Why do health data breaches keep breaking records?
Healthcare has been the most costly sector for data breaches for fourteen consecutive years. In 2025, the average healthcare breach cost $7.42 million, the highest of any industry, even after a $2.35 million decrease from the 2024 figure of $9.77 million. The average healthcare breach also took 279 days to identify and contain, roughly five weeks longer than the global average. In the United States alone, protected health information breaches have affected over 176 million patients.
Why healthcare, specifically?
Because of how the data is stored. The vulnerabilities of centralised clinical databases are now understood as structural properties of those systems, not incidental lapses. A central database holding millions of records is a single high-value target: one successful intrusion yields everything, and the same architecture that makes the data valuable to an institution makes it valuable to an attacker.
The dominant response has been to tighten access controls further. That compounds a different problem (legitimate research loses access) without addressing the structural cause: the honeypot is still a honeypot.
Health data is a debt until it serves the patient
Institutions should treat health data as a debt: a liability that becomes an asset only when the processing creates value for the data subject. An organisation sitting on millions of records it cannot protect and does not use for the patients’ benefit holds pure liability.
What a structural fix looks like
If centralisation is the structural weakness, the fix is architectural, not procedural:
- Per-person data, not bulk databases. Each person’s record lives in their own account. Compromising one account yields one record, not millions.
- Default-deny access. Health Data Safe runs on Open-Pryv, which ships privacy-protective behaviours that cannot be misconfigured away, starting with default-deny permissions: nothing is accessible until the person explicitly grants it.
- Every access logged. An invariant audit log records who accessed what, when, and under which consent, so anomalies are visible instead of silent.
No architecture makes breaches impossible. But when there is no central pile of records to steal, an intrusion gains an attacker very little.
Read more on who owns your health data, or see How it works.