October is Cybersecurity Awareness Month
Throughout the month we will take on cybersecurity subjects that continue to be challenging in healthcare today and ask our experts to weigh in.
Topic #3: Data Fragmentation and Interoperability Gaps
Healthcare data lives everywhere in, EHRs, imaging systems, pharmacy systems, wearables, patient portals, third‑party vendors, and cloud platforms. This fragmentation creates inconsistent security controls across systems, high-value data moving across insecure interfaces, and expanded attack surfaces through third‑party vendors. This results in breaches often occurring not through hospitals themselves, but through business associates (billing companies, transcription vendors, cloud services).
Chris Logan, Healthcare CISO, Zscaler
LinkedIn: Christopher Logan
Healthcare data is supposed to move. Clinicians need it, applications need it, and partners need it. The answer can’t be to lock everything down so tightly that people can’t do their jobs. Security should make that exchange safer by giving the right people access to the right data and applications, without giving them access to the entire network.
John Atkinson, CTO & COO at AxisCare
LinkedIn: John Atkinson
Data fragmentation isn’t only an operational challenge; it can also create additional security risks. The best approach is to prevent fragmentation by selecting technology platforms that support as many workflows as possible within a single system. While connecting platforms will still be necessary, organizations should prioritize those with built-in, vendor-managed integrations. When custom integrations are unavoidable, it’s critical to assign clear ownership and establish ongoing governance to ensure they are monitored, maintained and retired when no longer needed. This reduces unnecessary complexity while strengthening security and operational efficiency.
Leigh Burchell (Altera Digital Health), Chair, EHR Association
LinkedIn: Leigh C. Burchell
When organizations lack a complete picture of their internal systems and third-party integrations, data can become fragmented across networks to the point where there is no clear audit trail and intended protections are more difficult to fulfill. Consider a terminated employee: HR records the termination in the authoritative system, but the identity provider never receives the update. This means that other internal and vendor systems maintain local accounts that don’t reflect the status change, so a later access review pulls and validates an active account for someone who no longer works there. The proposed updates to the HIPAA Security Rule would make long-standing best practices mandatory, requiring covered entities and business associates to maintain a written technology asset inventory and a network map showing how ePHI moves through their systems (including a requirement to terminate a departing workforce member’s access within one hour). Turning these practices into obligations would help shore up security weaknesses across the industry.
Jeremy Carriger, Chief Information Security Officer, Arcadia
LinkedIn: Jeremy Carriger
The growing number of applications, models, and AI-enabled workflows touching healthcare data creates a greater need for security teams to understand where that information is going and how it is being used. As healthcare moves from experimenting with AI to embedding it into everyday workflows, cybersecurity leaders need to think beyond simply approving or blocking individual tools. Shadow AI, autonomous agents, and AI-enabled features quietly added to existing applications can change what data is being accessed, where it is going, and what actions the technology can take. An application that was previously considered low risk can look very different when an AI feature allows users to connect additional data sources. That makes visibility, data governance, and consistent security controls increasingly important as healthcare’s technology environment becomes more interconnected.
Jeffrey Eyestone, Chief Strategy & AI Officer, P-n-T Data Corp.
LinkedIn: Jeffrey Eyestone
The interoperability problem has changed shape. For twenty years, the goal was to get a claim or an authorization request from one system to another as a standard transaction. That is largely done. What is not done is everything the transaction now has to carry with it.
A claim or a prior authorization increasingly cannot be adjudicated on the EDI alone. The payer wants clinical notes, diagnosis history, medication lists, imaging, payer-specific forms, and more. The evidence lives in four or five systems in as many formats: X12, HL7, FHIR, CDA, PDF, fax. Each additional source is another integration, another format to reconcile, another copy of PHI sitting somewhere it does not need to be, and more friction.
What’s needed is data engineering: quality applied before submission rather than after denial, data transformation and orchestration, and governance that can prove where every element came from and who touched it or holds onto it. Fragmentation is not a wiring problem anymore. It is a data engineering problem.
Johnny Kaye, COO, MDaudit
LinkedIn: Johnny Kaye
Fragmented data is where revenue leaks and compliance risk hide. When documentation sits in one system, coding in another, and payer responses in a third, no one sees the full picture of a claim until something goes wrong, usually as a denial or an audit finding. Payers are investing heavily in automation and analytics to review claims. Providers need the same unified view of their own data, or they’ll keep discovering problems after the revenue is already at risk.
