SecurityScorecard ran an attacker’s-eye view across about 40,000 U.S. hospital and clinic records and published the results as a report titled “Visiting Hours.” The headline number for hospital CISOs: roughly 5,862 records, or about one in seven healthcare records in the dataset, carry a Known Exploited Vulnerability flag, meaning CISA has documented the flaw being used in real attacks.
Grade scores did not correlate with safety. Of 7,818 graded records, 62.5% earned an A or B, yet one Texas health system holding an A was running eight urgent vulnerabilities on live machines, the highest count of any group studied.
Supplier concentration is the other structural problem. Among 12 Texas hospital groups, 11 relied on the same vendor, and 72 of 313 suppliers appeared at two or more groups. Rural clinics earned D or F grades more often than hospitals, and leaked-credential signals turned up on 3,767 records, 9.6% of the dataset, with 10 showing signs consistent with possible compromise.
Healthcare context matters here. The report’s blast-radius maps show how a single breach cascades once ambulances and imaging are involved, because a rural county’s next hospital may sit 30 miles away. Vendors now account for the majority of healthcare breach victims this year.
The firm recommends a 30-day plan built around closing exposed services and rotated credentials rather than chasing letter grades. The report deliberately does not name individual organizations.
