What if I told you that your hospital’s infection control team only reported one out of every seven infections? You would be justifiably outraged. The lack of transparency would suggest a catastrophic failure of process and ethics. Yet, as I observe the landscape of digital health, I see a parallel crisis unfolding in cybersecurity. An estimated 85% of cyber incidents go unreported, a staggering figure that points to a silent epidemic of secrecy. The core problem I see time and again is that cybersecurity leaders are hiding incidents from their own executives. In healthcare, where protected health information (PHI) and patient lives are on the line, this silence is not just a business risk, it is a patient safety crisis. In this article, we will explore why these unreported cyberattacks in healthcare are happening, what this silence means for your organization, and what you can do to build a culture where transparency is the default.
When I speak with executives, they often believe they have a clear picture of their organization’s cybersecurity posture. They see the dashboards and hear the quarterly reports. The reality, I’m afraid, is often far different. According to a report from Kaspersky, a staggering 40% of businesses choose to conceal a data breach from their stakeholders. This isn’t just about small incidents being swept under the rug. We are talking about significant events that are never escalated to the leadership team that needs to understand the true risk profile of the organization.
The analogy to clinical care is direct and alarming. Imagine a physician notices troubling symptoms in a patient but intentionally omits them from the medical chart for fear of being blamed for a missed diagnosis. The care team, operating with incomplete information, would make flawed decisions, potentially leading to a terrible outcome. In the same way, when a Chief Information Security Officer (CISO) or IT director fails to report a security incident, they are giving the board a completely false picture of the organization’s health. The leadership is flying blind, unable to allocate the right resources or make informed strategic decisions because they do not know the full extent of the threats they face.
This culture of secrecy did not materialize overnight. For years, I watched as cyberattacks were relegated to the “IT problem” bucket. A server would get a virus, the IT team would re-image it, and everyone would move on. There was no need to bother the “suits” in the C-suite with technical details they likely would not understand anyway. It was a simpler, albeit more naive, time.
The arrival of the Health Insurance Portability and Accountability Act (HIPAA) and the subsequent HITECH Act was a seismic shift. Suddenly, data breaches carried legal weight. Reporting was not just good practice, it was the law, with the threat of multi-million dollar fines from the Office for Civil Rights (OCR) for non-compliance.
However, this well-intentioned regulation had an unintended consequence that I’ve seen play out countless times. By raising the stakes so high, it inadvertently created a powerful incentive for silence. The immense fear of a career-ending fine, public brand damage, and patient lawsuits has, paradoxically, made security leaders terrified to raise their hands and report a problem. The cure, in some ways, has worsened a symptom of the disease.
To truly understand this phenomenon, we have to step into the shoes of the security leader. From my conversations, their silence often stems from a complex mix of professional anxiety and organizational dysfunction.
The number one reason for silence is, without a doubt, fear. It is a primal fear of negative consequences, both personal and professional. CISOs worry about being fired for a breach that happened on their watch. They fear the irreversible reputational damage to their practice when the news breaks. And they fear the staggering financial fallout from regulatory fines, class-action lawsuits, and patient churn. When the perceived price of honesty is your job and your organization’s reputation, the temptation to “fix it quietly” can be overwhelming.
A common frustration I hear from technical leaders is the feeling that the C-suite simply does not understand cyber risk until it becomes a front-page disaster. They feel that reporting a near-miss or a contained incident is like screaming into a void. The board might nod along, but they do not truly grasp the significance. Without that executive understanding, a CISO’s request for more budget or stricter security controls can be perceived as crying wolf, which further discourages them from reporting anything but a full-blown catastrophe.
You might be surprised to learn how many healthcare organizations, even large ones, lack a clear, practical, and well-rehearsed incident response plan. When a potential incident occurs, chaos ensues. No one is entirely sure who to call, what the precise threshold for escalation is, or how to coordinate a response. In the absence of a clear playbook, the path of least resistance is often to do nothing and hope the problem goes away on its own.
I can understand the internal debate. The devil’s advocate view argues for keeping things quiet. By not reporting, you might avoid patient panic, prevent an immediate hit to your stock price or revenue, and dodge a painful OCR investigation. The hope is to fix the vulnerability before anyone significant notices.
However, this is a short-sighted and dangerous gamble. The case for full disclosure is not just ethical, it is strategic. First and foremost, under the HIPAA Breach Notification Rule, it is your legal duty. Failure to report a breach of unsecured PHI can lead to penalties far worse than those for the breach itself. Second, transparency builds long-term trust. As we saw with the massive HCA Healthcare data breach in 2023, where data from 11 million patients was compromised, prompt and clear communication is critical to managing the fallout. Attempting to hide a breach of that magnitude would have been catastrophic. Finally, and most importantly, reporting an incident is the only way to secure the executive buy-in and resources needed to solve the underlying problem. Hiding a breach is like putting a small bandage on a gaping wound, it does nothing to stop the bleeding.
I have come to believe that underreporting is not the disease itself, but rather a symptom of a deeper, more pervasive cultural sickness within an organization. It reveals critical vulnerabilities in your foundation.
Moving forward is not about buying more firewalls or fancier threat detection software. It is about fundamentally re-engineering your culture to prioritize psychological safety and build resilience.
The pressure for transparency is only going to increase. Regulators like the HHS Office for Civil Rights are becoming less patient with long delays in breach notification, and the fines are growing. We are also seeing transparency being forced upon other sectors. For instance, the new SEC rules on cybersecurity now mandate rapid and public disclosure of material incidents for public companies. It is only a matter of time before similar, stricter mandates come to healthcare. The world is moving toward radical transparency, and organizations that have not built the cultural muscle for it will be left dangerously exposed.
The silent epidemic of unreported cyberattacks is one of the greatest threats facing healthcare today. It is a failing strategy, born of fear, that actively makes your patients and your practice less safe. The solution is not more technology, it is more trust. The answer lies in building durable bridges between the server room and the boardroom, creating a unified front where technical experts and business leaders work from the same set of facts toward the same goal: protecting patients.
I challenge you to walk into your next leadership meeting and ask one simple question: “What is one thing we can do this quarter to make our team feel completely safe reporting bad news about our security?” The answer to that question will be your first step toward building a truly resilient organization.
Protecting patient data and ensuring operational continuity requires more than just in-house effort, it requires specialized expertise. To understand how professional cybersecurity solutions can fortify your defenses and build a culture of security, learn more at https://securetrust.io.
The HIPAA Breach Notification Rule requires healthcare providers and their business associates to provide notification following a breach of unsecured protected health information (PHI). For breaches affecting 500 or more individuals, covered entities must notify the affected individuals, the Secretary of HHS, and, in some cases, the media without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach.
A culture of blame discourages transparency and early reporting. When employees fear punishment for reporting a mistake, a suspicious email, or a potential security incident, they are more likely to stay silent. This allows small problems to grow into catastrophic breaches that could have been prevented or mitigated with early intervention.
A tabletop exercise is a discussion-based session where team members meet to discuss their roles and expected responses during a simulated emergency or security incident, such as a ransomware attack. It is important because it helps identify gaps, ambiguities, and flaws in an organization’s incident response plan in a low-stakes environment before a real crisis occurs.
The NIST Cybersecurity Framework (CSF) provides a voluntary, risk-based set of standards, guidelines, and best practices to manage cybersecurity risk. For a healthcare practice, it offers a common language and a structured approach to talk about, assess, and improve your cybersecurity posture across five core functions: Identify, Protect, Detect, Respond, and Recover. It helps bridge the communication gap between technical staff and executive leadership.
.