![\"Retail](\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\")
<\/a><\/p>\n<\/p>\n
The healthcare industry is undergoing a period of unprecedented transformation. The expansion of virtual health solutions, cloud-based apps and AI-enabled tools used within clinical workflows will only increase as Federal funding programs like the Rural Health Transformation Program incentivize digital transformation. This evolution in care delivery is long awaited and much needed in order for healthcare to become more scalable and to help drive down operational costs. However, the rapid adoption of technology can present a potentially dangerous paradox- as organizations modernize to support operational efficiency and empower clinicians to improve patient outcomes, they are simultaneously expanding their attack surface.<\/p>\n
To address these growing risks and vulnerabilities, a new HIPAA Security Rule has been proposed to drive new requirements, enforcement mechanisms, and accountability in the industry. For these new requirements to be adopted successfully, it is imperative that we understand why the healthcare industry is unique from all other verticals and inherently more insecure. The answer is not complacency or lack of funding (although these may certainly be contributing factors), rather, the answer lies in the innate complexity of delivering patient care.<\/p>\n
The Healthcare Insecurity Gap: Why it\u2019s Different<\/strong><\/h2>\nWhy is healthcare the most targeted industry for cyberattacks and why does the industry also lead in cost per breach? The cause has to do with the nature of healthcare delivery itself.<\/p>\n
\n- High-stakes availability:<\/strong> In finance or retail the ramifications of a breach are financial or reputational. In healthcare, a breach that renders systems unavailable is a critical operational crisis- potentially delaying access to patient data and hindering the delivery of care.<\/li>\n
- Data Value: <\/strong>Protected Health Information (PHI) is a goldmine for cybercriminals. It includes financial data, health information, social security numbers, insurance information, family history, and more. It can be used fraudulently for years before detection and cannot be easily canceled or changed like a credit card number.<\/li>\n
- The Interconnected Ecosystem:<\/strong> Healthcare does not occur in a silo. The average patient interacts with a web of hospitals, physicians\u2019 groups, insurers, pharmacies, and 3rd<\/sup> party vendors. This level of integration creates a massive attack surface where a vulnerability in network can easily propagate across the industry.<\/li>\n<\/ol>\n
Complexity is the Enemy of Security: How Complex Processes are Different Than Complicated Ones<\/strong><\/h2>\nComplicated Systems:<\/strong> Anyone who has spent time learning the Lean Six Sigma manufacturing mindset understands that it is intended to boost performance by reducing cost, eliminating waste, and reducing process variation. In the 20th<\/sup> century, this philosophy revolutionized manufacturing. It is largely based on the idea that any process, however \u201ccomplicated\u201d, if it is repeatable, can be managed, measured, and improved. We built rocket ships this way. This is also how we secure our financial system- by understanding the linear nature of the possible transactions and introducing controls.<\/p>\nComplex Systems:<\/strong> Healthcare delivery does NOT function in a linear, predictable way. Healthcare is often delivered in an urgent setting, each patient\u2019s care pathway may be individualized (even if their disease and symptoms appear similar), interactions with their care team could be more ad-hoc depending upon availability. At its most basic, healthcare is not linear or predictable- it is complex. Regardless of the disease state, the specialty, or organization, healthcare delivery is complex- not easily predicted, non-linear, and may appear (on the surface) unstructured or ad-hoc.<\/em><\/p>\nResearch has determined that this complexity is the primary driver of cybersecurity breaches. When information exchanges are ad-hoc and non-linear it is nearly impossible to analyze, test, and control an organization\u2019s security posture. The most complex healthcare systems \u2014 with the largest varieties of health service referrals from one hospital to another \u2014 were 29% more likely to be breached than average. 1<\/sup><\/p>\nA Regulatory Maze: Preparing for Tomorrow\u2019s HIPAA Security Rule<\/strong><\/h2>\nThe HIPAA Security Rule is currently undergoing its most significant transformation in over two decades, shifting from a flexible \u201cchecklist\u201d mentality to a rigorous \u201ccybersecurity architecture\u201d standard. As of March 2026, the Department of Health and Human Services (HHS) is finalizing a major overhaul of the HIPAA Security Rule<\/strong> that effectively eliminates the long-standing distinction between \u201crequired\u201d and \u201caddressable\u201d safeguards. While these new standards are expansive and may feel overwhelming, a systematic approach to Zero Trust that takes into consideration the inherent complexity in the healthcare industry can provide a roadmap for improved security maturity.2<\/sup><\/p>\nCisco\u2019s Approach<\/strong><\/h2>\nWe understand the size of the elephant when it comes to healthcare cybersecurity, therefore we choose a bite-by-bite approach. When we look at a Zero Trust strategy, we tend to break it down into three focus areas: Workforce, Workload, and Workplace.<\/p>\n
