Healthcare IT Leaders Overestimate Email Security as Breaches…

Event summary

100% of surveyed U.S. healthcare IT leaders rated their real-time breach detection as 'Excellent' or 'Good', yet 58% reported email breaches in the past two years.
Encryption emerged as the weakest dimension in Paubox's Healthcare Email Security Maturity Index 2026, with 47% of breached organizations prioritizing stronger encryption policies post-breach.
48% of healthcare organizations require recipients to log into portals for encrypted emails, but over a third of clinical staff bypass this workflow.
Healthcare data breaches cost an average of $7.42 million per incident, with phishing being the leading initial access vector.

The big picture

The disconnect between perceived and actual email security capabilities highlights a broader industry challenge in balancing robust cybersecurity measures with operational efficiency. As healthcare data breaches continue to incur the highest costs across industries, the focus on encryption and phishing mitigation will intensify, driven by both regulatory pressures and the need to protect sensitive patient information.

What we're watching

Encryption Effectiveness: Whether healthcare organizations can balance stringent encryption policies with user experience to reduce breaches.
Regulatory Compliance: How evolving HIPAA regulations will impact email security standards and enforcement in the healthcare sector.
Phishing Mitigation: The pace at which healthcare IT leaders adopt advanced phishing simulation training to address persistent breaches.