10/23/2026
Protected Health Information doesn't expire the way financial data does. A patient's medical history, diagnoses, and treatment records are permanent, which is precisely what makes PHI valuable to criminals and to the ransomware operators who hold it hostage.
Healthcare employees at every level handle PHI. Front desk staff process patient registration. Clinical staff access EHRs. Billing staff handle insurance data. Administrators manage vendor relationships that touch patient information. Every one of those roles is a potential target, not because the individual is high-profile, but because the data they access is.
Cybersecurity Awareness Month is the right time to make that explicit across the organization: the training, the phishing simulations, and the security culture conversations should reach clinical and administrative staff equally, because attackers don't distinguish between them.