Healthcare can’t stop. When a digital system behaves unexpectedly, a cyber incident disrupts access or a control fails, health leaders must be ready to respond while keeping patient care moving. The recent breach of Australia’s Medicare statistics reporting portal highlights a related challenge: health data and digital services now sit within a much broader ecosystem, and weaknesses in one part of that ecosystem can expose sensitive information, undermine trust and create risk across connected services.
The scale of the threat is growing: the latest Australian Signals Directorate reports that ransomware incidents targeting healthcare doubled year-on-year. For health leaders, that escalation makes cyber resilience more than a security priority; it is a prerequisite for maintaining care during times of disruption.
In healthcare, downtime is not only disruptive, but it can also affect access to records, delay treatment, leave clinicians without the information they need and, ultimately, put lives at risk. The challenge is not simply identifying, containing and resolving an incident but ensuring services can continue safely while systems are restored.
Cyber and clinical resilience are fundamentally linked. In healthcare, operational continuity is patient care.
Connected care demands shared accountability
Healthcare’s interconnectedness amplifies risk. Coordinated care depends on information moving securely between hospitals, GPs, specialists, pathology providers, pharmacies, aged care services and government platforms. Those connections improve outcomes but also increase complexity and exposure, particularly where ageing technology was not designed for today’s threats.
That makes the regulatory direction significant. As government moves from voluntary participation towards sharing by default, beginning with pathology and diagnostic imaging reports, it is also tightening the security and access obligations that support that exchange.
From 1 October 2026, healthcare organisations participating in My Health Record must be able to demonstrate stronger governance around user access, staff training, data-breach response and record keeping. The message for leaders is clear: expanding access to patient information and strengthening the controls that protect it must advance together.
This is also a third-party risk management challenge. Patient data and critical services now span healthcare providers, software vendors, cloud platforms, APIs, connected devices and their suppliers. AI-enabled automation adds another layer of complexity, particularly where sensitive information moves between systems and environments with differing levels of security and oversight. It is easy to point to a third party when a service is disrupted, but the reality is that the consequences flow through the entire supply chain. Effective shared accountability means security and continuity requirements must extend across every layer, with controls continuously validated to ensure they remain fit for purpose. No organisation can assume its own systems are secure without understanding the risks introduced by its partners and suppliers.
If healthcare can’t stop, are we resilient enough to keep care moving?
For leaders, the question should not only be, “How do we protect every system?” It should also be, “How will care continue when a system is unavailable?” The answer may include secure-by-design platforms, stronger clinical governance, disaster recovery environments and failover capability. It may also include simpler contingency plans, such as temporary manual processes. Whatever the approach, patient needs must come first, even when stronger authentication or tighter controls introduce additional steps for users.
Resilience is ultimately measured by whether clinicians can access critical information, patients can continue receiving care and services can recover safely when disruption occurs.
Trust is foundational to the future of digital health. Connected, data-driven and AI-enabled care will only succeed if patients and clinicians are confident that systems are secure, reliable and accountable.
Cyber resilience must extend across the wider health ecosystem with security, governance and continuity planning embedded across the systems, services and partnerships that healthcare depends on. This will help protect patient trust, reduce the flow-on impact of disruption and maintain critical services – because healthcare can’t stop.
