Why are healthcare breaches becoming more expensive in the US, and how can hospitals stay ahead?

Binoy Koonammavu, CEO & Founder, ValueMentor 

Data breaches have become a defining risk of the digital age, but no sector feels the impact as acutely as healthcare. For more than a decade, the U.S. healthcare industry has consistently recorded the highest cost per breach of any sector worldwide. According to IBM’s annual Cost of a Data Breach report, healthcare breaches have topped the charts for 13 consecutive years, with the average cost per incident surpassing $11 million in 2023. The HIPAA Journal further reports that the average cost of a healthcare breach in 2024 was $9.77 million,  nearly double the global cross-industry average of $4.88 million.

Despite rising investment in cybersecurity, the problem is not easing. Breaches are growing larger, attackers are more sophisticated, and the regulatory environment in the U.S. amplifies financial consequences. Understanding why healthcare breaches are becoming more expensive requires examining the unique value of medical data, the complexity of digital infrastructure, and systemic risks across the healthcare ecosystem.

Why are costs rising in healthcare breaches

1. The uniquely valuable nature of healthcare data

Unlike financial data, which can be cancelled or reissued, healthcare records have a near-permanent quality. A single electronic health record (EHR) often includes Social Security numbers, insurance details, treatment histories, prescription information, and even genetic data. On the black market, these bundled datasets are far more valuable than stolen credit card numbers. Once exposed, they can be exploited for years through identity theft, medical fraud, or insurance scams. This enduring utility makes healthcare organizations disproportionately attractive to attackers, and every compromised record carries greater downstream risk than in other industries.

2. Scale and frequency of attacks

The volume of attacks in U.S. healthcare has surged. Data from the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) shows that in 2023, 725 data breaches of 500 or more records were reported, exposing more than 133 million patient records. In 2024, that number skyrocketed to more than 276 million records, including the largest healthcare breach in history, the ransomware attack on Change Healthcare, which impacted an estimated 190 million individuals. The sheer scale of these incidents drives up notification, remediation, and legal costs, pushing per-breach expenses even higher.

3. Delayed detection and response

Healthcare organizations often take longer than other industries to identify and contain breaches. IBM data shows healthcare breaches have an average lifecycle of 279 days, more than a month longer than the global average. Contributing factors include legacy IT systems, fragmented hospital operations, and limited cybersecurity staffing. The longer an attacker remains undetected, the more data they exfiltrate and the deeper they embed themselves into critical systems. By the time an intrusion is uncovered, the cost extends beyond technical recovery to include rebuilding infrastructure and repairing reputational damage.

4. Regulatory and legal burdens

The U.S. healthcare sector operates under some of the strictest data protection laws in the world. HIPAA and HITECH mandate rigorous reporting, disclosure, and accountability following a breach. Penalties for non-compliance can reach millions of dollars per violation. Beyond regulatory fines, healthcare providers face intense litigation pressure, with class-action lawsuits becoming routine after large breaches. OCR has logged more than 5,887 large healthcare data breaches since 2009, with more than 857 cases still under investigation, underscoring the scale of regulatory oversight. The financial toll extends for years through settlements, identity protection services, and increased cyber insurance premiums.

5. Ransomware and operational disruption

Ransomware has become the most financially devastating threat to hospitals. Modern ransomware attacks combine encryption with data theft, threatening to leak sensitive records unless ransom is paid. OCR data shows a 278% increase in ransomware-related breaches between 2018 and 2023. Hospitals are particularly vulnerable, as downtime impacts critical care delivery, delayed surgeries, inaccessible medical histories, and disrupted billing systems. Downtime costs are estimated at nearly $1.9 million per day, with ransomware-related outages between 2018 and 2023 contributing to over $21 billion in losses. Even when ransoms are paid often in the millions, recovery is slow, incomplete, and costly.

