Why do health data breaches keep breaking records?
Healthcare has been the most costly sector for data breaches for thirteen consecutive years, according to IBM’s 2026 Cost of a Data Breach report. In 2026, the average healthcare breach cost $6.64 million, the highest of any industry, even after a 10.5% decrease from the 2025 figure of $7.42 million; the global average meanwhile rose to a record $4.99 million, and the mean time to identify and contain a breach climbed to 247 days. In the United States alone, the large breaches of protected health information (500 or more people each) reported to the federal regulator since 2009 add up to more than one billion affected individuals, a cumulative count in which the same person can appear more than once.
Why healthcare, specifically?
Because of how the data is stored. The security literature describes the weaknesses of centralised clinical databases as properties of the architecture itself: a single point of failure that concentrates millions of records behind one perimeter. A central database holding millions of records is a single high-value target, and hacking and ransomware now account for most of the records exposed: one successful intrusion yields everything, and the same architecture that makes the data valuable to an institution makes it valuable to an attacker.
The dominant response has been to tighten access controls further. That compounds a different problem (legitimate research loses access) without addressing the structural cause: the honeypot is still a honeypot.
Health data is a debt until it serves the patient
Institutions should treat health data as a debt: a liability that becomes an asset only when the processing creates value for the data subject. An organisation sitting on millions of records it cannot protect and does not use for the patients’ benefit holds pure liability.
What a structural fix looks like
If centralisation is the structural weakness, the fix is architectural, not procedural:
- Per-person data, not bulk databases. Each person’s record lives in their own account. Compromising one account yields one record, not millions.
- Default-deny access. Health Data Safe runs on Open-Pryv, which ships privacy-protective behaviours that cannot be misconfigured away, starting with default-deny permissions: nothing is accessible until the person explicitly grants it.
- Every access logged. An invariant audit log records who accessed what, when, and under which consent, so anomalies are visible instead of silent.
No architecture makes breaches impossible. But when there is no central pile of records to steal, an intrusion gains an attacker very little.
Read more on who owns your health data, or see How it works.
Sources
- IBM and Ponemon Institute (2026). Cost of a Data Breach Report 2026. IBM Corporation. ibm.com/reports/data-breach
- U.S. Department of Health and Human Services, Office for Civil Rights. Breach Portal: breaches of unsecured protected health information affecting 500 or more individuals (2009 to present). ocrportal.hhs.gov
- Jiang JX, Ross JS, Bai G (2025). Ransomware attacks and data breaches in US health care systems. JAMA Network Open 8(5): e2510180. doi:10.1001/jamanetworkopen.2025.10180
- Yari IA, Dehling T, Kluge F, Geck J, Sunyaev A, Eskofier B (2021). Security engineering of patient-centered health care information systems in peer-to-peer environments: systematic review. Journal of Medical Internet Research 23(11): e24460. doi:10.2196/24460
- Seh AH, Zarour M, Alenezi M, et al. (2020). Healthcare data breaches: insights and implications. Healthcare 8(2): 133. doi:10.3390/healthcare8020133