Healthcare just closed the books on its worst year ever for data breaches. In 2025,
772 large breaches were reported to the HHS Office for Civil Rights, exposing the protected health information of
nearly 140 million people — a new record. More than 80% of those incidents traced back to hacking and IT incidents, not lost laptops or misdirected faxes.
The uncomfortable truth: the perimeter-based security model most hospitals and clinics still run on was never designed for a world of cloud EHRs, remote clinicians, connected medical devices, and third-party vendors with standing network access. Zero trust is the model that was — and in 2026, regulators, insurers, and attackers are all pushing healthcare toward it at once.
Here’s what zero trust actually means for a healthcare organization, why this is the year to move, and a practical roadmap to get started without disrupting patient care.
Why “Trust but Verify” Failed Healthcare
Traditional network security works like a hospital badge that opens every door. Once an attacker — or a compromised vendor account — gets inside the network, they can move laterally to EHR systems, imaging archives, and billing databases largely unchallenged.
That’s exactly how the biggest healthcare breaches of the past two years unfolded: one set of stolen credentials, no multi-factor authentication on a remote access portal, and weeks of unnoticed lateral movement.
The numbers show how expensive that failure mode is:
- Healthcare has had the highest breach costs of any industry for 14 consecutive years — averaging $7.42 million per breach in IBM’s 2025 Cost of a Data Breach report.
- Healthcare breaches take an average of 279 days to identify and contain — five weeks longer than the global average.
- Ransomware crews deliberately target hospitals because downtime risks patient harm, which pressures administrators to pay.
Zero trust attacks the core weakness behind all three numbers: implicit trust inside the network.
Zero Trust in Plain Language
Zero trust is not a product you buy. It’s an architecture built on one principle:
never trust, always verify. Every user, device, and application must prove who it is and that it’s authorized — for every request, every time, regardless of where it connects from.
For a hospital, that means a nurse’s workstation can reach the EHR module she needs for her shift — but not the radiology PACS, the HVAC controller, or the finance share. If her credentials are stolen, the attacker inherits a tightly scoped slice of access, not the keys to the kingdom.
The Five Pillars (CISA’s Model)
CISA’s Zero Trust Maturity Model organizes the journey into five pillars, and it maps cleanly onto healthcare environments:
- Identity — phishing-resistant MFA, single sign-on, role-based access tied to clinical roles.
- Devices — inventory and health-check every endpoint, including medical IoT and legacy modalities.
- Networks — microsegmentation, so an infected device can’t reach what it doesn’t need.
- Applications & Workloads — continuous authorization for EHR, telehealth, and cloud workloads.
- Data — classify ePHI, encrypt it at rest and in transit, and monitor who touches it.
2026: The Year the Pressure Became Regulatory
Two developments make this the wrong year to wait.
The HIPAA Security Rule Overhaul
In January 2025, OCR published the most significant proposed update to the HIPAA Security Rule in two decades. The final rule hasn’t landed yet as of mid-2026, but the direction is unmistakable. The proposal eliminates the “addressable vs. required” distinction and makes a set of zero-trust-aligned controls mandatory, including:
- Multi-factor authentication across systems handling ePHI
- Encryption of ePHI at rest and in transit
- Network segmentation
- Vulnerability scanning, penetration testing, and an accurate asset inventory
- Annual testing of technical controls
Once finalized, covered entities and business associates are expected to get roughly
180 days to comply. Organizations that start building these capabilities now will treat the final rule as a checkbox. Those that wait will face a compliance fire drill measured in months, not years.
NIST Finally Showed the “How”
For years, the fair criticism of zero trust was that NIST SP 800-207 described the “what” but not the “how.” That changed in June 2025, when NIST published
SP 1800-35, “Implementing a Zero Trust Architecture” — the results of building 19 real, interoperable zero-trust implementations with commercial, off-the-shelf technology. It’s the closest thing to a recipe book the industry has, and it maps controls back to the NIST Cybersecurity Framework you’re likely already using for risk analysis.
A Practical Zero-Trust Roadmap for Healthcare
You don’t rip and replace your way to zero trust — you sequence it. Here’s the order that delivers the most risk reduction soonest.
Phase 1: Identity First (0–3 Months)
Most healthcare breaches start with credentials, so start where attackers do. Roll out phishing-resistant MFA on email, VPN/remote access, and EHR logins. Kill shared logins at nursing stations with badge-tap SSO so security doesn’t add seconds to clinical workflows — adoption fails when security slows care.
Phase 2: See Everything (1–4 Months)
You can’t protect devices you don’t know exist. Build a live inventory of every connected asset — workstations, infusion pumps, imaging systems, building controls. In most hospital assessments, this step alone surfaces unmanaged devices running end-of-life operating systems with direct paths to clinical networks.
Phase 3: Segment the Network (3–9 Months)
Microsegmentation is the single highest-impact control for healthcare because it solves the legacy-device problem. That 12-year-old MRI running an unsupported OS can’t be patched — but it
can be isolated so it talks only to the PACS server it needs. When (not if) something is compromised, segmentation turns a network-wide incident into a contained one.
Phase 4: Continuous Monitoring and Least Privilege (Ongoing)
Layer in continuous verification: device health checks before granting access, anomaly detection on ePHI access patterns, and quarterly access reviews that strip permissions people no longer need. This is also where the proposed HIPAA requirements on monitoring and annual control testing land.
The Mistakes to Avoid
Buying “zero trust” off a shelf. No single vendor sells it. Treat vendor tools as components of an architecture you own.
Ignoring clinical workflow. If verification adds friction to a code-blue response, clinicians will work around it — and workarounds are where breaches live. Design access policies with clinical staff at the table.
Forgetting business associates. Third-party vendors were behind many of the largest healthcare breaches in recent memory. Zero trust applies to their access too: scoped, time-limited, monitored.
Treating it as a project with an end date. Zero trust is an operating model. Budget for it like one.
Where to Start This Quarter
If you do nothing else in the next 90 days: enable MFA everywhere ePHI is touched, build your asset inventory, and run a gap assessment against the proposed HIPAA Security Rule requirements. Those three moves cover the most likely attack paths and the most likely regulatory requirements simultaneously.
Zero trust can feel like a multi-year mountain, but healthcare organizations don’t have to climb it alone — and they can’t afford to stand still at base camp while attackers set records every year. Our
cybersecurity services team helps healthcare organizations run exactly this playbook: assessment, identity hardening, segmentation design, and a compliance roadmap aligned to the incoming HIPAA requirements.
Ready to find out where your organization stands? Get in touch for a zero-trust readiness assessment — we’ll map your current environment against the five pillars and give you a prioritized, budget-aware plan.
