Cyber Governance Is Board Governance. A Director's Guide to Healthcare Risk.

A cyberattack in healthcare is a board issue the moment care, cash flow, or patient data is at risk. In this piece, I’d boil the message down to this: if a ransomware event can help drive $60 million+ in losses, delay treatment, and disrupt records, the board has to treat cyber like finance, audit, and patient safety.

Here’s the short version:

• Cyber risk is business risk in healthcare, not just an IT matter.
• Boards need to watch three main exposure areas: ransomware and downtime, PHI breaches, and vendor/supply chain risk.
• I’d expect directors to set risk appetite, define what gets escalated, and require plain-English reporting from management.
• The board’s job is oversight. Management’s job is execution.
• Good board reporting should focus on downtime, recovery time, vendor gaps, insurance limits, and financial exposure.
• In healthcare, poor cyber oversight can affect patient care, not just systems.

A few facts make the point fast:

• University of Vermont Medical Center reported more than $60 million in lost revenue after ransomware.
• Scripps Health reported more than $100 million in losses tied to ransomware, business interruption, and cleanup.
• Research cited in the article links hospital cyberattacks to longer stays and higher mortality rates.

When Cyberattacks Strike: Is Your Board Ready?

sbb-itb-535baee

Quick Comparison

If I were summarizing the article for a director, I’d say this: set clear thresholds, get cyber on the board agenda, test recovery, and make management report in business terms. That’s the core idea behind the rest of the piece.

The Healthcare Cyber Risks Boards Must Monitor

Boards don’t need a long list of cyber threats. They need to watch the few risks that can interrupt care, choke cash flow, trigger compliance trouble, and knock out vendor support. Once cyber is treated as enterprise risk, the next step is simple: manage the healthcare cyber risk portfolio to map the threats most likely to hit care delivery, compliance, and day-to-day operations.

Ransomware, Downtime, and Clinical Disruption

The first board-level question is blunt: Can the organization still treat patients during an outage?

Ransomware can move fast across hospital systems. When that happens, both clinical and business workflows can grind to a halt. Patient diversion may become necessary, and revenue cycle work can break down. For boards, the job isn’t to dig into technical jargon. It’s to decide whether recovery time is fast enough to protect patients and keep operations moving.

That means pressing management on detection, containment, and recovery times - and asking whether those time targets have been tested under conditions that look like an actual crisis ^[1].

"HDO boards and leaders must understand the dependencies and risks across these digital clinical and business processes when making decisions." - Ed Gaudet, CEO and Founder of Censinet ^[1]

Independent studies have linked hospital cyberattacks to increased mortality and longer hospital stays ^[1]. That’s why recovery speed sits at the center of this issue. This isn’t just an IT problem. It can affect patient safety in a direct way.

PHI Breaches, Privacy Exposure, and Regulatory Risk

Some cyber events don’t stop care, but they can still hit hard.

A breach involving protected health information (PHI) brings direct privacy, legal, and trust risk. It can trigger mandatory notification requirements and HIPAA/HITECH exposure. Boards should have a clear view of detection, containment, and recovery times here too. They also need to know whether the same control gaps keep showing up.

The board’s focus should stay tight:

• Notification readiness
• Repeat-control failures

If the same weak spots keep causing trouble, that’s not bad luck. It’s a pattern the board should challenge.

Third-Party, Fourth-Party, and AI Risk

Cyber risk in healthcare rarely stops at the edge of the organization. It moves through vendors, cloud platforms, and the suppliers behind those vendors.

Boards should confirm that management keeps a current inventory of critical vendors and that Business Associate Agreements (BAAs) are current and enforced. They should also ask a layer deeper: where do those vendors depend on their own suppliers, and where do AI tools use or expose regulated data?

When vendor risk isn’t controlled, the fallout can be immediate. Loss of access to records, labs, or imaging ^[1] can disrupt care just as surely as an internal outage.

The board’s focus here is vendor inventory and contract control.

Boards should compare these risks by business impact, not technical detail:

A Board Oversight Model for Cyber Governance

Cyber risk needs a clear line between oversight and execution. Boards set direction. Management carries it out. That split sounds simple, but it matters a lot when the stakes include patient care, daily operations, insurance coverage, and legal exposure.

Here’s what that division looks like in practice:

Set Risk Appetite, Materiality Thresholds, and Reporting Expectations

Before a board can expect answers from management, it has to define what acceptable risk means for the organization. That starts with three choices:

• How much cyber risk the organization is willing to carry
• What kind of incident is serious enough to go to the board
• What management needs to report on a regular schedule

These decisions aren't just policy language on paper. They tie straight to patient safety, operational continuity, cyber insurance coverage, and regulatory exposure.

A ransomware event that limits clinical capacity for a long stretch is not the same as one that gets contained fast. The board’s materiality threshold should reflect that gap. The same goes for PHI breaches and vendor incidents. If the size of the exposure or the level of disruption could affect care delivery, financial stability, or compliance duties, the board should expect escalation. Those thresholds should shape what reaches the board and when it gets there.

Put Cyber on the Board and Committee Agenda

Cyber risk should not show up on the agenda once a year and then disappear. A sound governance model uses a standing committee focused on cybersecurity. That gives the board a way to keep accountability in place without expecting every director to speak fluent security jargon.

That committee should have enough time to review staffing, policies, funding, and program performance. The full board still keeps fiduciary oversight, but the committee can do the deeper review work.

