Smaller U.S. hospitals and physician practices now face many of the same cyber threats as large health systems, but they defend against them with far leaner security teams. As of 2025, the country had more than 395,000 physician group practices, according to one healthcare market data and analytics company, and roughly 60% of hospitals had fewer than 100 beds. Security leaders and policymakers are pressing for support models that match the resources of these organizations.
The gap matters because these providers still deliver a substantial share of patient care, even as many large systems dominate the conversation about growth and consolidation.
Why Smaller Providers Are Now in the Crosshairs
Historically, smaller providers were seen as less attractive targets. Attackers tended to pursue large health systems with bigger payrolls, more patient records and greater capacity to pay ransoms.
That calculation is shifting. Smaller organizations often run the same electronic health record platforms, cloud services and connected devices as larger peers. Many also have fewer layers of defense, which can make them easier to breach.
Attackers also do not need to hit a target directly. A compromise at a shared vendor or billing partner can ripple across thousands of providers at once, regardless of size.
Background: A Fragmented Care Landscape
The scale of the challenge comes from how healthcare is organized. Hundreds of thousands of independent and small-group practices operate alongside community hospitals, many in rural areas where they are the main source of care.
For these organizations, cybersecurity may fall to one IT generalist, a small team or an outside managed service provider. Security often competes with clinical equipment, staffing and facility costs for limited budget dollars.
The consequences of an outage are also severe for a small provider. If the electronic health record goes down, clinicians may revert to paper charts, delay appointments or divert ambulances, and few have the redundancy to absorb a prolonged disruption.
Federal Guidance Targets Organizations of All Sizes
Federal agencies have tried to address the resource gap. The U.S. Department of Health and Human Services (HHS) published Health Industry Cybersecurity Practices (HICP), a voluntary framework under its 405(d) program, with guidance scaled for small, medium and large organizations.
HICP identifies five major threats: social engineering such as phishing, ransomware, loss or theft of equipment or data, insider data loss, and attacks against connected medical devices. It pairs them with practices including email protection, endpoint protection, access management, data protection and incident response planning.
In January 2024, HHS also released voluntary cybersecurity performance goals. They separate essential safeguards from enhanced ones, so organizations with limited capacity can prioritize.
In January 2025, HHS proposed updates to the HIPAA Security Rule that would strengthen requirements for protecting electronic patient health information. Any final rule could raise the compliance bar for providers of every size.
What Support for Lean Teams Looks Like
Security practitioners and federal guidance converge on several approaches that suit organizations with limited staff.
Focus on fundamentals. Multifactor authentication, timely patching, secure backups and staff phishing training address common attack paths without requiring large teams.
Use outside expertise selectively. Managed detection and response services and virtual security officers can provide round-the-clock monitoring that a small in-house team cannot staff. Providers still need to vet partners and clarify who is responsible for what.
Plan for failure. Tested incident response and downtime procedures can limit disruption to patient care. Offline backups and clear communication plans help restore operations faster.
Manage vendor risk. Because third-party breaches can affect many providers at once, contracts and security questionnaires matter. So does knowing which vendors hold patient data.
Tap shared resources. Industry groups, information-sharing organizations and federal agencies offer threat alerts and free or low-cost guidance that can supplement limited internal capacity.
Implications for Patients and the Industry
For patients, the stakes extend beyond privacy. A cyberattack on a community hospital or clinic can delay care and expose sensitive records. In some cases it can force patients to travel farther for treatment.
For providers, the pressure is likely to come from several directions at once. Regulators are weighing stricter security standards, and cyber insurers have tightened underwriting requirements in recent years. Partners increasingly expect proof of baseline controls.
For the cybersecurity industry, the trend creates demand for affordable, easy-to-manage tools and services built for organizations without dedicated security operations centers.
What to Watch Next
Several developments will shape how well lean teams can keep pace. Observers are watching whether HHS finalizes its proposed HIPAA Security Rule changes and what flexibility, if any, it gives smaller organizations. They are also watching whether federal or state programs offer funding or technical assistance for under-resourced providers.
Another open question is whether attackers continue shifting toward smaller targets and shared vendors. If they do, the security of community hospitals and independent practices will weigh more heavily on the resilience of the whole healthcare system.
Frequently Asked Questions
Why are smaller healthcare providers now attractive targets if they have fewer patient records and smaller payrolls?
Attackers have found that smaller providers often use the same electronic health record platforms, cloud services and connected devices as large systems, but with fewer layers of defense. That makes them easier to breach. A single compromised vendor can also expose thousands of providers at once, regardless of size.
What is HICP and is it mandatory for small practices?
Health Industry Cybersecurity Practices (HICP) is a voluntary framework from HHS under its 405(d) program. It is not mandatory. It offers guidance scaled for small, medium and large organizations, covering five major threats and matching practices such as email protection, endpoint protection, access management, data protection and incident response planning.
How do HHS cybersecurity performance goals help organizations with limited capacity?
Released in January 2024, the voluntary goals divide safeguards into essential and enhanced categories. Organizations with limited staff or budget can start with the essential measures and add enhanced ones as resources grow, rather than trying to implement everything at once. This helps them prioritize in a practical order.
Can a lean team realistically defend itself without a large security staff?
Yes, to a meaningful degree. Focusing on fundamentals such as multifactor authentication, timely patching, secure backups and staff phishing training addresses common attack paths without needing a big team. Selective outside help, like managed detection and response, can cover round-the-clock monitoring that a small in-house group cannot staff.
If a provider hires an outside security partner, does that transfer the responsibility?
Not entirely. The article notes that providers still need to vet outside partners and clarify who is responsible for what. Managed services and virtual security officers can add monitoring and expertise, but the practice remains accountable for its patient data and should define roles, expectations and response duties in contracts.
How could the proposed HIPAA Security Rule update affect small providers?
HHS proposed updates in January 2025 that would strengthen requirements for protecting electronic patient health information. If finalized, a rule could raise the compliance bar for providers of every size, meaning small hospitals and practices might have to meet stricter standards despite limited staff and budgets.