< + > IoT and ransomware are big security risks, and health systems feel unprepared

"The usage of AI and automatic vulnerability scanning performed by the attackers allows them to find an exposed IoT device and conduct an attack on it much quicker than they used to be able to," says one security researcher in a new report.

< + > UVA Health RAMPs up AI and real-time analytics

The success the health system has had with its real-time analytics monitoring platform, RAMP, is the focus of an artificial intelligence-themed session at HIMSS25 in March.

< + > What will AI do for telemedicine in 2025? More than you might think

Computer vision and sensor integration, evolution in virtual specialty care and other innovations are transcending the hype cycle and showing results, says one telehealth leader.

< + > Healthcare Cybersecurity – 2025 Health IT Predictions

As we wrap up another year and get ready for 2025 to begin, it is once again time for everyone’s favorite annual tradition of Health IT Predictions! We reached out to our incredible Healthcare IT Today Community to get their insights on what will happen in the coming year and boy did they deliver. We in fact got so many responses to our prompt this year, that we have had to narrow them down to just the best and most interesting. Check out the community’s predictions down below and be sure to follow along as we share more 2025 Health IT Predictions!

Check out our community’s Healthcare Cybersecurity predictions:

Bill Murphy, Director of Security and Compliance at LeanTaaS
As we enter 2025, AI is revolutionizing cyber threats in concerning ways. Cybercriminals are leveraging AI to craft highly persuasive phishing campaigns that overcome traditional red flags. With AI tools, attackers, especially those operating from outside the U.S., can generate highly convincing messages without easy-to-spot indicators like poor grammar or awkward phrasing. By analyzing targets’ digital footprints, AI enables highly personalized attacks that are increasingly indistinguishable from legitimate communications. The accessibility of AI tools has dramatically lowered barriers to entry for cybercrime, enabling less sophisticated actors to launch complex attacks that previously required significant technical expertise and resources.

Deepfake technology presents another critical threat, with AI-generated video and voice content enabling unprecedented impersonation attacks. Recent incidents involving fake video calls and voice cloning demonstrate the technology’s potential for sophisticated fraud. Perhaps most concerning is how AI’s perceived authority may lead users to accept its outputs without verification. As organizations integrate AI systems, they face a dual challenge: protecting against AI-enabled attacks while ensuring employees maintain critical thinking and verification practices rather than defaulting to blind trust in AI-generated content.

Joel Burleson-Davis, SVP Worldwide Engineering, Cyber at Imprivata
Identity security challenges in healthcare will make way for a passwordless future. A new GAO report revealed that the Department of Health and Human Services has faced challenges mitigating cybersecurity risks in the healthcare sector. One of the biggest struggles has been identity security, largely attributed to hospitals balancing large workforces, contractors, billing systems, strict compliance and privacy regulations, and the need for quick, always-on access to patient data across multiple shared devices.

While healthcare remains a top target for breaches, next year I anticipate an acceleration in the shift toward passwordless, whether it is adopting passwordless technology or preparing to adopt it, authentication across the healthcare industry. Passwordless authentication is an important step along the path to enhanced security and workflow efficiency, moving organizations from password-based access to fully passwordless workflows over time. For example, masking passwords from users significantly reduces cyber risks and improves clinical workflows today, getting rid of the password entirely only improves that benefit. By adopting passwordless authentication tailored to diverse healthcare workflows, organizations can protect sensitive data, boost operational efficiency, and enhance patient care.

Kel Pults, DHA, MSN, RN-BC, NREMT, Chief Clinical Officer and VP Government Strategy at MediQuant
In 2025, healthcare organizations are likely to significantly increase budgets for cybersecurity and infrastructure projects in response to the large breaches of recent years. This heightened focus on data protection may drive greater adoption of SaaS models. Organizations will also prioritize gap analyses to identify vulnerabilities, addressing both external threats from bad actors and internal risks, whether intentional or inadvertent. By proactively strengthening defenses and mitigating risks, healthcare providers can better safeguard their systems and maintain trust in an increasingly challenging digital environment.

