Who Is Actually Paying for Patient Safety?

# Who Is Actually Paying for Patient Safety? Amgen has spent its morning ensuring every possible news outlet knows it had a breach. Four separate reports hit the wire today alone, each slightly rephrasing the fact that patient health information and corporate files have walked out the door. From a regulatory standpoint, this is a textbook exercise in "aggressive disclosure". When a pharmaceutical giant leaks data, they don't just send one email; they flood the zone to ensure that when the regulators eventually arrive, the company can point to a mountain of press releases as evidence of their transparency. It’s a neat trick. It transforms a failure of security into a triumph of communication. Healthcare has emerged as the third most targeted sector this week, with just under 100 stories hitting our trackers—14 of those appearing today alone. While the technology sector continues to take the brunt of the volume at rank one, the healthcare sector is where the gap between what a law requires and what a company actually does becomes most visible. In this sector, the paperwork isn't just about fines; it’s about a fundamental disagreement over whether a server is a piece of IT equipment or a medical device. Take the CareCloud incident. Just north of 345,000 Americans have been warned that their sensitive personal and financial records were exposed via a breach in an AWS environment. This is where the civil servant in me starts counting the hours. Under various US state laws and federal guidelines, the clock for notification is ticking. The sheer administrative burden of notifying over 340,000 individuals—mailing letters, setting up call centres, providing credit monitoring—is a logistical nightmare that often dwarfs the actual cost of the security failure. The irony, of course, is that CareCloud is a service provider. This means we're looking at a second-order effect: the downstream collapse of trust for every clinic and doctor's office that trusted CareCloud to handle their patient data. The clinics are now the ones who have to explain to a patient why their medical history is floating around the dark web, while CareCloud's lawyers argue over the specific wording of the liability clauses in the service level agreement. Then we have the retrospective from Black Hat and HIMSS, which is far more grim than a leaked spreadsheet of names. The report suggests that ransomware attacks on hospitals can raise patient mortality rates by as much as 38%. That number should be the only thing any health board cares about. Instead, most healthcare executives treat cybersecurity as a compliance exercise. They check a box for HIPAA or follow a set of guidelines from Brussels to ensure they aren't hit with a GDPR fine that might cost them 4% of their global turnover. They treat security like an insurance policy: something you pay for so that when the disaster happens, you have a paper trail proving you tried your best. The argument usually levelled by hospital administrators is one of practicality. They’ll tell you that they cannot simply take a critical system offline to patch it because the "uptime" requirement of an emergency room is 100%. They claim that the risk of a patient dying because a ventilator's management software was being updated is higher than the risk of a ransomware attack. This is a false choice, and a lazy one. The mortality increase isn't caused by the act of patching; it's caused by the catastrophic failure of systems that were left unpatched for years. When a hospital's network goes dark, they don't just lose their billing system—they lose access to patient records, imaging, and pharmacy orders. The "uptime" they are so desperate to protect is an illusion if the entire environment is running on legacy software that hasn't seen a security update since the mid-2010s. They aren't protecting patients; they are protecting their current workflow from the inconvenience of modernisation. We see this same pattern in the Amgen breach. The loss of "corporate files" alongside patient data suggests a failure of internal segmentation. If your proprietary research is sitting on the same logical plane as your patient lists, you haven't built a secure environment; you've built a very large, very expensive target. From a regulatory perspective, we are waiting for the shift from "data protection" to "patient safety". For too long, the fines have been based on the number of records lost—a quantitative metric that is easy for lawyers to argue about in court. If 345,000 records are leaked, you pay a fine per record. It's a transaction. But if we start pricing security failures by the increase in mortality rates, the conversation changes. No one wants to explain to a board of directors why their failure to implement basic network segmentation contributed to a nearly 40% spike in deaths during a ransomware event. That is a metric that doesn't vanish into a settlement agreement. The current machinery of regulation is too slow. By the time an agency in Washington or Oslo completes an audit and issues a fine, the attackers have already moved on to three other targets, and the victimised company has already rebranded its "security initiatives" for the next annual report. I suspect we'll see more of this today. The wire is still humming with reports from the healthcare space because it remains the path of least resistance for anyone who knows how to exploit a cloud misconfiguration or a stale VPN password. The real question is whether the sector will continue to treat security as a cost centre to be minimised, or if they'll finally admit that a crashed server in 2026 is just as lethal as a surgical error. Until the fines are tied to clinical outcomes rather than record counts, I expect the press releases will remain polished and the systems will remain fragile.