US healthcare data breach costs and HIPAA regulation

The healthcare sector continues to face escalating financial and regulatory pressures due to data security failures. In 2025, healthcare organizations paid approximately $148 million in HIPAA fines, including a $126 million settlement involving Change Healthcare. During this period, breaches exposed 168 million patient records, with the average cost of a healthcare breach reaching $93 million.

Regulatory authorities have emphasized strict compliance regarding breach notifications. A settlement involving OSF Healthcare clarified that the 60-day HIPAA notification deadline begins on the day a breach is discovered, rather than when a forensic investigation concludes. Authorities have also noted that ransomware incidents are presumed to constitute HIPAA breaches.

In response to a 102% increase in large-scale healthcare breaches between 2018 and 2023, the U.S. Department of Health and Human Services (HHS) has proposed updates to the HIPAA Security Rule. These proposed changes aim to strengthen protections for electronic protected health information (ePHI) by mandating enhanced requirements for risk analysis, incident response, encryption, multi-factor authentication, and vulnerability identification.