Data Trust Takes Center Stage at Healthcare Security Summit

Besieged by ransomware, artificial intelligence-driven deepfakes, third-party breaches, and looming state and federal mandates, the healthcare sector faces a mounting crisis with patient care and cybersecurity inseparably linked. At Information Security Media Group’s Healthcare Security Summit: New York, CISOs, regulators and innovators came together to strengthen resilience across the sector and explore strategies to safeguard hospitals and patients alike. Through keynotes, fireside chats and lively discussions, the summit examined the sector’s toughest challenges, offering practical strategies.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

“Our latest Healthcare Security Summit was among our finest. We brought together some of the best and brightest from the sector – practitioner and vendor alike – to dive deep into the threat and regulatory landscapes, as well as emerging technologies such as AI and how they are helping security leaders address today’s challenges,” said Tom Field, senior vice president of editorial at ISMG. “From the stage to the boardroom to the video studio, the conversations were rich, insightful and meaningful – exactly what a summit should be.”

Data Deluge and Identity Fraud

From managing the explosion of health data to combating AI-driven identity fraud, summit speakers stressed that the foundations of healthcare security are under unprecedented strain. Experts highlighted how the sector’s vast troves of patient information demand stronger governance, privacy-preserving analytics and cryptographic safeguards, while identity systems face new threats from deepfakes, synthetic profiles and credential compromise. Calls for biometric verification, phishing-resistant authentication and post-quantum crypto readiness underscored a central theme: Resilience in healthcare begins with securing both the data and the identities that underpin patient care.

“Cybersecurity supports patient care. Several panelists emphasized that CISOs should use data to demonstrate how security protections enable healthcare providers to deliver care safely and build trust with patients and communities. No one is going to want to visit a provider that cannot safeguard their PHI,” said Matthew Perry, vice president of editorial at ISMG. “The concurrent message was clear: Cyber risk is enterprise risk, not just an IT issue, and while more providers recognize this, contingency and response plans are still lacking.”

Resilience and Continuity

Across multiple sessions, speakers emphasized that true resilience in healthcare goes beyond preventing breaches to ensuring continuity of care when systems fail. From incident response planning and third-party risk management to redundancy across critical platforms, leaders, including Bindu Sundaresan of LevelBlue and Scott Gee of the American Hospital Association, urged organizations to prepare for cascading failures, supply chain disruptions and extended outages. Case studies and data underscored that ransomware is only part of the threat. Vulnerabilities in vendors, cloud services and medical devices can be just as damaging. The message was clear: Building operational resilience is now as essential as defending against the next attack.

“Resilience is a common and often-repeated theme. Several panelists were candid about the pain regional healthcare systems and state-affiliated systems will face with recent budget cuts to IT. ‘Doing more with less’ came across as a mandate that panelists generally seemed to think would be in place indefinitely,” Perry said.

Medical Devices, Cloud Systems Under Fire

The summit spotlighted how emerging technologies are creating new fault lines in healthcare security. In the session “FDA: Latest Developments in Medical Device Cybersecurity,” Suzanne Schwartz, director of the Office of Strategic Partnerships and Technology Innovation at FDA, underscored the rising risks in medical devices, warning that vulnerabilities discovered too late can directly endanger patient safety. She shared insights into the FDA’s expectations for cybersecurity in pre-market medical device submissions to the agency, including what device-makers should consider when mitigating cybersecurity risks during the development phase.

Cloud security also took center stage, with experts urging a shift from fragmented defenses to unified, zero trust-driven architectures capable of withstanding AI-powered intrusions and third-party weaknesses. In an insightful session “Securing Autonomy: An Identity Playbook for the Agentic Era,” Jamey Doherty, senior sales engineer at Ping Identity, cautioned that autonomous AI agents are fast becoming part of the digital workforce, bringing novel identity and governance challenges. He underscored that safe deployment of AI agents requires making identity the control plane, giving organizations the confidence to scale, enforce governance by design and rapidly yield business value.

Policy and Regulation

Regulatory oversight emerged as a defining theme, with state and federal mandates setting new baselines for healthcare security. In the closing session, legal experts turned attention to looming reforms, from a potential overhaul of Health Insurance Portability and Accountability Act’s two-decade-old security rule to new expectations around interoperability, insurer requirements and enforcement. The message was clear: Compliance is no longer a checkbox but a dynamic force reshaping how healthcare organizations operate.

“Our summit featured sessions with subject matter experts who addressed the many regulatory, budget, workforce and technology challenges facing healthcare cybersecurity and data privacy leaders,” said Marianne McGee, executive editor at ISMG. “Speakers also shared practical insights that attendees can bring back to strengthen their organizations’ defenses and better manage emerging risks from innovative IT initiatives, including AI and other evolving technologies.”

Key Takeaways

• Healthcare data growth, now nearly one-third of the world’s total volume, is forcing providers to adopt AI-driven analytics and stronger governance to balance innovation with privacy, trust and compliance;
• Identity fraud in the age of deepfakes and synthetic profiles is driving a push toward cryptographic credentials, biometrics and phishing-resistant authentication across healthcare ecosystems;
• Resilience is no longer optional. Continuity planning, vendor oversight and redundancy have become as critical as perimeter defenses to keep patient care uninterrupted;
• Technology itself is a battleground, with vulnerabilities in medical devices, cloud systems and emerging AI agents creating new frontiers for attackers and regulators alike;
• State mandates, coupled with looming federal reforms to HIPAA and enforcement rules, are reshaping healthcare cybersecurity into a compliance-driven, enterprise-wide priority.

Join us at ISMG’s Fraud Prevention Summit: New York on Nov. 5. The summit will address the growing concerns associated with fraudsters wielding advanced tools to attack organizations, arming participants with strategies to outpace bold adversaries and disrupt the shadow economy of fraud as a service.