Ty Greenhalgh, Industry Principal of Healthcare at Claroty
Critical vulnerabilities in healthcare’s supply chain pose significant risks to patient care. Proactively identifying and securing these choke points is essential to minimizing disruption and safeguarding vital resources. The recent attacks on organizations like Change Healthcare and One Blood highlight the importance of understanding and protecting these critical facilities. The need to address weaknesses in the healthcare supply chain is more pressing than ever for these organizations.

By mapping out the workflows and dependencies within the healthcare supply chain, especially focusing on third-party access, organizations can pinpoint areas of vulnerability and implement robust security measures. This includes segmenting the supply chain, identifying connections, and reviewing access credentials. If Change Healthcare had mapped out and understood the access their third-party vendors had, the detrimental impacts of this breach could have been significantly reduced.

To be prepared for evolving threats in 2025, healthcare organizations must adopt a proactive approach to security. By thoroughly mapping out third-party access points and continuously reviewing security protocols, providers can significantly reduce the severity of attacks and ensure continuity of care and the availability of essential medical supplies.

Tony Lauro, Senior Director, Security Technology and Strategy at Akamai Technologies
As we move into 2025, the healthcare industry faces a growing threat from ransomware attacks, with far-reaching consequences, as we saw in this year’s cyberattack on Ascension Hospitals. Healthcare organizations highly value reputation and attackers know they will pay to avoid controversy. Conversely, rural hospitals, in particular, will become increasingly attractive targets due to the desperation factor, which significantly influences the likelihood of ransom payments. Once considered “off limits,” healthcare facilities under immense stress and with limited resources are expected to become prime targets for cybercriminals.

Petros Efstathopoulos, VP of Research at RSAC
Healthcare IT will overhaul identity management in 2025 with AI and ‘decentralized identity.’ In 2025, healthcare IT will face increasing pressure to modernize their identity security protocols to combat increasing cyber threats and meet operational demands. The Change Healthcare ransomware attack, which stemmed from a lack of MFA, highlighted the urgent need for stronger identity protections. And as AI-powered tools become central to healthcare, AI-driven IAM will be crucial for securely managing human and machine identities.

Patient-centric access controls enabling granular data privacy protections will also be key to maintaining trust and regulatory compliance. While decentralized digital identity approaches are still in the early stages, they offer a glimpse of a more secure, interoperable future for the industry. Healthcare leaders who invest in advanced IAM now will strengthen their defenses and position organizations for long-term success in an increasingly connected and risky ecosystem.

Michael McNerney, SVP of Security at Resilience
2025 is shaping up to be the most challenging year on record for the healthcare industry when it comes to cybersecurity. Health plans, providers, insurers, and others are facing a perfect storm: the new presidential administration has injected renewed uncertainty around policy and regulation; the Change Healthcare attack and subsequent fallout have emboldened other eager hacking groups; continued digitization and interconnectedness have been shown to open up new points of failure simply waiting to be exploited; and an expected rise in M&A in the sector has the potential to introduce entirely new kinds of vulnerabilities as two companies come together. It’s not all doom and gloom, though.

Often, a perfect storm like this is, unfortunately, exactly what’s needed for an industry to wake up to the reality of today’s cyber threat landscape, then act accordingly to pull themselves together and invest in safeguards and thorough risk management strategies that they may have previously lacked. Airlines had their own security wake-up call over the summer after the CrowdStrike outage; while that doesn’t necessarily mean I predict a 2025 outage of that magnitude for the healthcare sector, I do believe that the challenges facing healthcare now are so novel and dangerous that we may very well end up seeing a more resilient version of the industry by 2026.

