Chair File: Strengthening Cybersecurity to Protect Patients and Our Hospitals’ Mission
What does patient safety mean to you? For many, patient safety means what we can see: hand hygiene, infection prevention and control practices, medication checks and real-time monitoring. Those aspects matter every day, but another area is becoming increasingly important in patient safety discussions: cybersecurity. Hospitals and health systems are playing a more complex and larger role in protecting patients, critical operations and sensitive health information from growing cyberthreats.
A cyberattack or cyberthreat is not a siloed problem for your IT department to handle. It affects an entire hospital or health system, and cyberthreats are growing in frequency, scale and sophistication. From 2020-2025, more than 3,400 breaches were reported to the Department of Health and Human Services Office for Civil Rights. To put it in perspective, the number of stolen healthcare records exceeded the entire U.S. population more than once. Cyberthreats put patient care, critical infrastructure and millions of healthcare records at risk.
The AHA is working on several fronts to help healthcare teams better prepare for, prevent and mitigate cyberattacks. Here are some of its plans and resources:
- A centralized online hub on AHA.org offers cyber- and risk-related tools, regular updates, a preferred provider program and guidance tailored to healthcare organizations.
- The AHA’s cybersecurity and risk team, led by John Riggi and Scott Gee, provides comprehensive risk analysis and incident response strategy and advisory services; offers tailored education to boards and executives, including information about artificial intelligence and emerging risks; and facilitates culture transformation initiatives that embed cybersecurity and risk awareness across the organization.
- The AHA works closely with federal agencies to identify and share emerging threats and supports efforts in Congress to strengthen cybersecurity, reduce vulnerabilities and improve the training, coordination and resources healthcare organizations need to respond effectively.
We know that hackers often target healthcare organizations because they hold information of high monetary and intelligence value. In a recent Advancing Health podcast, John and Scott discuss several of the top cyberthreats facing healthcare in 2026.
The strongest healthcare organizations understand that cybersecurity is ultimately about protecting our patients and keeping them safe. Just as every employee plays a role in patient safety, every employee plays a role in cybersecurity. It requires vigilance, accountability and dedication to protecting our patients and our co-workers. When we approach cybersecurity in that way, we’re not only protecting data but also protecting our ability to care for patients and remain resilient in a world where cyberthreats are constantly evolving.