Healthcare is among the most targeted sectors for cybercriminals, and it's easy to see why.
A stolen medical record can fetch up to $1,000 on the dark web, compared with $1 to $3 for a set of email login credentials. Patient data contains everything an identity thief could want in one place: names, dates of birth, insurance information, financial details and, in many cases, Social Security numbers.
Such a concentration of sensitive information makes healthcare organizations a persistently attractive target. More than nine in 10 healthcare organizations (93%) experienced a cyberattack in the past 12 months, according to the 2025 Proofpoint/Ponemon Cyber Insecurity in Healthcare report. Healthcare has also recorded the highest average data breach cost of any industry for 15 consecutive years, reaching $7.42 million per incident in 2025.
Awareness of the exposure is translating into investment. Globally, around half of health system executives now cite cybersecurity as a top concern, dedicating close to 14% of their technology budgets to it.
This is a welcome trend, not least because cybercriminals are continuously adapting their methods and finding new ways to target the sector. AI and the proliferation of ransomware-as-a-service (RaaS) have also drastically reduced barriers to entry.
But putting more money into the same in-house, multi-vendor model isn’t going to equip healthcare organizations to fend off attackers for long. Without the right infrastructure behind it, additional spend tends to add unnecessary complexity with limited success.
In-house security is harder than it looks
On the flip side, the ambulatory practices making real progress are those questioning the delivery model itself.
Ambulatory services operate under a different set of constraints from the large health systems that dominate most cybersecurity headlines. Few have dedicated security teams, in-house CISOs or the technology budgets that enterprise-grade defense requires. Yet the threat landscape they face is largely the same and, in many cases, threat actors are deliberately targeting these smaller entities because they lack the security resources of large healthcare institutions.
Across the sector as a whole, 43% of healthcare organizations cite lack of in-house expertise as their primary barrier to an effective cybersecurity posture. Small IT teams are expected to manage patching cycles, monitor for threats, maintain vendor security relationships and prepare for HIPAA, HITRUST and ONC compliance audits, all while keeping the clinical systems the practice runs on available around the clock.
The attack surface has expanded considerably too. EHRs, practice management systems, connected medical devices, third-party billing tools and clinical AI applications each represent a potential entry point, and every additional vendor introduces another integration point, another login and another application that needs monitoring. Attackers need to find just one of those gaps.
What this tends to produce is a patchwork of point solutions accumulated over time, each addressing a specific concern and few of them fully integrated. Spending is reactive and happens after something goes wrong. Staffing and technology costs, compliance preparation and breach response are all real costs that rarely appear in a like-for-like comparison with what a managed platform would cost. When they do, the math often looks different.
The number of vendors involved is itself part of the problem. Every seam between systems is a potential vulnerability, and managing that complexity requires exactly the kind of deep, continuous expertise that most ambulatory practices don't have on staff. That's where consolidation starts to make sense.
Why you should consider a consolidated, cloud-hosted platform
Moving to a unified platform reduces the number of systems that need to be individually secured, monitored and patched.
In a multivendor environment, teams may need to monitor and manage dozens of integrations. A single platform brings those connections together, making them easier to manage and giving security teams, whether in-house or managed, a clear view of the whole environment from one place instead of across multiple dashboards.
The capabilities that come with an enterprise-grade platform are also worth examining. AI-driven threat detection, behavioral analytics and automated monitoring are standard features of modern platform security infrastructure, but building and maintaining equivalent capability in-house requires specialist expertise that many ambulatory practices cannot realistically afford to retain. On a certified platform, those capabilities are included and continuously updated by teams whose primary job is security.
Compliance is another area where the platform model makes a big difference. HIPAA, HITRUST, ONC and SOC 2 requirements don't disappear when a practice moves to the cloud, but much of the technical, administrative and process burden is offloaded. A certified platform provider maintains the documentation, undergoes independent audits and carries the certifications. Practices running on a HITRUST CSF-certified platform can also leverage many of the provider's security and privacy controls directly, simplifying their own audit processes and considerably reducing the need for dedicated, internal resources.
A managed cloud platform is continuously updated as threats evolve and regulations change. An in-house team stretched across everything else will struggle to keep pace, and the cost of falling behind is one reason the total cost of ownership calculation often looks very different from first impressions.
Rethinking what cybersecurity costs
Indeed, when practices calculate the cost of in-house cybersecurity, the spreadsheet entries rarely include everything they should.
Staffing gaps, technology redundancy, compliance preparation and breach response all carry real price tags that tend to sit in separate budget lines, if they appear at all. Once you add those in, a managed platform often works out to be more cost-effective than it first appeared.
The IBM Cost of a Data Breach Report 2025 reinforces that conclusion. When healthcare organizations experience a cyberattack, detection and containment take an average of 279 days, longer than in any other industry. The same report found that organizations with AI and automation built into their security operations saved an average of $1.9 million per breach compared with those without.
Physical infrastructure is another consideration, as maintaining on-premises security systems requires capital expenditures on hardware, licensing and upgrade cycles. A cloud-based platform replaces these costs with a predictable operating expense that scales with the organization and includes enterprise-grade protection that would be prohibitively expensive to replicate in-house.
Regulatory requirements are also tightening. Proposed updates to the HIPAA Security Rule would introduce mandatory asset inventories, stricter incident response timelines and more rigorous third-party risk monitoring. Meeting those requirements without a certified platform will demand significantly more internal resources than most ambulatory practices have available.
The threat environment for healthcare organizations continues to expand, and the cost of a breach keeps rising. The question for many ambulatory practices now is not how seriously to treat cybersecurity or how to secure funding for it, but whether their current model fits the threats they face.
NextGen Healthcare is the technology partner for diverse ambulatory practices with evolving business needs. Learn more at NextGen.com.