Cecil Pineda, SVP, Chief Information Security Officer at R1
By 2025, the rise of digital tools, AI, and automation in revenue cycle management will amplify the need for robust cybersecurity measures. Providers must deploy advanced threat detection and real-time monitoring systems to protect sensitive patient and financial data from increasingly sophisticated cyberattacks. Integrating proactive security protocols and automated responses will safeguard revenue cycle operations from breaches and downtime, ensuring compliance and preserving trust. These measures will be essential to maintaining the integrity of healthcare financial systems in an interconnected, high-tech landscape.

David Deas, CTO at Red Rover Health
The escalating threat of cyberattacks in healthcare will demand a proactive approach to data security in 2025. Organizations will prioritize advanced cybersecurity frameworks to safeguard sensitive patient and organizational data while maintaining trust. Seamlessly integrated security measures that protect systems without disrupting workflows will become a baseline requirement as healthcare continues to digitize and expand its reliance on interconnected networks.

Robert Bobel, Founder and CEO at Cayosoft
Nation-state-run ransomware groups will sharpen their focus on critical infrastructure organizations and their supply chains. In early 2024, we saw ransomware groups shed what ethics they had to target large organizations that served critical functions for society – Change Healthcare and Ascension Healthcare being prime examples. Traditionally considered off-limits as targets, the disruption and urgency caused by such attacks create Catch-22 scenarios in which targets more reliably paid high ransoms for quick resolutions. For this reason, I expect we’ll see increasingly daring ransomware attacks against critical infrastructure targets in 2025. In response, we’ll see a sharp increase in disaster recovery demand to complement the defense solutions on the frontlines.

Richard Wallace, Cyber Security Threat Analyst at Vercara
In the past year alone, nearly 400 healthcare institutions were successfully hit by ransomware. Healthcare organizations have become lucrative targets for cybercriminals due to the value of their nature, considering things like sensitive data and protected health information (PHI), the urgent need for data access, the use of legacy systems and software, and critical, time-sensitive services. In 2025, we’ll likely see increasing threats in the sector, but on a larger scale, as attackers become more sophisticated and use more advanced techniques like AI to make detection more difficult for security teams. Organizations must improve visibility across the network, endpoints, devices, and partners to keep pace with more attacks next year. Organizations should also consider using enhanced access controls and DNS solutions to counteract attacks like ransomware.

Yuval Wollman, Chief Cyber Officer at UST
In 2025, cybersecurity will be the top business function benefiting from AI, and analysts report they are seeing time savings of 40% on core tasks, including investigation. Specifically for incident response, Generative AI will augment security operations teams to boost detection capabilities and reduce the alert backlog analysis within the SOC. Furthermore, it will continue to enable healthcare security professionals without a full developer skill set to perform detection-as-code-related tasks, enhancing the overall efficiency and effectiveness of security operations teams for healthcare organizations.

This, in turn, will reduce the Mean Time to Detect (MTTD) as well as the Mean Time to Resolve (MTTR), a crucial task when these metrics have a real-world impact on human safety and patient care. While healthcare data will always be valuable to attackers, healthcare organizations in 2025 will reduce the likelihood of a breach through Cyber Threat Intelligence (CTI) services that reveal any exposed security risks. In particular, CTI leads automatically correlate with environmental logs to help identify suspicious behaviors early, and analysis of C2 architecture and metadata can assist further.

Additionally, if the worst occurs, healthcare organizations can limit the fallout from an attack by prioritizing the development of an incident response plan and working with outsourced MDR/MXDR vendors to fill gaps in expertise and resources. This also allows them to leverage the latest advancements in AI and automation without spending time and resources to build or develop in-house. With so many fires to fight (79% of security teams say they currently have 500 or more alerts open), there is no longer a way to ensure a truly risk-free enterprise environment. Instead, what McKinsey dubbed a risk-based model for security back in 2019 will be more crucial in 2025 than ever.

