insider threats to patient data

For the 14^th year in a row, the Healthcare and Pharmaceutical industries remain the most targeted by cyber criminals, and the costliest per incident. According to the 2025 Ponemon Report: Cost of a Data Breach, Healthcare’s attack costs per incident are nearly double the averaged individual costs reported in other verticals. Additionally, Healthcare breaches take roughly five weeks longer to identify and contain when compared to other sectors. There are myriad reasons for healthcare’s inflated breach costs: elevated data value stemming from extensive personal patient information, significant regulatory fines for HIPAA violations, lawsuits and legal fees, and highly complex incident responses which take longer to fix.

But why is healthcare so popular? Cybercriminals are a lot like schoolyard bullies—they target out those who a.) have a lot of lunch money, and b.) those who put up the least amount of resistance in the face of duress. Knowing that healthcare systems can ill afford prolonged service interruptions, they historically do whatever it takes to restore operations as quickly as possible, which increases the likelihood of ransom payments. They also know that the larger attack surfaces that exist in healthcare systems exponentially increase the odds of an attack’s success—like a dartboard with an 18” bullseye. Consider these 3 common traits found in literally every healthcare system: Complexity of networked–often dated–technologies and machines, numerous third parties with access to myriad internal systems, and most critical, a stressful, frenetic work environment for fatigued employees which can often lead to security policy negligence and data management errors. This last trait is a major contributor to what constitutes an Insider Threat, which on its own accounted for nearly 79% of data breaches in healthcare in 2024.

Protecting the network and patient data inside of the firewall remains a constant challenge. But knowing that nearly 80% of cyberattacks emanate from internal threat, and more than half of those internal attacks occur on an employee’s personal device or network, internal threat defense should carry equal or greater importance as external threat defense. As the healthcare industry increasingly steers toward becoming mobile, protecting employee endpoint devices outside of the firewall greatly expands the degree of difficulty. Malicious insiders and ever-evolving attacks from the outside will never go extinct. But eliminating the accidental and outsmarted insider threats—controlling the things that are within your control—is a goal that is within reach.

Ongoing internal threat risk management programs must be mandatory for all employees who have access to the network. Complete employee comprehension and buy-in to security policies must be enforced.

• All employee endpoint devices must be vetted, whitelisted, and updated regularly.

• Only secured networks may be used for personal devices that are also used for work.

• Patient and company data must be encryption-protected at all times.

To ensure that data and operational recovery can be achieved post-cyberattack, all employees must regularly back up sanitized data redundantly to offline, encrypted external drives such as Apricorn Aegis Secure Keys, Aegis Padlock, Fortress, and the high-speed Aegis NVX.