Study Provides Insights into Impact of Cyberattacks on Hospital Care
A recent analysis by The Health Management Academy of cyberattacks on U.S. hospitals provides insights into the extent to which patient care is being disrupted by cyberattacks. A growing body of research shows an increase in medical complications and poorer patient outcomes following cyberattacks, and multiple studies suggest increases in mortality rates following a cybersecurity incident such as a ransomware attack. One study suggested an increase in mortality rate of between 34% and 38% for patients admitted to hospital in the week prior to a ransomware attack.
Analysing the impact of cyberattacks on patient care is challenging, however, as The Health Management Academy discovered. Under the HIPAA Breach Notification Rule, data breaches rather than cyberattacks must be reported to the HHS’ Office for Civil Rights. While many cyberattacks involve breaches of patient data, that is not always the case. Cyberattacks can have an impact on patient care when no records are determined to have been breached, and as such, these incidents are absent from the federal record.
Additionally, OCR only publishes summaries of healthcare data breaches that impact 500 or more individuals. A cyberattack may not affect so many individuals in terms of exposed data but may still have an impact on patient care. Further, hospitals and health systems do not always publicly disclose the impact a cyberattack had on patient care.
The Health Management Academy is a member-based organization that connects and supports senior healthcare executives, offering leadership development programs, data and market insights, and creating trusted forums and peer groups where healthcare leaders can discuss shared challenges and share ideas. For its study, cyberattacks on U.S. hospitals and health systems were logged over a 4.5-year period between January 2022 and September 2026, when there was a reported impact on patient care. Data came from news coverage, trade publications, and hospital statements.
The researchers determined there had been at least 65 cyberattacks on hospitals and health systems during that period that impacted hospital care, including ambulance diversions, cancelled elective surgeries and appointments, and incidents where staff members were forced to switch to paper records. The true figure is likely substantially higher, given that Comparitech tracked 293 ransomware attacks on hospitals, clinics, and other direct care providers in the first 9 months of 2025 alone.
According to The Health Management Academy analysis, the 65 cyberattacks affected at least 305 hospitals in 36 U.S. states, the District of Columbia, Guam, and the US Virgin Islands, with 21 attacks impacting more than one hospital, and one incident impacting 140 hospitals across the United States. In 26 of the logged cyberattacks (40%), ambulances were placed on divert, resulting in patients having to travel to alternate facilities, delaying emergency care. In 28 attacks (43%), patients faced delays in care from cancelled or postponed surgeries, appointments, or treatments.
In 58 attacks (89%), key systems were taken offline, resulting in staff having to work with paper records while the incident was remediated and systems were restored. Out of the 23 attacks where a restoration date was provided for clinical systems such as electronic medical record systems, the median downtime was 15 days, although 51% of attacks saw lengthier downtime periods, with 22% of attacks involving more than a month of downtime.
Based on current figures, in 2025, 807 large healthcare data breaches were reported to OCR and are currently listed on its data breach portal, 81% of which are listed as hacking/IT incidents. The impact of those incidents on patient care is not a reporting metric, and the HIPAA Journal has found through its breach reporting that patient care impacts are often not publicly disclosed.
The Health Management Academy’s incident tracking for its analysis only identified 12 cyberattacks on hospitals and health systems in 2025 where there was a confirmed impact on patient care, and many incidents included in its analysis have still not made it onto the OCR breach portal. One in five cyberattacks that were publicly disclosed more than a year ago is still not listed on the OCR breach portal. While those incidents may not have involved unauthorized access to the protected health information of 500 or more individuals, they caused at least some disruption to patient care.
Given the difficulty in accurately tracking the impact of cyberattacks on patient care, The Health Management Academy suggests tracking and sharing data using metrics such as days of clinical downtime, hours on diversion, and the number of procedures postponed, as it would allow hospitals and health systems to more accurately benchmark their readiness and recovery against peers. Through its programs, there is the option of doing that; however, there are no indications that OCR will mandate any such reporting metrics in the foreseeable future.
