The February 2024 cyberattack on Change Healthcare had an extraordinary and far-reaching impact across the healthcare industry. The ransomware attack underscored the deep interdependencies among providers, payers, and third-party vendors—revealing how a single disruption within this interconnected ecosystem can cascade across care delivery, financial operations, and patient safety throughout the sector. To address ongoing and evolving cybersecurity risks, many organizations are adopting and implementing cybersecurity frameworks and best practices, such as the NIST Cybersecurity Framework 2.0 (NIST CSF 2.0), the Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs), the Health Industry Cybersecurity Practices (HICP), and the NIST AI Risk Management Framework (NIST AI RMF). High coverage of these frameworks and best practices is a strong indicator of an organization’s cybersecurity maturity and preparedness.
This report provides an update to previous research and examines organizations’ self-reported coverage within the frameworks and best practices listed above. In particular, it looks at the gaps that persist around third-party risk management and asset management. In addition, key metrics from participating organizations regarding cybersecurity insurance premiums, IT and cybersecurity spending/staffing, and other data was analyzed for correlations. Data in the report comes from 69 healthcare and payer organizations who were surveyed September–December 2024.
The 2025 Benchmarking Study is a collaboration between Censinet, KLAS Research, the American Hospital Association, Health-ISAC, the Health Sector Coordinating Council, and the Scottsdale Institute.
Hear from the Censinet team on industry news, events, content, and engage with our thought leaders every month.