In March 2021, Medcrypt published "Why Healthcare Cybersecurity Is Hard," naming six structural constraints that no amount of security spending could fix on its own. Five years later, we went back and checked each one against the record: new breaches, new regulation, and a materially different vendor landscape. Four of the six constraints haven't just persisted, they've intensified. Two have genuinely changed, largely because regulation forced it. None have gone away.
Healthcare has now ranked as the costliest industry for a data breach for 14 consecutive years running. The 2024 Change Healthcare/UnitedHealth breach alone affected 192.7 million people, the largest healthcare breach on record. At the same time, new FDA authority has genuinely reshaped two of the original six constraints. Understanding which problems are structural and durable, and which are actually solvable through regulation, is the difference between a security program that treats symptoms and one that addresses root causes.
Healthcare has ranked as the costliest industry for a data breach for 14 straight years, averaging $7.42M per incident. The 2024 Change Healthcare breach affected 192.7 million people, the largest healthcare breach on record. Section 524B (2023) created the first statutory mandate for continuous postmarket risk management, including SBOMs and a 60-day vulnerability remediation clock. The QMSR, effective February 2026, replaced the 1996-era Quality System Regulation. Four of six constraints named in 2021 have intensified; two changed, both because regulation forced it, not market incentives.
Introduction: Six Constraints, Five Years Later
Constraint 1: Healthcare Optimizes for Healthcare — Persisted
Constraint 2: Security Debt Accumulates & Problems Manifest for Consumers — Persisted
Constraint 3: Adversaries Exist — Persisted
Constraint 4: Security Requires Deep Specialization — Changed
Constraint 5: US Healthcare Technology Governance Is Fragmented — Persisted
Constraint 6: Uncertainty Breaks Existing Risk Models — Changed
Conclusion: Five Years On, the Root Causes Remain
.svg)