Anand Naik, CEO at Sequretek
As healthcare’s reliance on digital systems deepens, cybersecurity in 2025 must tackle the complexities of interconnected networks managing patient data. AI-powered security will transform threat detection, utilizing machine learning models trained on global intelligence feeds to recognize and mitigate cyber risks in real-time. Generative AI will accelerate proactive threat hunting and attack path analysis, addressing vulnerabilities before breaches occur. Autonomous parsing and advanced contextual analytics will simplify threat identification across diverse endpoints, including IoT devices and telehealth platforms. Zero-trust frameworks will integrate with AI-driven capabilities, ensuring continuous verification at every access point.

Blockchain-inspired solutions, combined with AI-driven attack surface management, will secure data interactions, enhancing both transparency and resilience. Leveraging extensive threat intelligence, healthcare systems can pre-emptively defend against sophisticated attacks while ensuring data integrity. By embedding these robust AI and blockchain-enabled security measures, healthcare providers will demonstrate a solid commitment to protecting patient information. This approach will foster patient trust and ensure safe, resilient operations in a rapidly evolving digital landscape.

Steve Cagle, CEO at Clearwater
In 2025, healthcare organizations will continue to advance their cybersecurity and risk management programs, building on the progress we’ve seen. Many have already embraced industry best practices, conducting business impact analyses to identify critical systems, developing robust continuity plans, and practicing incident response. Those lacking internal resources are partnering with expert providers to strengthen their defenses.

Next year, we expect broader adoption of these proactive measures as awareness grows among business leaders, making cyber risk management a priority. Organizations will increasingly invest in long-term strategies to tackle evolving threats and secure both legacy and emerging technologies. However, progress won’t be universal. Healthcare remains a critical infrastructure sector, and we cannot depend solely on voluntary action. Anticipate new regulations, enhanced enforcement, and potential funding initiatives, especially for underserved hospitals, to drive accountability and ensure patient safety in an era of growing cyber.

Vijaya Krishna Veeravalli, Senior Vice President – Cloud Engineering at AGS Health
In 2025, the healthcare sector’s cybersecurity landscape will be shaped by evolving ransomware tactics, increased regulatory pressures, and the integration of advanced AI-driven defenses. As the threat of ransomware attacks pose risks and disruptions to operations and patient care, healthcare providers will need to adopt proactive measures to prevent service delays and protect patient safety. Financial impacts will likely escalate, with healthcare organizations not only incurring direct ransom demands but also higher costs related to compliance, cybersecurity improvements, and reputational recovery. AI will play a larger role in cybersecurity, with new AI-powered tools providing enhanced detection and automated response capabilities.

However, as AI itself becomes a target for cybercriminals, healthcare IT leaders must implement rigorous oversight to manage these tools responsibly. To stay resilient, organizations should prioritize advanced strategies like network segmentation, vulnerability disclosure policies, and regular third-party assessments. Additionally, proactive approaches, such as reducing dependence on legacy systems, applying multi-factor authentication, and maintaining a strict security patch schedule, will be critical to maintaining robust defenses against both established and emerging threats.

Heather Randall, PhD, Chief Compliance Officer at TrustCommerce, a Sphere Company
With healthcare organizations constantly under threat of data breaches and cybersecurity incidents, they must continue to take new steps to protect themselves against the increasing sophistication of these threats. For example, AI offers new ways for bad actors to illegally access sensitive data, making it imperative that providers and staff members limit access to patient data, evolve their risk analyses to adapt to the changing threat landscape, and regularly review their control environment to ensure it’s appropriate to their level of risk.

Ganesh Nathella, Senior Vice President and General Manager – HLS Business at Persistent Systems
By 2025, the intersection of AI and cybersecurity will redefine how healthcare systems protect sensitive data. As healthcare networks grow more complex, AI will become indispensable in detecting and neutralizing threats in real-time. For instance, machine learning algorithms can flag anomalies, such as unauthorized access to patient records or unusual activity on IoT devices, before damage occurs. Zero-trust frameworks, already a critical part of today’s cybersecurity strategies, will continue to evolve and become more pervasive, ensuring every access point, from wearables to telehealth platforms, is continuously verified.

