What Healthcare Boards Should Expect from Security Leadership

Healthcare boards operate under a unique set of pressures. They carry fiduciary responsibility for patient safety, direct liability for data breaches, and regulatory exposure that can run into millions in fines. Yet in my experience working with dozens of healthcare organizations, most boards receive security reporting that ranges from overly technical to dangerously superficial. Directors ask good questions but often lack the frame of reference to know whether they're getting good answers. And the gap between what boards think they're overseeing and what's actually happening in their organization's security program can be wide enough to drive a breach notification through.

This disconnect isn't usually malicious. It's structural. Healthcare organizations that don't have senior security leadership in place — or that rely on well-meaning IT directors to fill that role — tend to produce board reporting that focuses on activities rather than outcomes, on compliance checkboxes rather than risk posture, and on technical minutiae rather than the strategic questions that actually matter at the governance level.

The result is a board that thinks it's exercising oversight but is actually flying blind. And when the OCR comes calling after a breach, or when a cyber incident forces patient care diversion, that gap becomes painfully visible.

The Reporting Pattern I See Too Often

Here's what inadequate security reporting to healthcare boards typically looks like: a quarterly slide deck that covers firewall updates, antivirus deployment percentages, the number of phishing emails blocked, and confirmation that the annual HIPAA training was completed. The presentation ends with "no significant incidents to report" and the board moves on to the next agenda item feeling like they've done their job.

The problem is that none of those metrics tell you what actually matters: whether your organization can detect a breach in progress, whether your business associate agreements create liability you don't understand, whether your clinicians are using shadow IT that bypasses every control you think you have in place, or whether the compliance attestations you're relying on would hold up under OCR scrutiny.

I've sat in board meetings where directors were told their HIPAA compliance program was "mature" and "fully documented," only to discover during an actual risk assessment that the organization hadn't conducted a meaningful risk analysis in three years, had no encryption on portable devices, and was storing patient data in cloud applications that had never been evaluated for HIPAA compliance. The reporting wasn't dishonest; it was just built by people who didn't know what questions mattered.

The IT Director Problem

Many healthcare organizations assign HIPAA and security oversight to their IT director. This is understandable — IT touches the systems, understands the technology, and is already on the payroll. But IT leadership and healthcare security leadership are different disciplines, and conflating them creates blind spots that boards don't see until it's too late.

An IT director is optimizing for uptime, performance, and user experience. A CISO is optimizing for risk, control effectiveness, and regulatory defensibility. Those objectives overlap, but they're not the same. And when the same person is responsible for both, the operational demands of keeping the EHR running and tickets closed tend to crowd out the strategic, policy-driven work that keeps an organization out of trouble.

I'm not criticizing IT directors — many are excellent at what they do. But asking them to also serve as the organization's senior security leader is like asking your CFO to also run HR. The skillsets and accountabilities are different, and governance suffers when you pretend they're not.

What Healthcare Boards Actually Need to Know

Board-level security reporting in healthcare should answer a short list of high-stakes questions. These aren't technical questions. They're governance questions that require someone with security judgment and regulatory experience to frame correctly.

Are we compliant with HIPAA, and can we prove it?

This isn't a yes-or-no question. HIPAA compliance is a continuous state, not a one-time achievement. What boards need to know is whether the organization has conducted a recent, thorough risk analysis, whether identified risks have been mitigated or accepted with documentation, whether policies reflect actual practice, and whether the compliance program would survive an OCR audit.

The right answer sounds like: "We completed a comprehensive risk assessment in Q2, identified 14 gaps, remediated 11, and documented risk acceptance for the remaining three with compensating controls. Our next assessment is scheduled for Q4. We're tracking remediation in our GRC platform and I can show you the current status at any time."

The wrong answer sounds like: "Yes, we're compliant. We do annual training and our IT team follows best practices."

What is our breach risk, and where does it come from?

This is the question that separates superficial reporting from genuine security leadership. Breach risk in healthcare comes from specific, observable patterns: unencrypted devices, third-party vendors with access to PHI, misconfigured cloud storage, inadequate access controls, weak authentication, poor incident response capability, and employees using unsanctioned tools to get work done.

A board should hear which of those risks are present in their environment, what's being done about them, and what the timeline and cost look like. They should also hear about the risks that can't be fully eliminated — because in healthcare, some risk is inherent — and how those residual risks are being managed and monitored.

What would happen if we had a breach tomorrow?

Most healthcare boards have never walked through a realistic breach scenario. They should. The exercise reveals gaps in incident response planning, communication protocols, legal readiness, and operational resilience that are invisible until you pressure-test them.

