I&#x27;ve been in Healthcare IT for a decade and a half or so, and I think there&#x27;s definitely a reckoning coming with regard to the lapses in security.<p>I think honestly, the only thing that&#x27;s kept this from being a problem with greater consequence is that to date it hasn&#x27;t been clear that there&#x27;s a real path to monetization of health data. It&#x27;s been a lot more profitable to chase down credit card #&#x27;s and mass email&#x2F;password combinations that lead to banking access.<p>I&#x27;ve long wondered when a solid monetization strategy for health data would show up and we&#x27;d see a quick rush to target these datasets. Trends that I see that make me think we&#x27;re getting closer:<p>1. Systems are increasingly net-connected, obviously. In some ways it&#x27;s increasing security (literally most hospitals I&#x27;ve been in you could plug into any ethernet port in the building and be on a network where pretty sensitive data is sent in the clear), but it&#x27;s making these systems available to a larger number of interested attackers<p>2. Patients have accounts now. Health data is suddenly a not-insignificant source of email&#x2F;password combinations for patients (previously just employees). Pretty reasonable to expect that health systems may be the source of future Gawker-style breaches for collecting poorly protected user credentials that can be used elsewhere.<p>3. The uptick and cost-effectiveness of encryption-ransomware, personal and corporate. It&#x27;s been interesting to see cases where the data itself isn&#x27;t monitezed because it has some broad market value, but solely by threatening the owners with it&#x27;s release or exposure. I won&#x27;t be surprised if Healthcare organizations or individual patients find themselves victims of extortion either by threatening to publish sensitive health data, or to destroy it.<p>There is (finally) an extra-linear increase in attention to this issue in Health IT, but there&#x27;s also quite a large backlog of debt and an enormous number of systems deployed that were built for a different reality than current exists.