Healthcare has spent years accelerating its digital transformation. Clinical applications have moved to the cloud. Collaboration tools have become essential to how care teams work. And now AI is increasingly being used to streamline operations, strengthen cybersecurity and support patient care.
Each step has created enormous opportunity. It has also changed what healthcare organizations need to protect.
Our fifth annual Cyber Insecurity in Healthcare report, conducted with Ponemon Institute, shows just how high the stakes have become. Cyberattacks are growing more frequent and costly, but their consequences increasingly extend beyond IT systems. Nearly three in four organizations experiencing the four types of attacks studied reported disruption to patient care.
This year, however, another shift stands out: healthcare is adopting AI faster than it is building the governance and security needed to manage it.
Healthcare's AI transformation is already underway
AI isn't some distant healthcare technology trend.
Organizations are already using it to automate administrative work, analyze medical images and diagnostics, monitor patients and strengthen cybersecurity. 45% of healthcare organizations have embedded AI in cybersecurity or both cybersecurity and patient care. Another 30% plan to adopt it.
That's potentially transformative. AI can help healthcare organizations operate more efficiently, augment overstretched teams and improve how they detect and respond to cyber threats.
But healthcare's AI transformation is creating a familiar security challenge: technology adoption is moving faster than organizations' ability to understand and govern the resulting risk.
60% of organizations in our research don't have controls governing sensitive data used in AI systems. Only 42% use security measures specifically designed to protect AI systems, agents and generative AI. And fewer than one-third have full visibility into employees' use of unsanctioned AI tools.
The problem isn't AI adoption. It's AI adoption without visibility and guardrails.
The human risk equation is changing
For years, healthcare cybersecurity has focused heavily on people—and for good reason.
Healthcare employees work with extraordinarily sensitive information under enormous time pressure. They communicate across email, messaging and collaboration tools. They access patient records and clinical systems. A mistaken recipient, compromised account or successful social engineering attack can have consequences far beyond the individual user.
That hasn't changed.
What is changing is who—or what—is participating in those workflows.
AI agents can access information, interact with applications and take actions on behalf of people. For the first time in this year's study, respondents identified AI agents operating without guardrails as a cause of data loss or exfiltration incidents, cited by 24%.
That's an important signal.
As people increasingly work alongside AI, healthcare organizations need to understand not only what people are doing with sensitive data, but what AI systems and agents can access, what they're doing with that information and what actions they're permitted to take.
Human-centric security isn't becoming less relevant in the AI era. It's expanding.
And the consequences of getting it wrong are already clear
Why does the AI governance gap matter so much in healthcare?
Because this isn't an industry where cyber disruption is confined to computers.
Recent healthcare cyberattacks have demonstrated how quickly technology disruption can become operational disruption. During the 2024 cyberattack against Ascension, critical systems including electronic health records were taken offline, contributing to ambulance diversions, delayed care and reliance on manual processes.
Our research shows that experience is part of a broader pattern.
Healthcare organizations tell us their greatest cyberattack costs now come from operational disruption, downtime and the effort required to restore patient services. Across the attacks studied, organizations reported consequences including longer patient stays, delayed procedures and tests, patient diversions and increased complications.
That's why the conversation about AI security in healthcare can't be separated from the conversation about resilience.
As AI becomes embedded in clinical and operational workflows, organizations aren't simply adding another application to protect. They're introducing technology that may interact with sensitive information, make decisions and take actions within environments where availability and accuracy can affect care.
Healthcare’s cloud transition offers a preview
We've seen a similar dynamic play out with cloud adoption.
Healthcare organizations moved applications and collaboration into the cloud because doing so made people and services more connected and productive. Attackers followed.
More than three-quarters of organizations in this year's study experienced a cloud/account compromise. Meanwhile, healthcare continues moving clinical applications to the cloud.
The lesson isn't to slow cloud—or AI—adoption. Innovation is essential to modern healthcare.
The lesson is that security has to evolve alongside adoption rather than follow it.
For AI, that means understanding where sanctioned and unsanctioned tools are being used. It means controlling access to sensitive healthcare data. It means monitoring how AI systems and agents behave. And it means protecting the interactions among people, data and AI.
From cyber resilience to healthcare resilience
There is no realistic future for healthcare that doesn't include more cloud, more automation and more AI.
So the question isn't whether healthcare organizations should adopt these technologies. It's whether they can adopt them without introducing risks faster than they can manage them.
Our research suggests that gap deserves attention now.
Cybersecurity in healthcare has already moved beyond protecting infrastructure. Organizations need to protect the people delivering care, the sensitive data they depend on and, increasingly, the AI systems and agents participating in their work.
The organizations best positioned for what's next will be those that treat security and governance as part of AI adoption—not something added after deployment.
Because as healthcare becomes more connected and AI-driven, cyber resilience is increasingly healthcare resilience.
Learn more
Download the 2026 Study on Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care to explore the complete findings.