Does the organization know how to determine whether a breach is reportable under the HIPAA breach notification rule? Can it conduct a forensic investigation to determine the scope of compromised records? Does it have legal counsel with HIPAA breach experience on retainer? Can it notify affected individuals, OCR, and potentially the media within the required timelines? Can it maintain patient care operations during the response?

These aren't theoretical questions. Every healthcare organization will eventually face a security incident. Whether it becomes a regulatory disaster or a manageable event depends almost entirely on the quality of preparation, and preparation is the job of healthcare security leadership.

Are our business associates creating risk we don't understand?

Healthcare organizations are liable for the HIPAA failures of their business associates. That's not a theoretical risk — it's the basis for some of the largest HIPAA settlements on record. Yet I routinely see healthcare boards that have no visibility into how many business associates they have, whether those vendors have been properly vetted, whether business associate agreements are in place and current, or whether anyone is monitoring those vendors for security incidents.

The explosion of AI-powered clinical tools has made this problem worse. Clinicians are adopting AI scribes, diagnostic support tools, and patient engagement platforms that touch PHI, often without a formal evaluation process. Some vendors are prepared to operate as HIPAA business associates; others aren't. And many healthcare organizations don't have a defined process for evaluating these tools before they're deployed.

Boards need to know: do we have a business associate risk management process, who owns it, and does it actually work?

The Metrics That Matter (and the Ones That Don't)

Not all security metrics are created equal, and healthcare boards are often presented with dashboards full of numbers that don't actually measure what matters. Here's how to separate signal from noise.

Operational metrics vs. risk metrics

Operational metrics — patch deployment rates, antivirus coverage, ticket resolution times — are useful for managing an IT department. They're not useful for governing security risk. Boards don't need to know that 94% of endpoints have current antivirus; they need to know whether the organization can detect and respond to a ransomware attack before it encrypts the EHR.

Risk metrics, by contrast, answer governance questions: How many high-risk vulnerabilities are present in patient-facing systems? How long does it take us to detect unauthorized access to PHI? What percentage of our business associates have completed security assessments in the past 12 months? How many reportable breaches have we had, and what were the root causes?

A CISO knows the difference and reports accordingly. An IT director often doesn't, not because of incompetence but because the frame of reference is different.

Compliance status as a lagging indicator

Compliance metrics — training completion rates, policy review dates, audit findings — are important, but they're lagging indicators. They tell you what happened in the past, not what's likely to happen next. Boards need both: evidence that the compliance program is functioning, and forward-looking risk intelligence that informs strategic decisions.

For example: "We completed annual HIPAA training for 98% of employees" is a compliance metric. It's necessary but not sufficient. What matters more is whether employees can recognize a phishing email in the wild, whether they know how to report a suspected breach, and whether they're actually following policy when they take patient data offsite or share it with external providers. Testing those behaviors — through phishing simulations, spot audits, and access reviews — gives you a better picture of real-world risk.

Trend data and directional movement

Single-point-in-time metrics are less useful than trend data. Is your mean time to detect incidents improving or getting worse? Are the number of business associates under management increasing faster than your ability to vet them? Are access control violations trending up, suggesting policy drift or inadequate enforcement?

Boards should be asking: are we getting better or worse, and what are we doing about the gaps?

The Role of a vCISO in Healthcare Governance

For healthcare organizations that don't have a full-time CISO — and many don't, because the cost of a senior security executive with deep regulatory experience can exceed $250,000 annually — a virtual CISO engagement provides the strategic leadership and board reporting capability that IT alone can't deliver.

A vCISO brings three things that matter at the board level: experience, objectivity, and accountability.

Experience

Healthcare security leadership isn't something you can learn from a textbook. It requires pattern recognition built from years of assessments, audits, breach responses, and enforcement actions. A vCISO who has worked with dozens of healthcare organizations has seen the failure modes, knows what OCR looks for during investigations, understands how business associate relationships create liability, and can translate regulatory language into operational controls.

That experience shapes how risk is framed for the board. Instead of "we're compliant," the reporting becomes: "We've mitigated the risks that typically drive OCR enforcement, we have gaps in these three areas, and here's the plan to address them." That's the kind of clarity boards need to govern effectively.

Objectivity

A vCISO doesn't have the internal political pressures that an employee does. They're not trying to protect a departmental budget, justify past decisions, or avoid conflict with clinical leadership. Their job is to tell the board what's true, whether or not it's comfortable.

I've been in situations where the internal IT leadership assured the board that everything was fine, and a vCISO assessment revealed control failures that posed significant regulatory risk. That's not about competence; it's about incentives and perspective. An external advisor can deliver bad news without the organizational friction that an employee might face.

