According to the report, 61% of healthcare organizations expect a fatal cyberattack within five years. However, 62% still treat cybersecurity and compliance as a technical line item rather than a patient-safety priority. The report also found that more than eight in 10 practices have gaps in their recovery plans. Nearly a third (31%) are still running on legacy systems that can't contain a breach quickly once it starts.

Ninety-three percent of practices are already using AI in patient-facing and administrative workflows, according to the report. Additionally, six in 10 leaders have self-attested to HIPAA compliance despite known, unpatched vulnerabilities. With the proposed 2026 HIPAA Security Rule, 76% of practices say they aren't ready.  

Fifty-two percent of practices have no managed security service provider (MSSP), and 39% manage cybersecurity entirely in-house. Thirty-five percent say this leaves their teams understaffed, and 23% describe their technology as antiquated. Practices that do partner with an MSSP report better access to capabilities such as managed threat detection and response (42%) and next-gen firewalls (35%).

Download the report