Researchers have finally put a hard count on what a hospital cyberattack costs patients, though the figure is almost certainly too low.
The Health Management Academy logged cyberattacks on US hospitals and health systems where care was reported disrupted between January 2022 and September 2026. The total came to 65 incidents touching at least 305 hospitals across 36 states, the District of Columbia, Guam and the Virgin Islands.
The pattern that matters for continuity planning is downtime. In 58 of those attacks, roughly 89%, key clinical systems went offline and staff reverted to paper. Where a restoration date was available, the median clinical system outage ran 15 days, and more than one in five stretched past a month.
Ambulances went on divert in 26 cases, or 40%, sending patients to alternate emergency departments. Another 28 attacks, 43%, delayed care through cancelled or postponed surgery, appointments or treatment. A single incident reached 140 hospitals.
Why the record undercounts
The authors point to a reporting gap. The HIPAA breach notification rule requires disclosure of data breaches, not cyberattacks, so an intrusion that halts radiology but never touches PHI simply never reaches the federal record. The Office for Civil Rights also publishes summaries only above 500 affected individuals.
The academy found one in five publicly disclosed attacks older than a year still absent from the OCR portal. It tracked just 12 confirmed care-impact events in 2025, against 807 large breaches reported to OCR that year.
The remedy proposed is measurement: days of clinical downtime, hours on diversion and procedures postponed, so executives can benchmark recovery against peers. Nothing in current rulemaking compels those numbers.