Additionally, blockchain-inspired technologies may emerge as a standard, offering transparent and tamper-proof data interactions. Imagine a system where every patient data access or modification is logged immutably, ensuring trust and compliance. These advancements are not just about preventing breaches; they’re about reinforcing patient trust. A secure digital environment is critical for the adoption of innovative care models, making cybersecurity a cornerstone of healthcare’s future.

Navroop Mitter, CEO at ArmorText
As companies, venture capitalists, and other stakeholders come to terms with the inevitability of breaches, investments in post-breach preparedness will rise substantially. While regulatory mandates are driving compliance, venture capitalists are recognizing an under-served market: post-breach resilience. Previously dominated by pre-breach cybersecurity tools, the investment landscape is shifting. Organizations, witnessing gaps in their response capabilities following breaches, are increasingly prioritizing incident response planning and testing. This trend is expected to make post-breach resilience the new cornerstone of cybersecurity strategies.

Investments in out-of-band preparedness for incident response and business continuity will also multiply significantly. During incident response, organizations often find themselves unprepared for taking communications out of band securely, a critical gap that leaves them vulnerable. Effective response relies on communications continuity, and organizations will increasingly look to bolster their capabilities to ensure safe and secure out-of-band communication not only for cybersecurity professionals but also to support broader operational resilience across the enterprise.

Thank you so much to everyone who took the time out of their day to submit a prediction to us and thank you to all of you for taking the time to read this article! We could not do this without all of your support. What do you think will happen for Healthcare Cybersecurity in 2025? Let us know on social media. We’d love to hear from all of you!

Be sure to check out all of Healthcare IT Today’s Healthcare Cybersecurity content and our other 2025 Health IT Predictions.

< + > Stepful Secures $31.5 Million Series B Led by Oak HC/FT to Address U.S. Healthcare Worker Shortage

Investment will Expand Scalable Programs and Partnerships with Healthcare Providers, Aiming to Close Critical Workforce Gaps by 2025

Stepful, the company dedicated to re-imagining healthcare training for allied health professional jobs, today announced it has raised $31.5 million in Series B funding. The round was led by Oak HC/FT with participation from Y Combinator, Reach Capital, AlleyCorp, SemperVirens, Company Ventures, Green Sands, ECMC Education Impact Fund, Intermountain Ventures, and Cedar Pine.

Today, Stepful offers educational training programs for both entry-level positions, including medical assistants, medical admins, and pharmacy technicians, and advanced programs for licensed practical nurses and surgical technicians. Unlike other trade schools, Stepful is an AI-powered learning platform with an accelerated format, lower costs, and placement for students who successfully complete the program. To date, the company has seen strong growth in its business, expanding from 50 students in 2021 to more than 30,000 enrollees projected in 2024. With this new funding, Stepful will expand its B2B offering and continue growing its health system partnerships.

Stepful’s platform is designed for working adults, particularly from historically underserved communities, providing virtual instructor-led courses that include live, cohort-based learning sessions and one-on-one coaching for those looking for entry-level positions in hospitals and healthcare settings. Additionally, the program’s bite-sized, asynchronous, interactive learning modules allow students to manage their studies alongside other commitments, while AI-powered feedback offers personalized support and outreach to ensure students don’t fall behind.

“This funding supports our mission to make healthcare training more accessible while addressing the U.S. shortage of healthcare workers,” said Carl Madi, CEO at Stepful. “It enables us to reach more students, ensuring that our graduates can transition into high-demand roles more quickly, grow our practical nursing offerings, and open new schools in key regions. We’re also enhancing our capabilities to better serve healthcare employers by adding tools for screening and vetting, analytics, on-site learning support and to pursue strategic acquisitions.”

The U.S. healthcare system will face a shortage of 3.2 million allied healthcare workers, nurses, and mental health professionals by 2026, according to the American Hospital Association, which could result in $86 billion in increased expenses and employee burnout. Traditional educational models, such as community colleges and trade schools, often require in-person attendance, have enrollment caps, and are costly—limiting their scalability in addressing these shortages.

