• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Skip to secondary sidebar
  • Skip to footer

  • Opinion
  • Health IT
    • Behavioral Health
    • Care Coordination
    • EMR/EHR
    • Interoperability
    • Patient Engagement
    • Population Health Management
    • Revenue Cycle Management
    • Social Determinants of Health
  • Digital Health
    • AI
    • Blockchain
    • Precision Medicine
    • Telehealth
    • Wearables
  • Life Sciences
  • Investments
  • M&A
  • Value-based Care
    • Accountable Care (ACOs)
    • Medicare Advantage

Healthcare Cybersecurity Benchmarking Study 2025: Key Findings

by Fred Pennic 04/11/2025 Leave a Comment

  • LinkedIn
  • Twitter
  • Facebook
  • Email
  • Print

What You Should Know: 

– A recent report KLAS report has shed light on the ongoing cybersecurity challenges facing the healthcare industry, emphasizing the ripple effects of breaches like the 2024 Change Healthcare incident.

– The new KLAS study, the “Healthcare Cybersecurity Benchmarking Study 2025,” has analyzed the self-reported cybersecurity practices of 69 healthcare and payer organizations, revealing both progress and persistent vulnerabilities in the industry. 

– The study was a collaborative effort involving several organizations, including KLAS Research, Censinet, the American Hospital Association, Health-ISAC, the Healthcare & Public Health Sector Coordinating Councils, and the Scottsdale Institute.

Strengthening Healthcare Cybersecurity Resiliency Through Industry Best Practices & Cybersecurity Frameworks

Conducted from September to December 2024, the study emphasizes the significant impact of events like the Change Healthcare breach, which exposed the fragility of connections within the healthcare ecosystem. The findings of the study highlight the ongoing challenges healthcare organizations face in maintaining strong cybersecurity posture. The increasing reliance on third-party vendors and the adoption of new technologies like AI introduce new vulnerabilities that must be addressed proactively. 

Here are six key findings from the report: 

1. Reactive vs. Proactive Cybersecurity: Healthcare organizations continue to prioritize reactive measures, with strong coverage in “Respond” and “Recover” functions of the NIST Cybersecurity Framework (CSF) 2.0, indicating a focus on incident response and recovery. However, proactive measures, particularly in Supply Chain Risk Management and Asset Management, remain weak.  

2. Third-Party Risk: A Major Concern: The report highlights the increasing number of third-party breaches in healthcare, emphasizing the urgent need for better Supply Chain Risk Management. Effective asset management is crucial to mitigate these risks, requiring organizations to have a comprehensive understanding of their assets, including those provided by third parties.  

3. NIST CSF 2.0 Adoption Benefits: Organizations using NIST CSF 2.0 as their primary framework reported lower increases in cybersecurity insurance premiums, demonstrating a tangible financial benefit to strong cybersecurity preparedness.  

4. HPH CPGs Analysis: Similar to the NIST CSF 2.0 findings, the study reveals that third-party risk management and asset management are areas needing improvement within the Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs).  

5. AI Risk Management: As healthcare organizations increasingly adopt AI, the study emphasizes the importance of establishing robust AI governance. Unlike traditional cybersecurity programs with strong CISO ownership, AI risk management requires a cross-departmental approach to address risks related to data bias, transparency, clinical workflows, privacy, and ethics.  

6. HICP Gaps: While healthcare organizations generally have strong email protection systems, significant gaps persist in medical device security. This aligns with the broader challenges in asset management and third-party risk management identified in the report. 

  • LinkedIn
  • Twitter
  • Facebook
  • Email
  • Print

Tagged With: Cybersecurity

Tap Native

Get in-depth healthcare technology analysis and commentary delivered straight to your email weekly

Reader Interactions

Primary Sidebar

Subscribe to HIT Consultant

Latest insightful articles delivered straight to your inbox weekly.

Submit a Tip or Pitch

Featured Interview

Reach7 Diabetes Studios Founder Chun Yong on Reimagining Chronic Care with a Concierge Medical Model

Most-Read

Particle Health Addresses Integration to Epic Data Despite Dispute

US Court Allows Particle’s Antitrust Claims Against Epic to Proceed

Epic Launches Comet: A New AI Platform to Predict Patient Health Journeys

Epic Launches Comet: A New AI Platform to Predict Patient Health Journeys

Preparing for the ‘Big Beautiful Bill’: How Digitization Can Streamline Medicaid Eligibility & Social Care Delivery

Preparing for the ‘Big Beautiful Bill’: How Digitization Can Streamline Medicaid Eligibility & Social Care Delivery

Evernorth Health Services Invests $3.5B in Shields Health Solutions

Evernorth Health Services Invests $3.5B in Shields Health Solutions

KLAS Report: Oracle Health Faces Customer Losses and Declining Satisfaction

KLAS Report: Oracle Health Faces Customer Losses and Declining Satisfaction

Tempus AI Acquires Digital Pathology Leader Paige for $81.25M

M&A:Tempus AI Acquires Digital Pathology Leader Paige for $81.25M

Mira Launches Ultra4™, the First At-Home Hormone Monitor with Lab-Quality Insights

Femtech: Mira Launches Ultra4™, the First At-Home Hormone Monitor with Lab-Quality Insights

How Healthcare CIOs Can Solve the Unstructured Data Crisis and Reduce Storage Costs

How Healthcare CIOs Can Solve the Unstructured Data Crisis and Reduce Storage Costs

Healthcare C-Suite Acknowledges AI Potential but Lacks Trust

Sage Growth Partners Report: Healthcare C-Suite Acknowledges AI Potential but Lacks Trust

EVERSANA and Waltz Health Merge to Redefine Pharmaceutical Commercialization

EVERSANA and Waltz Health Merge to Redefine Pharmaceutical Commercialization

Secondary Sidebar

Footer

Company

  • About Us
  • Advertise with Us
  • Reprints and Permissions
  • Submit An Op-Ed
  • Contact
  • Subscribe

Editorial Coverage

  • Opinion
  • Health IT
    • Care Coordination
    • EMR/EHR
    • Interoperability
    • Population Health Management
    • Revenue Cycle Management
  • Digital Health
    • Artificial Intelligence
    • Blockchain Tech
    • Precision Medicine
    • Telehealth
    • Wearables
  • Startups
  • Value-Based Care
    • Accountable Care
    • Medicare Advantage

Connect

Subscribe to HIT Consultant Media

Latest insightful articles delivered straight to your inbox weekly

Copyright © 2025. HIT Consultant Media. All Rights Reserved. Privacy Policy |