I will never forget the day we rushed through the hospital doors, ready to become first-time parents. Technology, managed services, and compliance were furthest from my mind. As we were about to be escorted to the maternity ward, I looked up at the 47” display mounted above the entrance, and I couldn’t believe my eyes. There, bouncing from edge to edge on the screen was an old friend whom I did not expect to see: the Windows XP logo as a screensaver.
The reason for my surprise?
It was 2024, and Windows XP had been out of support for over 10 years (April 8, 2014).
I should not have been surprised, as studies coinciding with the COVID pandemic in 2020 cited that as many as 83% of IT systems and medical devices in hospitals are running outdated software. Sadly, with the upcoming End of Support for Windows 10, it would be a fair expectation for that number to increase in the coming months. Naturally, this raises serious questions.
How can this happen in an industry as highly regulated and responsible for as much sensitive data as healthcare? The answer is not complicated.
The hidden cost of compliance and cyber risk
While IT budgets, especially cybersecurity budgets in healthcare IT, have consistently risen over the last several years, the growth rate has declined year-over-year for several consecutive years. This is happening while the threats facing healthcare organizations and IT have never been higher, and high-level breaches, like United Healthcare in 2024, dominate the headlines and only embolden the next wave of attackers.
Security is not the sole consideration in healthcare. Regulatory compliance, primarily driven by HIPAA regulations, is a guiding principle for every IT team. The standards set by HIPAA ensure the processes for protecting, securing, and disclosing in the event of breach are adequate to store, handle, and process the sensitive data included within Protected Health Information (PHI) and Personally Identifiable Information (PII).
This data requires extra protection as it contains sensitive and valuable information such as patient names, addresses, social security numbers, medical conditions, and past procedures, everything a hacker needs to compromise an individual.
According to IBM’s “Cost of a Data Breach Report,” in 2024, the average cost of a healthcare data breach exceeded $9.7M, with the average cost per individual record compromised (each single piece of PHI or PII exposed) estimated at $500. Since tracking healthcare-specific breaches began in 2009, the number of reported violations per year has steadily increased from 19 in 2009 to 734 in 2024.
Underfunded, overstretched IT teams
Given HIPAA and the exorbitant costs of a breach, the IT side of healthcare is poised to properly protect its data, systems, and applications; however, healthcare IT leaders and teams are constantly asked to do more with less. Each year, as demands grow, regulatory requirements increase, and practices, policies, and procedures face more scrutiny, while the resources to meet these needs continue to shrink.
In an age of ever-increasing technological demands, limited staffing, and shrinking budgets, how can healthcare IT organizations stay ahead of the curve and find the roadmap to success in managing the availability, security, and compliance of their systems, solutions, and data?
The answer: partnering with the right Managed Services and/or Cloud Services Provider.
Specialization that scales: The MSP advantage
The increasing threats of breaches and data loss, coupled with the complexity of decentralized systems that can span a variety of Cloud and Software-as-a-Service providers, require a deep bench of experienced technical experts familiar with and well-suited to the challenges. Maintaining that level of expertise within your own, internal IT staff can prove next-to-impossible, as focus always comes back to the operational nature of keeping our systems up, keeping our users productive, and keeping our applications and data safe. This means that having time to focus on the larger, strategic objectives of our businesses often falls by the wayside as priority usually drifts back to maintaining the status quo.
Additionally, having the time to enable and encourage our IT teams to seek out additional training, knowledge, and certifications is a luxury that many, if not most, healthcare IT teams cannot afford.
The specialization that a Managed Service Provider can offer, whether specifically focused on compliance, security, IT resilience, cloud hosting, AI-readiness and integration, or even point-in-time auditing from an impartial, third-party perspective, can be a game-changer for organizations who feel bogged-down with the ”keeping the lights on” part of the job.
These providers not only have their own multi-faceted, multi-talented staff who have helped multiple other healthcare organizations overcome similar challenges, but they have unparalleled access to the vendors who supply the platforms, tools, and solutions that are used to deliver their services. By the economies of scale in which they deal, MSPs and CSPs often have direct access to higher tiers of vendor support to escalate and expedite requests, whether resolving potential issues or requesting new features or functionality that may not be currently available.
Fast-tracking compliance with HITRUST certification
Additionally, in the healthcare industry, some providers can also offer an “expedited path” to achieving HIPAA compliance through the HITRUST CSF Framework. HITRUST is framework that provides a granular and structured approach to ensuring that compliance requirements, both in technology and policy, are properly met. One of the most interesting aspects of HITRUST is the concept of “inheritable controls.” This allows companies to leverage the HITRUST Certified status of Managed/Cloud Service Providers to “check the box” for those aspects of their environment, simplifying, streamlining, and reducing costs of the regularly recurring auditing process.
For the team: Offload the mundane
The passion for their work is evident throughout all who work in healthcare IT, but few and far between are the IT professionals who tell you they are passionate about applying desktop patches, providing tier 1 application support, or performing device provisioning and reclamation. While these types of tasks may not be considered glamorous, they are the foundation of ensuring that healthcare IT operations remain secure and within the constraints of policies dictated by compliance requirements.
By working with a trusted partner as a Managed Services Provider, especially one that is HITRUST certified, healthcare IT teams can offload these routine tasks to allow themselves to elevate within their organizations, shift their thinking from tactical to strategic, and better serve the needs of their IT professionals on staff, their companies, hospitals, and clinics, as well as the patients being served.
Let’s make sure the next time you walk through a hospital lobby, you don’t see the Windows XP logo, questioning whether your PHI and PII could be at risk.