Stepful’s approach has yielded industry-leading outcomes, including an 87% NHA CCMA exam pass rate—ten points higher than the national average—and a 75% completion rate. Stepful currently serves 13,000 monthly active students and boasts a network of over 8,000 healthcare partners where students complete hands-on clinical training.

“Stepful is addressing a significant unmet need to mitigate the health professional labor shortage, and they’re doing it while creating a win-win situation for both students and employers,” said Vig Chandramouli, Partner at Oak HC/FT. “The quality and outcomes of Stepful’s program have proven to be superior to current options with higher graduation rates, certification pass rates, and job placement rates, all at a lower cost. We’re proud to partner with Stepful as they scale their impact.”

As the $28 billion healthcare training market continues to grow amidst labor shortages, Stepful is positioning itself as an end-to-end workforce solution for healthcare employers, adding tools like online training, on-site learning support, and analytics. By collaborating with major healthcare providers like Providence, Ohio State University Physicians, and Johns Hopkins All Children’s Hospital, Stepful’s growing B2B segment is positioned to help systems directly feed their labor pool with well-trained, skilled workers.

About Stepful

Stepful offers accelerated, affordable training programs for healthcare roles. Through partnerships with healthcare providers, Stepful connects students to job opportunities after certification. Stepful was co-founded by Carl Madi, Tressia Hobeika, and Edoardo Serra. For more information, visit stepful.com.

About Oak HC/FT

Oak HC/FT is a venture and growth equity firm specializing in investments in fintech and healthcare. Using partnership as a foundation, Oak HC/FT guides companies and founders at every stage, from seed to growth, to create businesses that make a measurable and lasting impact. Founded in 2014, Oak HC/FT has invested in over 85 portfolio companies and has over $5.3 billion in assets under management. Oak HC/FT is headquartered in Stamford, CT, with an office in San Francisco, CA. Follow Oak HC/FT on LinkedIn and X and learn more at oakhcft.com.

Originally announced November 13th, 2024

< + > Merry Christmas!!

As you can probably imagine, we’re taking the day off for Christmas.  We hope you’re enjoying time with the people you love and and are having an amazing holiday.   However, we did take time to create this little holiday video with the Healthcare Scene team to celebrate this holiday season.  Turns out that we have a very multi-lingual team here at Healthcare Scene, so this year we decided to celebrate the holidays in our second language.  We hope you’ll enjoy!

We appreciate each of you in the Healthcare IT Today community.  We’ll be back tomorrow with some more amazing healthcare IT content.

Merry Christmas!

< + > Key Challenges in Maintaining Compliance with Regulatory Standards in the Context of Health Information Management

Rules and regulations are an integral part of life, especially in the world of healthcare where you are dealing with very sensitive information and situations. Though it may not always be clear at first glance, rules and regulations are put in place to help protect people and make things as fair as possible. Where it gets tricky, however, is the span of time between when we implement our systems and when the rules and regulations were written and enacted. During that time span, technology has advanced, new ideas and plans have been created, and what we value may have shifted.

This can result in situations where you are trying to do something new that will be a great benefit to your organization, staff, and/or patients, but it’s extremely complicated to near impossible to do it while maintaining your compliance with current regulations. Or the complete opposite can happen to you. There can be situations where your organization has been functioning in a specific way for a while – only for new regulations to be written and/or old regulations to get updated in such a way that you are suddenly no longer in compliance. Currently, one such tricky area is health information management.

To learn more about this, we reached out to our brilliant Healthcare IT Today Community and asked them — what are the key challenges in maintaining compliance with regulatory standards, such as HIPAA, in the context of health information management? The following are their answers.

