Only 19% of practice leaders are very confident their group could recover quickly from a cyberattack, according to MGMA Stat's October 6, 2026 poll of 238 respondents. In January 2025 the figure was 20%, and 21% of leaders now say they are not confident at all.
What the October 2026 poll found
MGMA Stat asked practice leaders how confident they were in a fast recovery. Of 238 applicable responses, 19% said very confident, 61% said somewhat confident and 21% said not confident. The published figures add to 101%.
The same question ran on January 22, 2025. The article does not state that poll's sample size. The share answering "not confident" fell by 6 points between the two polls, and the "somewhat" group grew by 7 points. The "very confident" group barely moved, so 82% of leaders in October 2026 sit outside it (61% somewhat confident plus 21% not confident).
| Answer | January 2025 | October 2026 |
|---|---|---|
| Very confident | 20% | 19% |
| Somewhat confident | 54% | 61% |
| Not confident | 27% | 21% |
Source: MGMA Stat, October 7, 2026. Base: practice leaders answering the poll (238 in October 2026).
What an outage cost practices in 2024
The clearest measure of recovery cost comes from the Change Healthcare outage. The American Medical Association ran an informal survey from March 26 to April 3, 2024 and published it on April 10, 2024. It drew a convenience sample of more than 1,400 respondents, and 1,097 of them (78%) worked in practices with 10 or fewer physicians.
The outage hit practices at the claims stage. The AMA found that 36% of respondents saw claim payments suspended, 32% could not submit claims and 22% could not verify eligibility for benefits.
| Financial effect | Share of respondents |
|---|---|
| Lost revenue from unpaid claims | 80% |
| Added staff time for revenue cycle tasks | 85% |
| Lost revenue from uncollected copays and balances | 51% |
| Used personal funds for practice expenses | 55% |
| Could not buy supplies | 44% |
| Could not make payroll | 31% |
| Reduced hours | 15% |
Source: AMA informal survey, March 26 to April 3, 2024, more than 1,400 respondents. A convenience sample is not representative of all practices.
Only 15% of practices cut their hours, so most stayed open and covered the gap themselves. Outside help was thin. Respondents reported assistance from UnitedHealth Group or Optum at 25%, CMS at 12%, other health plans at 4.5% and state Medicaid plans at 0.7%.
How often practices are attacked and how much they spend
MGMA's February 15, 2022 poll of 828 practices found that 16% had faced a cyberattack or ransomware incident in 2021.
Spending has risen since then. In MGMA's September 17, 2024 poll of 326 groups, 72% raised cybersecurity spending during 2024 and 28% did not. A July 9, 2024 MGMA poll found that 26% of leaders named IT as the biggest non-labor expense increase. A 2023 MGMA poll found that 74% of groups reported higher health IT compliance costs than the year before.
MGMA's October 2026 article also cites the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, published in April 2026. It puts ransomware at 36% of reported cyber threats in 2025, with more than 3,600 complaints.
Spending rose during 2024 for 72% of groups, yet the share of leaders who are very confident in recovery was 20% in January 2025 and 19% in October 2026.
What HHS has proposed for recovery time
The HHS Office for Civil Rights announced a proposed update to the HIPAA Security Rule on December 27, 2024. It was published in the Federal Register on January 6, 2025, and comments closed March 7, 2025. Paul Hastings summarized the proposal on January 22, 2025.
| Proposed requirement | Timing |
|---|---|
| Written procedures to restore lost systems and data | Within 72 hours |
| Business associate notice after activating a contingency plan | Within 24 hours |
| Vulnerability scanning | At least every 6 months |
| Penetration testing and compliance audits | At least every 12 months |
| Asset inventory, network map and incident response plan test | At least every 12 months |
| Final rule takes effect | 60 days after publication |
| Proposed compliance date | 180 days after the effective date |
Source: Paul Hastings, January 22, 2025, summarizing the HHS OCR proposed rule.
HHS cited a 100% rise in reported breaches of unsecured protected health information between 2018 and 2023, and a 950% rise in affected individuals. MGMA reported in October 2026 that McDermott Will & Schulte, in a July 16, 2026 note, projects final action on the rule in July 2027.
Who files the breach reports
The HIPAA Journal's tracking of the HHS breach portal, updated September 8, 2026, lists 804 large breach reports for 2025. Healthcare providers filed 604 of them, or 75.1%. Business associates filed 139 (17.3%), health plans 59 (7.3%) and clearinghouses 2 (0.2%).
| Entity type | Large breaches, 2025 | Share of 804 |
|---|---|---|
| Healthcare providers | 604 | 75.1% |
| Business associates | 139 | 17.3% |
| Health plans | 59 | 7.3% |
| Clearinghouses | 2 | 0.2% |
Source: HIPAA Journal, Healthcare Data Breach Statistics, updated September 8, 2026, citing the HHS OCR breach portal.
Business associates, the vendors that handle billing, scheduling and claims data, filed about 1 in 6 of the reports. The proposed 24-hour contingency notice would apply to that group of companies.
Sources
- MGMA Stat, Only 19% of practice leaders are very confident they could recover quickly from a cyberattack, October 7, 2026
- American Medical Association, Physicians struggle to keep practices afloat after Change cyberattack, April 10, 2024
- MGMA Stat, Confronting the rising price tag of cybersecurity in medical practices, September 18, 2024
- MGMA Stat, Cyberattacks, ransomware still a growing threat for medical practices, February 16, 2022
- Paul Hastings, HHS OCR releases proposed updates to HIPAA Security Rule, January 22, 2025
- HIPAA Journal, Healthcare Data Breach Statistics, updated September 8, 2026
Talk to us
Fifteen minutes about your practice and the systems you run.