News

Aliasgar Dohadwala, CEO of Visiontech Systems, is a visionary and serial entrepreneur with a knack for turning challenges into opportunities

getty​Healthcare data breaches cost an average of $6.64 million, the highest among industries studied in IBM’s 2026 Cost of a Data Breach Report. Healthcare organizations also took an average of 279 days to identify and contain a breach. That period describes the breach life cycle, rather than continuous downtime, but it demonstrates how long an incident can demand attention and resources.

For healthcare leaders, those figures should prompt a closer look at how cybersecurity budgets are planned, though I understand the pressure to control costs. Healthcare organizations have competing priorities like clinical equipment, staffing, facilities and digital services. Cybersecurity spending can be harder to justify because its value is often measured through disruption avoided.

A renewal is postponed. A security assessment is pushed to the next quarter. Recovery testing is delayed because backups appear to be working. Each decision may seem manageable on its own. Together, they can leave the organization relying on assumptions about how well it is protected and how quickly it can recover.

My view is that healthcare cybersecurity and recovery should be planned around one question: What would happen to patient care if this service became unavailable?

That gives leaders a practical basis for deciding where to invest, where to improve existing capabilities and which savings carry consequences they cannot afford to overlook.​

Begin with clinical priorities.Before discussing purchases or renewals, clinical, operational and IT teams should identify the workflows most sensitive to disruption: accessing patient records, receiving diagnostic results, processing medication orders and communicating between departments.

Then map their technology dependencies. An application may require databases, networks, authentication services and external connections. Protecting one component while overlooking another can leave the entire service exposed.

This helps establish which services need urgent restoration and which can operate temporarily through alternative procedures.

It also informs recovery targets: how quickly a service must return and how much data loss is tolerable. These requirements should guide security spending and recovery design.​

Strengthen existing protection.Once priorities are clear, assess whether essential controls are working. Are systems updated, unnecessary accounts removed, remote access controlled and administrative privileges restricted? Are critical devices monitored?

Verizon’s 2026 healthcare breach snapshot identifies vulnerability exploitation, phishing and credential abuse among initial access routes, alongside persistent staff errors and misconfigurations.

The investment should follow the gap. Some improvements require new capabilities; others require configuration changes, clearer ownership or better use of existing platforms. I would review what the organization already owns before approving another purchase. Which features are active? What is covered? Who maintains it? What evidence shows it works?

That controls costs while directing investment toward genuine needs.​

Budget for people and response.An alert needs someone to assess it and act. A vulnerability needs an owner to coordinate remediation. A suspected compromise needs a clear escalation route.

If these responsibilities fall to an already stretched IT team, leadership must understand its capacity. Decide what can be managed internally and where specialist support is needed. External arrangements should define coverage, response permissions, escalation and follow-up.

Reducing support can create misleading savings: Technology remains installed, but timely detection and response become harder. The budget must cover the work required to keep protection effective.​

Plan and test recovery.Prevention and recovery belong in the same investment discussion. “We have backups” should lead to questions. Can the organization restore a complete critical service? Are the infrastructure and credentials available? Are recovery copies protected from compromised administrative access? When was restoration last tested?

Healthcare disaster recovery requires working dependencies, usable data and validation before services resume. Clinical and application owners should confirm that the restored system supports their work.

Compare actual recovery times with agreed targets. If restoration takes too long, identify the gap and budget for improvement. An untested recovery plan leaves a critical assumption unresolved.​

Prepare for the recovery period.Even successful restoration takes time. Staff need procedures for accessing essential information, recording activity, receiving updates and reconciling records afterward.

Develop these arrangements with the departments using them, then rehearse them. Exercises can expose missing resources, unclear authority and communication channels dependent on unavailable systems.

HHS’s Healthcare System Downtime Preparedness Checklist supports planning for operational continuity and patient safety during cyber emergencies.

I would make downtime preparation and recovery testing explicit budget items. Findings need owners, deadlines and follow-up.​

Make savings through prioritization.A phased plan can address the greatest exposure first, strengthen recovery for priority services and expand coverage over time. Review unused capabilities and duplication, checking that changes preserve necessary protection.

Unsupported systems need replacement plans or documented interim controls. Medical device changes require coordination with clinical teams, biomedical engineering and manufacturers.

Suppliers also matter. Verizon’s healthcare snapshot (linked above) found third-party involvement in 32% of healthcare breaches in its dataset. Leaders should understand supplier access, incident communication and recovery responsibilities.

These decisions make spending deliberate and help distinguish efficiency from reduced readiness.​

Make the consequences visible.When a savings affects a critical control, explain what changes. Which service becomes more exposed? Is response coverage reduced? Could recovery take longer? Who accepts the remaining risk, and when will it be reviewed?

Every funding request need not be approved. Every consequential decision should be informed. I believe strong healthcare cybersecurity plans connect spending to clear outcomes: fewer priority vulnerabilities, stronger access protection, defined response coverage and demonstrated recovery.

Before cutting cybersecurity or recovery spending, ask what the savings would mean on the day a critical service fails. Patient care will still need to continue. The budget should reflect the preparation required to make that possible.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?