Rural hospitals and small medical practices must be creative and open-minded in when it comes locking down their digital footprint, said Jim Roeder, vice president of IT at Lakewood Health System. There's help from the private- and public-sectors and open source tools.

As healthcare providers and their vendors develop and implement agentic artificial intelligence and other AI tools, they need to throughly understand data privacy risks under HIPAA and other laws, said attorney Jordan Cohen of law firm Akerman LLP.

The flood of new artificial intelligence tools, including those to help cybersecurity teams, can overwhelm healthcare CISOs and their security staff, fueling "AI fatigue" that in itself can create additional cyber risk, said Drew Henderson and Jon Hilton, practice leaders at consulting firm LBMC.

Smaller and rural hospitals and clinics, as well as federally qualified health centers, are constantly battling cybersecurity resource constraints, and especially serious workforce shortages, said Jennifer Stoll of OCHIN, a nonprofit provider of health IT services and products.

Identity security is still one of the most underinvested areas of cybersecurity across the healthcare sector, regardless of the depth of cyber resources available to many different types and sizes of entities, said Hugo Lai, CISO at Temple University Health System.

While healthcare organizations often know in general what they need to do in case they're faced with a ransomware attack, the devil is in the details of how comprehensive and well-rehearsed that incident preparedness plan is for optimal response, said Rick Doten, vice president and healthplan CISO at Centene Corp.

It's only a matter of time before cybercriminals begin to use artificial intelligence-enabled tools, open-source software and other technologies to launch attacks to exploit sensitive genetic data, said Nicholas Morris, a practice manager at security firm Optiv.

Emerging artificial intelligence and machine learning technologies being applied in the health and wellness space that are not necessarily covered by HIPAA but instead fall under a variety of tough new state privacy laws that are being enacted, said attorney Lily Li of Metaverse Law.

Pharmaceutical companies typically have more mature cyber programs than other healthcare factions, but these firms also face unique risks involving their large attack surfaces, complex manufacturing, supply chains and sensitive intellectual property, said Joshua Mullen of Booz Allen Hamilton.

Although the National Institutes of Health appears to have scaled back plans to build a national registry to track individuals with autism, the agency's research project still poses critical data privacy concerns, said Ariana Aboulafia and Andrew Crawford of the Center for Democracy and Technology.