With Cybersecurity Awareness Month underway and MSP Summit fresh in our minds, we’re bringing a message from the event to healthcare security leaders and partners: Cybersecurity has a blind spot: Internal Risk.
Ransomware gets the attention it deserves. CISOs are working to prevent PHI breaches, system outages, and interruptions to patient care. But while defending against the next outside attack, hospitals also need to watch what happens inside. Who is accessing patient information, and do they have a legitimate reason?
Ransomware deserves the attention it gets
HIPAA Journal’s first-half 2026 report identified 397 reported healthcare breaches affecting 500 or more individuals. Of those, 343 were classified as hacking or IT incidents, approximately 86%. That category includes ransomware and other cyber incidents; it is not a ransomware-only count.
The operational consequences explain why this work stays near the top of a CISO’s agenda. Protecting the availability of clinical systems is part of protecting patients.
Healthcare organizations and their security partners should keep several priorities in focus:
- Close known entry points. Prioritize exploited vulnerabilities, secure remote access, and maintain an accurate inventory of systems and connected devices.
- Strengthen account security. Use unique passwords, approved password managers, and phishing-resistant multifactor authentication wherever feasible. Avoid shared credentials and separate administrative accounts from everyday accounts.
- Limit how far an attacker can move. Segment networks and restrict access according to job responsibilities.
- Practice keeping care moving. Test protected backups, restoration procedures, incident response, and clinical downtime workflows. Include scenarios where a critical vendor is unavailable.
These recommendations align with HHS healthcare cybersecurity guidance, which emphasizes vulnerability management, stronger authentication, segmentation, and incident planning.
Internal privacy risk extends beyond the headlines
Recent breach reporting shows why internal privacy risk deserves continued attention:
- 2024: HIPAA Journal’s annual report identified 114 large unauthorized access/disclosure incidents.
- 2025: 128 incidents, with HIPAA Journal reporting a 17.4% increase over its revised 2024 baseline.
- 2026: Already 51 incidents in the first half of the year, with second-half reporting still to come.
These reports cover breaches affecting 500 or more individuals. The category includes snooping, misdirected communications, and improper sharing. Counts can change: the earlier 2024 report listed 114 incidents, while the 2025 report’s chart revised that baseline to 109, which is the basis for its 17.4% increase. Sources: 2024, 2025, H1 2026
The smaller breaches missing from the headline numbers
Those numbers are concerning, but they only tell part of the story. Each incident above affected at least 500 people. Thousands of smaller breaches fall outside those totals.
OCR’s annual reports show how much that leaves out:
- 2022: 63,966 smaller breaches, including 59,727 unauthorized access or disclosure incidents.
- 2023: 68,315 smaller breaches, including 64,231 unauthorized access or disclosure incidents.
- 2024: 74,299 smaller breaches, including 69,773 unauthorized access or disclosure incidents.
In 2024, 94% of smaller breaches involved unauthorized access or disclosure. OCR noted that many involved employees improperly accessing records of coworkers, family, friends, and others. This category also includes mistakes and other improper disclosures, so these are not snooping-only figures. Sources: OCR 2022, 2023, 2024
Smaller-breach totals for 2025 and 2026 have not yet been published. These historical figures show why the 51 large incidents reported in the first half of 2026 capture only part of the privacy risk. But these numbers serve as a reminder that a privacy incident does not need to affect hundreds of people to expose a serious gap. One employee opening one patient’s chart without a work-related reason deserves attention.
A valid login does not establish a valid reason
That is the internal risk hospitals need to watch alongside ransomware. Someone already inside may have a valid login and no legitimate reason to open a particular record. Strong authentication helps establish who is accessing a system. Patient privacy monitoring helps determine whether the access makes sense.
An employee may need broad EHR access to perform their job. That does not give them a work-related reason to view a neighbor’s diagnosis, check a coworker’s treatment, or follow a high-profile patient’s care. Internal risk also includes mistakes, such as sending information to the wrong recipient or using an unapproved sharing method. Training, access controls, and monitoring each address different parts of that risk.
A June 2026 HIPAA Journal report provides a concrete example: approximately 8,600 individuals were affected after a Washington Department of Social and Health Services employee accessed client records for reasons unrelated to their duties. The investigation found no evidence that diagnoses, treatment information, or chart notes were accessed, but the records included sensitive personal information.
Incorporate AI into patient privacy monitoring
If your privacy team is reviewing thousands or millions of access events, manual audits alone can leave suspicious activity buried in routine work. Evaluate AI-driven patient privacy monitoring tools that analyze access patterns, add context, and prioritize events for human review.
IBM’s 2026 Cost of a Data Breach Report found that organizations extensively using security AI and automation identified and contained breaches in an average of 215 days, compared with 280 days for those using neither. Their average breach costs were also $1.93 million lower: $4 million versus $5.93 million. These are global findings across industries, rather than HIPAA-specific reporting times or fine reductions.
For patient privacy teams, the practical opportunity is to spend less time sorting through access logs and more time investigating meaningful risk. Look for tools that combine EHR activity with HR and third-party system data, prioritize suspicious access, and support investigation documentation. Keep trained reviewers responsible for determining whether access was appropriate and what response is required.
Close the internal privacy gap
When potentially inappropriate access is identified, privacy, security, HR, and relevant managers need a clear process for preserving evidence, limiting further exposure, investigating the circumstances, and documenting the outcome to remain HIPAA compliant.
Haystack™ iS brings EHR audit logs, HR data, and access activity from third-party applications into one platform. AI-driven analytics help reduce false positives and prioritize suspicious activity, while investigation workflows and reporting help privacy teams review, document, and respond more efficiently. Importantly, as privacy teams are preparing for the new HIPAA Security Rule update expected in July 2027, our patient privacy monitoring software provides historical reports that assist with fully completing your HIPAA assessment including the information involved, the unauthorized user, whether it was actually inappropriate, and the mitigation steps taken.
Protecting healthcare requires visibility into both attempted intrusions and the use of trusted access. You know who can access PHI. Do you know how they are using that access? Speak with one of our privacy experts today for a more in depth conversation.