"A standing committee for cybersecurity enables its members to facilitate deeper discussions and develop a level of understanding and expertise of a complex topic, which enables the full board to leverage the committee's recommendations and decisions." - Ed Gaudet, CEO and Founder of Censinet ^[1]

Use a Decision Framework for Cyber Risk Tradeoffs

When management brings a cyber issue to the board, directors need a steady way to weigh the options. Otherwise, every discussion turns into a one-off debate.

A useful approach is to come back to the same set of questions each time: What do we need to protect to achieve our goals? Where are the gaps in coverage, people, and skills? How fast can we detect and recover from an incident? Do we have enough cyber and D&O coverage? How do we compare with peer organizations?

Those questions should feed the dashboard and reporting model that follow.

Tools Directors Can Use to Strengthen Accountability

Once the board sets risk appetite and reporting rules, it needs tools that turn oversight into action.

Build a Board Cyber Risk Dashboard That Shows Business Impact

A board dashboard only matters if it connects cyber data to business harm: downtime, patient care disruption, financial loss, and compliance exposure.

That means the dashboard shouldn't just show security activity. It should show what happens to the business if nothing changes. Tie each metric to a clear outcome, such as downtime, a PHI breach, or vendor failure.

A useful board dashboard should track:

• Recovery readiness
• Critical vendor assessment coverage
• Open remediation items
• Digital asset inventory
• Insurance adequacy
• Peer benchmarking

Use the dashboard to estimate downtime cost, recovery cost, and insurance gaps before an incident happens.

Ask Governance Questions That Management Must Answer Clearly

Use the dashboard to force these management answers.

Good governance questions cut through technical noise and push management to speak plainly. Directors don't need to know firewall configurations. They do need to know whether the organization can keep operating if a core system goes down for 24 hours.

Management should be able to answer these questions in plain language. If the answer needs a glossary, that's a governance problem the board should deal with head-on.

Align Oversight With U.S. Healthcare Frameworks and Operating Tools

U.S. healthcare frameworks give directors a common baseline for asking whether management is closing the right gaps. HHS 405(d) and the Health Industry Cybersecurity Practices (HICP) offer healthcare-specific guidance on the controls that matter most for healthcare organizations. The HIPAA Security Rule sets baseline expectations for protecting electronic protected health information. NIST Cybersecurity Framework practices - identify, protect, detect, respond, recover - give boards a structure that works well in board-level reporting.

Boards do not need to audit the frameworks. They need to know whether management uses them to rank gaps and test recovery.

For third-party and AI-driven systems, boards should use operating tools that support:

• Centralized risk visibility
• Faster vendor assessments
• Human review and approval

That gives directors a clearer view of where exposure sits and whether management is acting on it.

Conclusion: What Effective Board Cyber Governance Looks Like

Effective cyber governance is board governance. It’s a disciplined oversight model, not a box-ticking exercise.

Boards should treat cybersecurity with the same rhythm and weight they give to audit and compensation. That means setting a clear risk appetite, defining materiality thresholds, using dashboards that show what matters, and agreeing on escalation rules. Annual reassurance isn’t enough.

The financial damage can be massive. The University of Vermont Medical Center lost more than $60 million after ransomware, and Scripps Health lost more than $100 million ^[1]. Those aren’t IT losses. They’re board-level losses. And boards that set clear expectations for reporting are far more likely to see trouble early and push management on weak spots before the damage spreads.

Strong boards tend to focus on a few plain things:

• They require management to speak in business terms, not jargon.
• They test recovery readiness on a regular basis.
• They compare performance against peer healthcare organizations.

The board does not need deep technical detail. Its role is simpler, and harder: decide whether recovery plans protect patient care, keep core operations running, and hold up under stress. The question isn’t whether a setting is configured the right way. The question is whether the organization can take a hit and still deliver care.

In healthcare, cyber governance is patient-safety governance.

FAQs

What should boards see in a cyber dashboard?

Boards need to see cyber risk as a business issue, not a pile of technical stats. A good dashboard turns exposure into plain English and shows what it could mean in financial, operational, and clinical terms.

Track measures like expected loss, outage and recovery time, canceled procedures, patient diversions, claims backlogs, vendor risk, PHI breach exposure, and the time it takes to detect, contain, and recover from an incident. Don’t just show a single number. Show ranges, trends over time, and how each measure lines up with the organization’s risk appetite.

When should a cyber incident be escalated to the board?

Boards need a clear escalation matrix with set triggers tied to incident severity.

Small compliance issues can stay with the department handling them. But major events, like PHI breaches or large ransomware attacks, should move to the C-suite and board right away.

Incident response playbooks should keep communication consistent, so the board gets timely, actionable updates on:

• financial exposure
• operational disruption
• clinical impact

How can boards oversee vendor and AI risk?

Boards should treat vendor and AI risk as enterprise governance issues, not just IT or compliance tasks. Why? Because the fallout can hit where it hurts most: financial loss, operational downtime, and patient safety.

For vendors, focus first on your most critical providers. Ask for quarterly risk reporting and make sure contracts spell out clear security terms. That way, oversight isn’t vague or left to chance.

For AI, put formal governance in place and define the organization’s risk appetite up front. Boards should review quarterly reports and back annual board education so members can keep up with how AI use is changing.

Dashboards and automation can help give leaders a clearer view across both areas. But they shouldn’t run the show on their own. For harder calls, especially ones with legal, operational, or care impact, human oversight still matters.

Related Blog Posts

• From Undervalued to Indispensable: How to Elevate ERM in Board-Level Discussions
• Benchmarking Study Finds Cyber Risk Governance Emerging as Board-Level Priority
• The boardroom has a new command center: cyber risk.
• Why Board-Level Oversight Is Now Central to Healthcare AI Governance