The EHR Association’s Privacy & Security Workgroup issued the following statement to mark Cybersecurity Awareness Month (October).

“In healthcare, cybersecurity protects more than data. It protects clinicians’ ability to deliver quality care. When a cyberattack forces a health system to take its records and scheduling systems offline, divert ambulances and delay procedures, the consequences reach the bedside.”

Understanding the scale and nature of that risk is the first step toward reducing it and the dangers it presents to healthcare providers and patients. At its 2026 HIPAA Security conference, OCR reported that in 2025, healthcare organizations reported  650 large data breaches, each affecting 500 or more people and collectively exposing the protected health information (PHI) of over 45 million individuals.