What Healthcare Taught Me That No Other Industry Could

I’ve secured a lot of environments, but healthcare changed how I think about the job. In most industries, the worst case for a breach is money and embarrassment — a hard quarter, a bad headline, a painful call with the board. In a hospital, the systems I was protecting were attached to people having the worst day of their lives. The record I was securing wasn’t an abstraction on a risk register. It was a person in a bed, and the speed of their care sometimes depended on whether the technology in front of a clinician worked right now. That reframes your priorities fast, and permanently.

You can’t just say no

In a bank, if a control is inconvenient, people grumble and comply. In a hospital, if your control slows down a clinician pulling up a chart during an emergency, you’re not an annoyance — you’re a risk to care. The stakes on the other side of your security decision aren’t productivity and morale; they’re someone’s treatment. I learned to design security that got out of the way of the mission, because the alternative was that people would route around it — and in that context, they were right to. A nurse who bypasses your clumsy control to get a doctor the information they need in a crisis is not the problem. Your control is the problem.

So the design discipline becomes: make the secure path the fast path, especially under pressure. Break-glass access for emergencies that’s logged and reviewed rather than blocked. Authentication that’s strong but doesn’t make someone fight a login while a patient waits. Security that assumes the user is a good person doing an urgent job, and builds guardrails that protect them without slowing them down. That’s harder than saying no. It’s also the only version that survives contact with a real emergency room.

Availability is a patient-safety control

In most of my career, “availability” meant revenue — downtime costs money. In healthcare, downtime can mean harm. When systems go dark in a hospital — the chart, the medication records, the imaging — clinicians fall back to paper and memory under pressure, and that’s exactly when mistakes happen. So keeping systems up stopped being an operational nicety and became part of keeping people safe. It changed how I thought about ransomware in particular: the threat wasn’t just extortion or data theft, it was a system that could take a hospital’s ability to function offline at the worst possible moment. That’s not an IT problem. That’s a clinical one.

The data never dies

A stolen credit card gets cancelled in an afternoon. A stolen medical record is valid forever — your history, your conditions, your diagnoses, things you can’t change and can’t reissue. You can’t call the bank and get a new medical history. That permanence raises the stakes on everything: how long you keep data, who can see it, how you prove it hasn’t been tampered with. A breach in most industries is a bad moment that fades. A breach of health data is a harm that follows people for the rest of their lives, which is exactly why that data is worth so much to the people trying to steal it.

HIPAA is a floor, not a ceiling

HIPAA gets treated like a paperwork exercise — a box you check, a training module people click through, a policy binder for the auditor. In practice it’s a floor, not a ceiling, and the real work started exactly where the checklist ended. Compliance told me the minimum I had to do to avoid a fine. It said very little about whether a determined attacker could actually reach a million patient records, which is the question that kept me up. I’ve seen organizations that were technically HIPAA-compliant and genuinely exposed, because they mistook the regulatory minimum for a security program. The regulation is a useful starting line. It was never meant to be the finish.

Design for the worst day, not the demo

Every security control looks great in a calm conference room during a demo. The real test is the 3 a.m. version — understaffed, high-stress, a genuine emergency, someone who needs the system to just work. If your control only holds up on a good day, it doesn’t hold up, because the bad day is the entire point. Healthcare forced me to design for that worst day as the default assumption rather than the exception, and it made me a better security leader everywhere I’ve gone since — because every industry has its version of the 3 a.m. emergency, and controls that only work when everyone’s calm and rested are controls that fail when it counts.

In the end, healthcare taught me that security isn’t really about the data. It’s about the people the data is attached to — their care, their safety, their privacy in moments they never chose to be vulnerable in. I’ve carried that into every environment since. Even when I’m securing a payments system or a factory floor, I try to remember that behind the records and the machines are actual people who are counting on me getting it right, whether they’ll ever know my name or not. That’s the version of this job worth doing.