Ajai Sehgal, Group Chief AI Officer, IKS Health
LinkedIn: Ajai Sehgal
Healthcare cybersecurity is challenged by data fragmentation and interoperability gaps. Patient information is scattered across disconnected systems like EHRs, labs, payers, and third-party apps, making it nearly impossible to enforce a unified cybersecurity approach.
This creates additional risk including:
- Expanded attack surface: Every vendor interface and duplicate data copy is a potential entry point for attack.
- Inconsistent protections: Many legacy systems commonly used in hospitals and clinics rely on weak authentication and outdated software that never gets updated.
- Dangerous workarounds: When systems don’t communicate smoothly, clinical staff resort to insecure methods like email or shared logins to ensure care delivery.
- Blind spots and slow response: Scattered audit logs make detecting threats and containing breaches very difficult.
- Permissions everywhere: Users retain unnecessary access rights across many disconnected platforms, which is difficult to manage and risky.
- Supply chain risks: Third-party integrations confuse responsibility for patching and monitoring various systems.
- Patient safety: Hacker/ransom attacks on fragile integrations can make critical clinical data unavailable, directly threatening care delivery.
The real threat is poorly governed interoperability. Secure data exchange actually strengthens defense by eliminating rogue data copies, standardizing access controls, and centralizing threat detection.
In the end, data fragmentation and interoperability gaps make security unmanageable. Healthcare organizations must build a secure ecosystem where data is both seamlessly connected and uniformly protected. This means having a single common data model leveraged across applications.
Scott Stuewe, President and CEO, DirectTrust
LinkedIn:Â Scott Stuewe
Over the last two years, the threat environment has entirely changed, while the behavior of threat actors hasn’t really seen much of a shift – yet. We all know that it’s much easier to identify existing vulnerabilities in systems by using AI, but there hasn’t been a huge change from what we were seeing in the pre-Claude, pre-ChatGPT era. Why? Because while it’s a lot easier to find the nooks, crannies, and holes in the walls that complex legacy environments have always had, it’s still much easier to just walk in the front door with a valid credential obtained through phishing or another social engineering method.
However, AI has changed the pace of these attacks. Now, attackers are trying the front door thousands of times an hour. This gives enterprises only a brief respite to patch vulnerabilities they are able to identify with AI themselves, hopefully before attackers change their preferred patterns. Attackers are already using their knowledge of these vulnerabilities to navigate systems and exfiltrate data or deploy ransomware once they gain credentials for primary systems. To keep their systems safer, healthcare organizations need to make gains in their effort to safeguard the front door while simultaneously strengthening their layered armor and confidence in the protections deployed by connected third parties.
Russell Teague, Chief Security and Strategy Officer, Fortified Health Security
LinkedIn:Â Russell Teague
Every new integration in healthcare can create another pathway to sensitive data and critical systems. The risk is not interoperability itself; it is losing visibility and accountability as connections multiply across applications, vendors, devices, and care settings. Fragmented systems can leave organizations without a consistent view of who can access sensitive information, where copies reside, or whether suspicious activity spans multiple platforms. Interoperability gaps can also encourage manual workarounds that are harder to govern and monitor. Well-designed data sharing can improve visibility, provided security and accountability follow the information across systems and organizations.
Organizations should maintain an inventory of interfaces and application programming interfaces, identify the information each connection can access, and assign an accountable owner, apply appropriate authentication and least-privilege access, monitor activity, and define how the connection will be changed or retired. As healthcare expands data sharing, treating each connection as a lifecycle risk decision rather than a one-time technical task allows openness and security to advance together. Discipline is what makes both possible.
Dr. Nick van Terheyden aka Dr. Nick
Host of News You Can Use
LinkedIn:Â Nick van Terheyden, MD
Fourteen systems. Zero visibility. One very happy hacker.
Interoperability is when your systems share data on purpose. Fragmentation is when attackers do it for you. Your patient’s data lives in 14 systems. Attackers only need to find one unlocked. Silos don’t protect data. They just hide the leaks. If no one knows where the data lives, no one knows when it’s gone. Map your data flows. If it surprises you, it will delight attackers. Then keep on mapping and monitoring.