6. Interconnected ecosystem and third-party risk

Hospitals no longer function as isolated entities. They rely on electronic health record providers, insurers, diagnostic labs, and payment processors. A single compromise in the supply chain can cascade across multiple organizations. The Change Healthcare incident exemplified this systemic risk: nationwide billing and claim processing ground to a halt, creating financial strain for providers across the U.S. Similarly, the MOVEit file transfer breach swept dozens of healthcare entities into exposure via third-party vulnerabilities.

7. Legacy systems and shadow IT

Healthcare’s reliance on outdated systems adds further risk. Diagnostic machines, imaging systems, and patient monitoring devices often run on unsupported operating systems that cannot be easily patched. Shadow IT, unsanctioned apps, personal devices, or unapproved cloud services also widen the attack surface, often escaping monitoring and compliance oversight. HIPAA Journal analysis suggests breaches involving shadow IT increase average costs by $200,000 per incident.

8. The U.S. cost premium

The cost premium in the U.S. is not just about technology; it is also about litigation and regulation. The U.S. is highly litigious, with breach-related settlements running into hundreds of millions of dollars. Hospitals must frequently provide credit monitoring and identity protection to millions of affected patients, further multiplying costs. Cyber insurance premiums also rise significantly after a breach. Together, these factors create a “U.S. surcharge” on healthcare breaches, making them far more expensive than in other parts of the world.

How hospitals can stay ahead

If the problem is uniquely severe in U.S. healthcare, the solution must also be uniquely rigorous. Preventing breaches entirely may be unrealistic, but reducing their frequency, scope, and cost is achievable with the right strategies.

Accelerated detection and response: Hospitals must deploy advanced monitoring solutions such as Security Information and Event Management (SIEM), Extended Detection and Response (XDR), and automated incident workflows. Reducing dwell time is critical, as attackers often persist undetected for months. Regular red-team exercises and tabletop simulations help strengthen real-world readiness.

Zero trust architecture: The traditional “trust but verify” model is obsolete. Zero Trust enforces continuous verification, least-privilege access, and strict network segmentation. By isolating systems, for example, preventing radiology devices from accessing billing systems, attackers’ lateral movement is contained.

Identity and access hardening: Multi-factor authentication should be applied universally, not just to administrators. Privileged Access Management (PAM) tools ensure critical systems are only accessed with time-bound, monitored credentials. Weak identity controls have been at the heart of many large breaches.

Modernized patching and development: Hospitals must embrace DevSecOps to integrate security into software lifecycles. Automated patching and risk-based vulnerability management reduce exploitation windows, even in environments where downtime must be minimized.

Supply chain security: Vendor risk management is now a core enterprise priority. Hospitals should conduct continuous risk assessments, enforce contractual cybersecurity obligations, and align vendors with standards like NIST or HITRUST. Greater transparency into software components also helps mitigate cascading risks.

Encryption and data protection: Encrypting data at rest and in transit limits exposure, even if systems are compromised. Tokenization of billing and payment data further reduces sensitive information stored locally, shrinking the attack surface.

Resilience and recovery planning: Immutable, offline backups ensure ransomware cannot destroy recovery pathways. Hospitals should align recovery playbooks with NIST SP 800-184 and conduct regular drills to practice rapid restoration of services.

Staff awareness and training: Human error remains a top breach vector. Regular phishing simulations, role-based training, and fostering a culture of accountability among clinicians and administrators can dramatically reduce risk.

Conclusion

Healthcare breaches in the U.S. are not only becoming more frequent but also more financially devastating. The sensitivity of medical data, evolving ransomware tactics, regulatory demands, and systemic supply chain risks have created a perfect storm where the cost of failure continues to escalate.

Hospitals cannot afford to view cybersecurity as merely an IT function; it is now a pillar of patient safety, operational continuity, and financial stability. By investing in proactive defense strategies from Zero Trust architectures and advanced detection tools to vendor oversight, encryption, and tested recovery plans, healthcare organizations can shift from reactive crisis management to proactive resilience.

In an era where a single breach can compromise millions of patients and cost tens of millions of dollars, preparation is the defining factor between survival and systemic disruption. The path forward is clear: only through rigorous, layered cybersecurity can hospitals safeguard both their operations and the trust at the heart of healthcare.