Healthcare IT leaders are rethinking device security, governance, and risk management to strengthen protection and improve overall digital resilience.
In addition to potential effects on patient outcomes or even closure, healthcare institutions are aware of the risks associated with a successful ransomware attack, including downtime, data loss, and patient confidence loss, and that’s only after paying the ransom.
Although security leaders are aware of the threats and bad actors in the world, it is becoming more challenging to identify the origin of attacks due to bitcoin payments. Because of these reasons, healthcare organizations need to prioritize resilience and prevention.
Healthcare security professionals spoke at the 2025 CHIME Fall Forum in San Antonio about how to safeguard medical devices and Internet of Medical Things devices to build a robust security posture to fend off increasing threats driven by artificial intelligence. They also stressed the importance of risk management and governance for a strong security program.
Many healthcare tasks became remote during the epidemic, and businesses were compelled to expand their networks, which increased the attack surface of health systems. Maintaining a safe environment is becoming more difficult as new tools like generative AI enter the market and some workloads remain distant.
“With generative AI, you can ask for a guacamole recipe as easily as you can upload patient data,”
said Ravi Monga, CISO for healthcare at Zscaler.
“The threat landscape is changing and evolving.”
CIO Ismelda Garza of Cuero Regional Hospital in Cuero, Texas, stated that she discovered early in her career that dealing with people is the most challenging aspect of her work. Preventing successful attacks requires the ability to educate everyone about security best practices, from the board and leadership to nurses, clinicians, and doctors.
But one issue he frequently observes, according to Monga, is that education only goes one way. Clinical personnel are not informed about danger; instead, IT reports it to the CIO, who then reports it to the board.
