needs to be.
This article is exclusive to STAT+ subscribers
Unlock this article — plus in-depth analysis, newsletters, premium events, and news alerts.
Already have an account? Log in
