Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Greg Hoffer, CEO, Coviant Software
A recent article in Becker’s Hospital Review pointed to an increase in hospital mergers and acquisitions in the third quarter of 2025. The article cited Anu Singh, managing director at healthcare advisory firm Kaufman Hall who said that the increased M&A activity was spurred by passage of the One Big Beautiful Bill Act, which was signed into law on July 4. Singh said adoption of the law means “hospitals and health systems have more policy clarity to inform their growth strategies.”
According to Becker’s, the trend toward accelerated activity was illustrated by the announcement of 15 transactions during Q3, a near doubling compared to the eight announced during Q2. The article said the total value of the announced transactions in Q3, $8.6 billion, was six times higher than the previous quarter.
This trend may be seen as good news for communities served by smaller healthcare organizations. Those facilities are likely to benefit from the resources and economies of scale that come with being part of a larger network as they seek ways to continue their missions in the face of challenging economic conditions. Indeed, Kaufman Hall reported that acquisitions may be embraced by “distressed organizations” seeking “long-term sustainable partners/acquirers.”
Healthcare Data Breaches on the Horizon
But I predict that, in the rush to consummate the purchase of smaller hospitals and other healthcare facilities, we are likely to see an increase in the number and size of data breaches already plaguing the industry. Here’s why.
In November 2018, hotel and hospitality industry giant Marriott announced it had been compromised by cybercriminals who stole the personally identifiable information (PII) of a half-billion customers. An investigation revealed that the breach was the result of an integration of IT systems from the Starwood hotel chain following its purchase by Marriott. Cybercriminals had gotten inside Starwood undetected in 2014 but hadn’t begun any data exfiltration by the time of acquisition. Instead, they were in surveillance mode, gathering information they intended to use at a date and time of their choosing. Marriott purchased Starwood in 2016 and suddenly the hackers found they had access to a much larger trove of information.
Drawing on the lessons learned from that experience, I believe it is likely that, as large healthcare organizations, private equity firms, and others look to purchase “distressed” hospitals, there will be similar stories coming out of the healthcare industry in 2026. We know that healthcare organizations are already under constant threat of cyberattack. Indeed, a recent Ponemon Institute study found that 92% of healthcare organizations experienced a cyberattack in 2024. And those are just the attacks we are aware of. If the Starwood/Marriott breach taught us anything, it is that not all successful attacks are detected immediately.
Best Practices for Cyber Defense
To guard against introducing threats into an otherwise secure environment by overlooking the potential for a de facto Trojan horse in the form of an acquired organization’s compromised IT demands cyber due diligence prior to systems integration. In commentary on the Marriott incident appearing in Forbes, cybersecurity expert Itzik Kotler suggested four areas of investigation:
- Infiltration of assets like unsecured web servers and devices, user accounts with weak, default or no passwords, or systems vulnerable to unintentional malware downloads via phishing attack.
- Evidence of lateral movement such as suspicious/unexpected network traffic and activity associated with expired credentials that might originate with hackers silently monitoring traffic.
- Activity associated with unauthorized or suspicious data exfiltration to an outside device or recipient.
- Scenarios that could allow an employee to download and execute ransomware and infect a host or endpoint like servers, laptops or other equipment connected to the network.
Our Data Suggests HIPAA Violations, Too
Increased M&A activity also means introducing other risks to larger organizations, which is why I also predict an increase in violations of privacy and security regulations like the Health Insurance Portability and Accountability Act (HIPAA) during the coming year. That’s because hospitals are more likely to acquire legacy data handling processes that are out of sync with current standards.
Hospitals and healthcare organizations that are unable to keep pace with state-of-the-art tools for data management develop bad habits for essential tasks like file transfer (Coviant Software’s area of expertise). My company recently polled healthcare IT leaders and discovered that process automation is alarmingly low for an industry that shares data with large and complex digital supply chains. While 62% of respondents recognize the value of automation for their critical file transfer workflows, only 9% have fully automated and integrated their file transfer processes.
Because of an over-reliance on manual effort, 71% said they are unable to freely share files with partners. Furthermore, only 12% feel “very confident” that their file transfer tools meet HIPAA and other privacy and security mandates. Administrative staff that have grown used to emailing sensitive healthcare files, using non-secure file sharing services, or that have developed other shortcuts and workarounds that are slow and error prone will not easily break those habits. And that means mistakes leading to data breaches and non-compliance will be made.
I Hope I’m Wrong
Of course, I hope that I am wrong and that 2026 turns out to be the year that healthcare and other industries turn the corner to get one step ahead of their digital adversaries. But that will only happen through a thoughtful investment in tools and training that close security gaps, increase vigilance across the entire employee roster, and focus on developing strong processes and effective training that increases security and compliance vigilance. Happy holidays, and all our best for the year to come.
##
ABOUT THE AUTHOR
Gregory Hoffer is CEO of Coviant Software, makers of the award-winning and secure-by-design Diplomat MFT managed file transfer solution.