This approach to Zero Trust allows us to prioritize and make incremental progress on security controls and policies that are needed to scale. Each focus area has particular priorities that are critical to a fully developed Zero Trust strategy:<\/p>\n
\n- Workforce:<\/strong> In healthcare we are thinking about secure remote connectivity (both for contractors, employees, and 3rd<\/sup> parties), multi-factor authentication (MFA), role-based access controls, dynamic secure connectivity (SASE), monitoring of AI model usage, access, and information transmitted.<\/li>\n
- Workload:<\/strong> By combining strong workforce controls with application micro segmentation and monitoring, as well as a comprehensive AI Governance strategy that includes DevOPs security and guardrails, the crown jewels can be better defended and in the event of a breach the blast radius will be greatly reduced.<\/li>\n
- Workplace:<\/strong> One of the biggest challenges in healthcare is visibility and context- this is increasingly challenging when it comes to medical devices. In order to properly set network access controls (NAC) as well as segmentation policies it is critical to have the right technologies and enforcement strategy defined and in place.<\/li>\n<\/ul>\n
\u00a0<\/strong>Cisco has a comprehensive portfolio of security solutions to help address the new HIPAA Security Rule standards. We also offer consultative services and assessments to help you evaluate your security posture and support your efforts to meet your compliance obligations.<\/p>\nHow Can We Help?<\/strong><\/h2>\nThe Customer Experience (CX) Healthcare Practice at Cisco is comprised of individuals who have experience in many different areas of the healthcare industry. We understand the unique challenges that the industry faces and work to help align technologies to healthcare specific outcomes. If you are interested in discussing your HIPAA Security Rule readiness, overall cybersecurity maturity, or our other advisory services, please reach out to use directly at: cxhealthcarebd@cisco.com.<\/p>\n
\n- Tanriverdi, H\u00fcseyin, et al. \u201cTaming Complexity in Cybersecurity of Multihospital Systems: The Role of Enterprise-wide Data Analytics Platforms.\u201d MIS Quarterly<\/em>, vol. 48, no. 1, 2024, https:\/\/doi.org\/10.25300\/MISQ\/2024\/17752.<\/li>\n
- Modernizing Cybersecurity for Healthcare<\/em>. Cisco, 2026.<\/li>\n<\/ol>\n
\u00a0<\/p>\n<\/p><\/div>\n
Complexity is the Enemy of Security: How Complex Processes are Different Than Complicated Ones<\/strong><\/h2>\nComplicated Systems:<\/strong> Anyone who has spent time learning the Lean Six Sigma manufacturing mindset understands that it is intended to boost performance by reducing cost, eliminating waste, and reducing process variation. In the 20th<\/sup> century, this philosophy revolutionized manufacturing. It is largely based on the idea that any process, however \u201ccomplicated\u201d, if it is repeatable, can be managed, measured, and improved. We built rocket ships this way. This is also how we secure our financial system- by understanding the linear nature of the possible transactions and introducing controls.<\/p>\nComplex Systems:<\/strong> Healthcare delivery does NOT function in a linear, predictable way. Healthcare is often delivered in an urgent setting, each patient\u2019s care pathway may be individualized (even if their disease and symptoms appear similar), interactions with their care team could be more ad-hoc depending upon availability. At its most basic, healthcare is not linear or predictable- it is complex. Regardless of the disease state, the specialty, or organization, healthcare delivery is complex- not easily predicted, non-linear, and may appear (on the surface) unstructured or ad-hoc.<\/em><\/p>\nResearch has determined that this complexity is the primary driver of cybersecurity breaches. When information exchanges are ad-hoc and non-linear it is nearly impossible to analyze, test, and control an organization\u2019s security posture. The most complex healthcare systems \u2014 with the largest varieties of health service referrals from one hospital to another \u2014 were 29% more likely to be breached than average. 1<\/sup><\/p>\nA Regulatory Maze: Preparing for Tomorrow\u2019s HIPAA Security Rule<\/strong><\/h2>\nThe HIPAA Security Rule is currently undergoing its most significant transformation in over two decades, shifting from a flexible \u201cchecklist\u201d mentality to a rigorous \u201ccybersecurity architecture\u201d standard. As of March 2026, the Department of Health and Human Services (HHS) is finalizing a major overhaul of the HIPAA Security Rule<\/strong> that effectively eliminates the long-standing distinction between \u201crequired\u201d and \u201caddressable\u201d safeguards. While these new standards are expansive and may feel overwhelming, a systematic approach to Zero Trust that takes into consideration the inherent complexity in the healthcare industry can provide a roadmap for improved security maturity.2<\/sup><\/p>\nCisco\u2019s Approach<\/strong><\/h2>\nWe understand the size of the elephant when it comes to healthcare cybersecurity, therefore we choose a bite-by-bite approach. When we look at a Zero Trust strategy, we tend to break it down into three focus areas: Workforce, Workload, and Workplace.<\/p>\n
This approach to Zero Trust allows us to prioritize and make incremental progress on security controls and policies that are needed to scale. Each focus area has particular priorities that are critical to a fully developed Zero Trust strategy:<\/p>\n
