Updated 3 min read

Why do health data breaches keep breaking records?

Healthcare has been the most costly sector for data breaches for thirteen consecutive years, according to IBM’s 2026 Cost of a Data Breach report. In 2026, the average healthcare breach cost $6.64 million, the highest of any industry, even after a 10.5% decrease from the 2025 figure of $7.42 million; the global average meanwhile rose to a record $4.99 million, and the mean time to identify and contain a breach climbed to 247 days. In the United States alone, the large breaches of protected health information (500 or more people each) reported to the federal regulator since 2009 add up to more than one billion affected individuals, a cumulative count in which the same person can appear more than once.

Why healthcare, specifically?

Because of how the data is stored. The security literature describes the weaknesses of centralised clinical databases as properties of the architecture itself: a single point of failure that concentrates millions of records behind one perimeter. A central database holding millions of records is a single high-value target, and hacking and ransomware now account for most of the records exposed: one successful intrusion yields everything, and the same architecture that makes the data valuable to an institution makes it valuable to an attacker.

The dominant response has been to tighten access controls further. That compounds a different problem (legitimate research loses access) without addressing the structural cause: the honeypot is still a honeypot.

Health data is a debt until it serves the patient

Institutions should treat health data as a debt: a liability that becomes an asset only when the processing creates value for the data subject. An organisation sitting on millions of records it cannot protect and does not use for the patients’ benefit holds pure liability.

What a structural fix looks like

If centralisation is the structural weakness, the fix is architectural, not procedural:

No architecture makes breaches impossible. But when there is no central pile of records to steal, an intrusion gains an attacker very little.

Read more on who owns your health data, or see How it works.

Sources