Bill Olsen, Co-Founder and CTO at UptimeHealth
The primary challenge in maintaining compliance with regulatory standards like HIPAA in health information management lies in data governance. Strict regulations govern the sharing of Protected Health Information (PHI) to safeguard patient privacy. However, these restrictions can conflict with the need to utilize this data in analytics and AI systems aimed at enhancing patient outcomes. Developing these systems often requires using real or closely approximated statistical data.

John Squeo, Senior Vice President & Market Head, Healthcare Providers at CitiusTech
Maintaining compliance with regulatory standards like HIPAA in health information management is challenging due to the ever-evolving nature of regulations and the increasing complexity of healthcare systems. Additionally, the culpability of health systems for third-party-caused breaches makes privacy assurance and digital security programs even more complex to implement and consistently execute. Furthermore, the growing volume of electronic health records and the need for interoperability between different systems can make it challenging to ensure compliance with all relevant regulations.

Brian Laberge, Solution Engineer, Health Language at Wolters Kluwer Health
Constant evolution to address new technologies that are brought into the healthcare workflow- such as AI-enabled tools that provide Clinical Decision Support to providers or patients or regulations for data sharing across stakeholders, makes it challenging to keep up with the regulatory standards. Further, there are state-specific variations in the laws which makes it challenging for technology vendors to provide solutions with state-specific variations and customizations based on the markets they serve.

All technology platforms aren’t created equal, and the influx of technology companies into healthcare offers an opportunity for risk if these new entrants aren’t taking the proper precautions to protect patient data. There are rules on the transparency of AI models (including HTI-1) and the data they are trained on as well as HIPAA requirements. Health information professionals need to ensure they have a solid data governance process and understand the models they are incorporating into processes to stay compliant. Technology also should have the necessary security certifications to ensure security and data privacy and can control who sees what only when they need to see it. Further, technology platforms should rely on the most current regulatory guidance (annual ICD-10 updates, HCC version model changes, etc.), and should have a process in place to keep track of these updates to ensure compliance.

Bridget O’Connor, Chief Operating Officer (COO) at Fortalice Solutions
The key challenge in maintaining compliance is always remembering that HIPAA compliance goes deeper than the surface level within the organization. It’s more than just completing your annual HIPAA assessment. The remediation items from the assessments need to be tracked through resolution and, in some cases, need to be re-tested or audited to ensure they’ve been addressed. Additionally, with third-party risk being one of the leading causes for breaches, ensure you have a robust Vendor Management Office and process to make sure your vendors (if applicable) are also compliant and ask them to attest to it.

Jason Griffin, MBA, CISM, Managing Director of Digital Health Strategy and Cybersecurity at Nordic Global Consulting
Compliance with regulatory standards like HIPAA presents several key challenges for health information management (HIM) professionals. One significant hurdle is the ever-evolving nature of technology and cybersecurity threats, which require constant vigilance and adaptation. As healthcare organizations increasingly adopt digital solutions and electronic health records (EHRs), the potential for data breaches and unauthorized access escalates. HIM professionals must implement robust security measures and stay informed about the latest regulations and best practices to mitigate risks. Ensuring that all staff are adequately trained in compliance requirements and security protocols further complicates the landscape, as ongoing education is essential to prevent costly violations. Another challenge in maintaining compliance arises from the complexity and diversity of healthcare environments.

Organizations often need help to integrate and standardize data across various systems and departments. Fragmentation can lead to inconsistencies in data handling and privacy measures, making it difficult to ensure the consistent compliance practices needed to meet HIPAA standards. Additionally, the need for collaboration among multiple stakeholders—including healthcare providers, IT personnel, and legal teams—can create communication barriers that hinder compliance efforts. Navigating these challenges requires a concerted effort from HIM professionals to foster a culture of compliance, ensuring that all aspects of health information management are aligned with regulatory standards while safeguarding patient privacy and data security.

Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Product at Cognizant
Maintaining compliance with regulatory standards like HIPAA is increasingly complex, especially as lesser-known aspects of HIPAA grow in significance. Further, compliance extends beyond HIPAA; health information management must navigate a broad range of federal and state-specific regulations. Meeting the demands of this wider regulatory scope is challenging, particularly as regulations constantly evolve and vary by jurisdiction. Organizations must also track regulatory changes impacting other stakeholders, such as providers monitoring payer regulations and vice versa. This is essential because new regulations can open strategic opportunities for data use and influence the timing of technological advances and adoption. The key challenge is staying agile—maintaining data integrity, security, and privacy—while balancing compliance with changing regulatory landscapes and capitalizing on new opportunities.

Susan Clark, Senior Director of Community & Advocacy at DirectTrust
Health information management (HIM) professionals face numerous challenges in maintaining compliance with evolving regulatory standards like HIPAA, particularly as new rules emerge. For instance, the recently finalized HIPAA Reproductive Rule introduces additional consents and attestations for law enforcement, creating complexity around what qualifies as reproductive data. HIM must also balance federal rules with state-specific legislation on data privacy, reproductive or gender-affirming care, and artificial intelligence.

The introduction of the Information Blocking Rule has expanded HIM’s role in data asset management, helping to define and track the flow of information. Yet another challenge is adapting consents to electronic environments, which could reduce the burden on both patients and staff. While some electronic consent systems show promise, standardization and widespread adoption remain limited. But there are many collaborative industry initiatives, including Sequoia Project’s Interoperability Matters Privacy & Consent Workgroup that are trying to create more uniform, compliant, and efficient workflows.

Ram Krishnan, CEO at Valant
Many practices rely on email for communication, but this presents substantial risks to HIPAA compliance. First, email addresses are often mistyped, which can result in dangerous disclosures of protected health information (PHI). Even if they reach their intended recipient, emails are often overlooked or misdirected to spam folders, and they are usually unencrypted. As a result, emails can more easily be intercepted by third parties than information conveyed through a secure web portal. This does not mean you should skip email entirely, but you can help ensure compliance by limiting the use of email to alerts and reminders that direct patients to a patient portal.

Effective EHR software with a fully integrated patient portal helps ensure HIPAA-compliant interactions and allows patients to manage their care in a secure and HIPAA-compliant way. This includes viewing and paying bills, managing appointments, and completing and e-signing forms. Mobile app functionality is another thing to consider, as many patients prefer to use mobile devices for these types of tasks.

Marlena Herrera, Director, Customer Success at Protegrity
The key challenge in maintaining compliance with regulatory standards in the context of health information management is that there are guidelines and requirements but often, there are no specifications on the requirements and how they need to be implemented to be considered compliant. This causes organizations to take an independent assessment of the regulatory standards which may vastly vary from one organization to another depending on their leadership, risk appetite, and maturity in technology and their approaches.

In addition, there are often new regulatory standards and requirements that may vary from state to state or emerge with new requirements based on governmental requirements that create challenges to adherence. Reviewing these requirements holistically and creating a strategic approach to meeting the requirements in alignment with organizational risk, leadership, and technical maturity often results in faster results with the ability to quickly adjust and meet new requirements.

What great answers! Huge thank you to Bill Olsen, Co-Founder and CTO at UptimeHealth, John Squeo, Senior Vice President & Market Head, Healthcare Providers at CitiusTech, Brian Laberge, Solution Engineer, Health Language at Wolters Kluwer Health, Bridget O’Connor, Chief Operating Officer (COO) at Fortalice Solutions, Jason Griffin, MBA, CISM, Managing Director of Digital Health Strategy and Cybersecurity at Nordic Global Consulting, Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Product at Cognizant, Susan Clark, Senior Director of Community & Advocacy at DirectTrust, Ram Krishnan, CEO at Valant, and Marlena Herrera, Director, Customer Success at Protegrity for taking the time out of your day to submit a quote to us! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

What do you think are the key challenges in maintaining compliance with regulatory standards, such as HIPAA, in the context of health information management? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!