460 Ransomware Attacks, 17 Days of Downtime: What Florida's Hospital Cybersecurity Crisis Means for Your Practice

Your practice doesn't have to be the one that gets breached to feel the damage. If the hospital you refer patients to, the lab that runs your bloodwork, or the imaging center down the street gets hit with ransomware, your patients — and your schedule — feel it within hours.

That's the uncomfortable point Florida Hospital Association President and CEO Mary Mayhew made this week in South Florida Hospital News, and the numbers behind it are worth every practice owner's attention, not just hospital administrators'.

What actually happened

Citing the 2025 Ponemon Healthcare Cybersecurity Report, Mayhew's piece lays out a grim national picture: more than 460 ransomware attacks hit healthcare organizations in 2025 alone, more than any other critical infrastructure sector tracked, including energy and finance. The average attack knocked systems offline for 17 days. Over six years, the cumulative cost to the industry has reached $21.9 billion.

The part that should stop practice owners, specifically: nearly 90% of healthcare organizations surveyed said a cyberattack on a supply chain partner — not their own systems — disrupted patient care. Forty-nine percent reported increased complications during medical procedures as a direct result of an attack somewhere in their ecosystem. Fifty-one percent had to delay procedures or tests.

Two incidents anchor the pattern. The 2024 Change Healthcare attack, per an American Hospital Association survey of roughly 1,000 hospitals, caused direct patient care impacts at 74% of them — delayed prior authorizations, blocked prescription fills, stalled billing. And this year's widely covered Stryker cyberattack disrupted device supply chains badly enough that hospitals nationally couldn't get surgical instruments ordered and delivered on schedule.

Florida hospitals are responding by leaning on the Florida Hospital Association, USF's Center for Cybersecurity, and a newly formed Chief Information/Security Officers Council to coordinate defenses. That's the right move for large systems. It doesn't do much for a five-provider practice that has no seat at that table but is downstream of every vendor those systems share.

Why this matters more than it looks like it should

Most of the cybersecurity conversation aimed at small practices — including a lot of what we've written here — focuses on what happens if your systems get breached: stolen records, ransom demands, OCR investigations. That's real and it's not going away. But the Ponemon data points at a second, quieter risk that's easy to miss because it never shows up as your breach notification letter: operational disruption that originates entirely outside your walls.

A hospital, lab, imaging center, or EHR vendor you depend on goes down for 17 days on average. During that window, referrals stall, results don't come back, prior authorizations sit in a queue, and patients call your front desk asking why nothing is moving — even though nothing happened to you. Your practice absorbs the disruption without having caused it and often without any warning it was coming.

What this means if you're a South Florida practice

Palm Beach, Broward, and Miami-Dade practices already sit inside a dense referral and vendor network — regional hospital systems, national lab chains, shared EHR and billing platforms — which is exactly the kind of interconnected ecosystem the Ponemon data describes. The same exposure applies as UpsiteGroup extends its HIPAA-focused IT support reach into Martin and St. Lucie counties: practices in Stuart and Port St. Lucie refer into and share vendors with the same regional hospital systems and national labs serving the rest of South Florida, so a disruption three counties away can still land on your schedule.

The fix isn't securing systems you don't control. It's building enough operational slack that a partner's 17-day bad month doesn't become your 17-day bad month too.

Practical takeaways

• Build a "system's down" plan that doesn't assume it's your system — cover what happens if a referral hospital, lab, or EHR vendor is unreachable for days, not hours.

• Ask your top three referral partners and labs directly whether they've had a business continuity or incident response plan tested in the last 12 months — a vague answer is itself useful information.

• Keep a documented, offline fallback for critical patient information (allergies, active medications, current care plans) that doesn't depend on any single vendor's uptime.

• Diversify where possible: know a backup lab, backup imaging partner, and backup path for urgent referrals before you need one.

• Treat a major regional healthcare cyberattack the way you'd treat an approaching hurricane — as a trigger to check your own continuity plan, even when the storm isn't hitting your building directly.

Not sure where your practice stands?

Most practices have never mapped which of their referral relationships and vendors represent single points of failure. That's a conversation worth having before a regional incident forces it. If you want a second set of eyes on your practice's exposure to a disruption you didn't cause, we're glad to help you think it through.