Five years later, the same six problems

In March 2021, Medcrypt published "Why Healthcare Cybersecurity Is Hard," naming six structural constraints that no amount of security spending could fix on its own. Five years later, we went back and checked each one against the record: new breaches, new regulation, and a materially different vendor landscape. Four of the six constraints haven't just persisted, they've intensified. Two have genuinely changed, largely because regulation forced it. None have gone away.

Healthcare has now ranked as the costliest industry for a data breach for 14 consecutive years running. The 2024 Change Healthcare/UnitedHealth breach alone affected 192.7 million people, the largest healthcare breach on record. At the same time, new FDA authority (Section 524B's postmarket mandates, Section 515C's change-control provisions, and the QMSR effective February 2026) has genuinely reshaped two of the original six constraints. Understanding which problems are structural and durable, and which are actually solvable through regulation, is the difference between a security program that treats symptoms and one that addresses root causes.