\n- Workforce:<\/strong> In healthcare we are thinking about secure remote connectivity (both for contractors, employees, and 3rd<\/sup> parties), multi-factor authentication (MFA), role-based access controls, dynamic secure connectivity (SASE), monitoring of AI model usage, access, and information transmitted.<\/li>\n
- Workload:<\/strong> By combining strong workforce controls with application micro segmentation and monitoring, as well as a comprehensive AI Governance strategy that includes DevOPs security and guardrails, the crown jewels can be better defended and in the event of a breach the blast radius will be greatly reduced.<\/li>\n
- Workplace:<\/strong> One of the biggest challenges in healthcare is visibility and context- this is increasingly challenging when it comes to medical devices. In order to properly set network access controls (NAC) as well as segmentation policies it is critical to have the right technologies and enforcement strategy defined and in place.<\/li>\n<\/ul>\n
\u00a0<\/strong>Cisco has a comprehensive portfolio of security solutions to help address the new HIPAA Security Rule standards. We also offer consultative services and assessments to help you evaluate your security posture and support your efforts to meet your compliance obligations.<\/p>\nHow Can We Help?<\/strong><\/h2>\nThe Customer Experience (CX) Healthcare Practice at Cisco is comprised of individuals who have experience in many different areas of the healthcare industry. We understand the unique challenges that the industry faces and work to help align technologies to healthcare specific outcomes. If you are interested in discussing your HIPAA Security Rule readiness, overall cybersecurity maturity, or our other advisory services, please reach out to use directly at: cxhealthcarebd@cisco.com.<\/p>\n
\n- Tanriverdi, H\u00fcseyin, et al. \u201cTaming Complexity in Cybersecurity of Multihospital Systems: The Role of Enterprise-wide Data Analytics Platforms.\u201d MIS Quarterly<\/em>, vol. 48, no. 1, 2024, https:\/\/doi.org\/10.25300\/MISQ\/2024\/17752.<\/li>\n
- Modernizing Cybersecurity for Healthcare<\/em>. Cisco, 2026.<\/li>\n<\/ol>\n
\u00a0<\/p>\n<\/p><\/div>\n
Complex Systems:<\/strong> Healthcare delivery does NOT function in a linear, predictable way. Healthcare is often delivered in an urgent setting, each patient\u2019s care pathway may be individualized (even if their disease and symptoms appear similar), interactions with their care team could be more ad-hoc depending upon availability. At its most basic, healthcare is not linear or predictable- it is complex. Regardless of the disease state, the specialty, or organization, healthcare delivery is complex- not easily predicted, non-linear, and may appear (on the surface) unstructured or ad-hoc.<\/em><\/p>\n Research has determined that this complexity is the primary driver of cybersecurity breaches. When information exchanges are ad-hoc and non-linear it is nearly impossible to analyze, test, and control an organization\u2019s security posture. The most complex healthcare systems \u2014 with the largest varieties of health service referrals from one hospital to another \u2014 were 29% more likely to be breached than average. 1<\/sup><\/p>\n The HIPAA Security Rule is currently undergoing its most significant transformation in over two decades, shifting from a flexible \u201cchecklist\u201d mentality to a rigorous \u201ccybersecurity architecture\u201d standard. As of March 2026, the Department of Health and Human Services (HHS) is finalizing a major overhaul of the HIPAA Security Rule<\/strong> that effectively eliminates the long-standing distinction between \u201crequired\u201d and \u201caddressable\u201d safeguards. While these new standards are expansive and may feel overwhelming, a systematic approach to Zero Trust that takes into consideration the inherent complexity in the healthcare industry can provide a roadmap for improved security maturity.2<\/sup><\/p>\n We understand the size of the elephant when it comes to healthcare cybersecurity, therefore we choose a bite-by-bite approach. When we look at a Zero Trust strategy, we tend to break it down into three focus areas: Workforce, Workload, and Workplace.<\/p>\n This approach to Zero Trust allows us to prioritize and make incremental progress on security controls and policies that are needed to scale. Each focus area has particular priorities that are critical to a fully developed Zero Trust strategy:<\/p>\n \u00a0<\/strong>Cisco has a comprehensive portfolio of security solutions to help address the new HIPAA Security Rule standards. We also offer consultative services and assessments to help you evaluate your security posture and support your efforts to meet your compliance obligations.<\/p>\n The Customer Experience (CX) Healthcare Practice at Cisco is comprised of individuals who have experience in many different areas of the healthcare industry. We understand the unique challenges that the industry faces and work to help align technologies to healthcare specific outcomes. If you are interested in discussing your HIPAA Security Rule readiness, overall cybersecurity maturity, or our other advisory services, please reach out to use directly at: cxhealthcarebd@cisco.com.<\/p>\n \u00a0<\/p>\n<\/p><\/div>\nA Regulatory Maze: Preparing for Tomorrow\u2019s HIPAA Security Rule<\/strong><\/h2>\n
Cisco\u2019s Approach<\/strong><\/h2>\n
\n
How Can We Help?<\/strong><\/h2>\n
\n