Accountability

When a board engages a vCISO, they're establishing a clear line of accountability for security and compliance outcomes. Someone is explicitly responsible for the risk analysis, the policy framework, the vendor management process, the incident response plan, and the board reporting. That person isn't also responsible for keeping the network up or managing the help desk. Their focus is governance, risk, and compliance, and they're accountable for delivering it.

This structural clarity matters. Boards can't exercise oversight when it's unclear who owns the security function. A vCISO makes that ownership explicit.

How Board Reporting Should Actually Work

Effective security reporting to a healthcare board isn't about overwhelming directors with technical detail. It's about creating a structured, repeatable cadence of risk communication that enables informed governance decisions.

Quarterly risk reporting

Boards should receive a written security and compliance report at least quarterly. The report should be short — no more than three to five pages — and it should follow a consistent structure so that directors can track progress over time.

The core elements should include: current compliance status (with evidence), new or elevated risks identified since the last report, progress on remediation of known gaps, summary of incidents or near-misses, updates on business associate risk, and any strategic decisions that require board input (budget for new controls, policy changes, major vendor relationships, etc.).

The tone should be clear and direct. If there's a problem, say so. If there's uncertainty, acknowledge it. Boards can't make good decisions based on sanitized reporting.

Annual deep-dive sessions

At least once a year, the board should have a longer session — 60 to 90 minutes — dedicated to a more substantive discussion of the organization's security and compliance posture. This is the time to walk through the full risk assessment, review the incident response plan, discuss emerging risks (like new regulatory requirements or changes in the threat landscape), and pressure-test assumptions.

This session should also include education. Healthcare security is a moving target, and board members who aren't in the space day-to-day benefit from context on what's changing and why it matters. For example: the rise of AI tools in clinical workflows, the implications of new state privacy laws, or the growing risk of ransomware targeting hospitals.

Real-time incident reporting

Boards shouldn't learn about significant security incidents at the next quarterly meeting. There should be a clear protocol for notifying board leadership — typically the board chair and the audit or compliance committee chair — within 24 to 48 hours of discovering a potential breach or serious incident.

This isn't about micromanagement. It's about ensuring that the board can fulfill its fiduciary duty and provide strategic direction during a crisis. Early board engagement can also help avoid missteps in breach notification, media communication, or regulatory reporting that can turn a manageable incident into a reputation-damaging event.

The Questions Directors Should Be Asking

If you're a healthcare board member or executive trying to assess whether your organization has the security leadership it needs, here are the questions that reveal the truth:

• When was our last comprehensive HIPAA risk assessment, and can I see the executive summary? If the answer is vague or it's been more than 18 months, you have a problem.
• Who owns our security and compliance program, and what percentage of their time is dedicated to that role? If it's an IT director who also has operational responsibilities, you likely have a gap in strategic oversight.
• What would we do if we discovered a breach tomorrow? If there's no clear, documented process, you're not prepared.
• How many business associates do we have, and how do we manage the risk they create? If no one can answer this with specifics, your third-party risk program isn't working.
• What are the top three security risks facing this organization, and what are we doing about them? If the answer is generic or focused on technology rather than business risk, you're not getting CISO-level thinking.
• If OCR opened an investigation tomorrow, would we be able to demonstrate compliance? If there's hesitation, you have documentation or control gaps that need attention.

These questions don't require technical expertise to ask. They require governance-level thinking. And the quality of the answers will tell you very quickly whether you have the right leadership in place.

Why This Matters Now More Than Ever

The risk landscape for healthcare organizations has changed significantly in the past few years, and boards that aren't adapting their oversight are falling behind.

Ransomware targeting hospitals has become routine. The attack on Change Healthcare in 2024 disrupted claims processing for thousands of providers and exposed the fragility of healthcare infrastructure. OCR enforcement has become more aggressive, with multimillion-dollar settlements for organizations that failed to conduct adequate risk assessments or allowed impermissible disclosures of PHI. State privacy laws are creating new compliance obligations that overlap with but aren't identical to HIPAA. And the rapid adoption of AI in clinical and administrative settings is introducing risks that most healthcare organizations haven't begun to evaluate systematically.

These aren't abstract future concerns. They're happening now, and they require healthcare security leadership that can anticipate risks, implement controls, and communicate clearly to boards about what's at stake. That leadership doesn't have to be a full-time employee, but it does have to be someone with the experience and accountability to do the job right.

Boards that continue to rely on IT directors to double as CISOs, or that accept superficial compliance reporting as evidence of a functioning security program, are accepting risks they don't fully understand. And in healthcare, where patient safety, regulatory liability, and reputation are all on the line, that's a governance failure with real consequences.

Building the Governance Structure You Need

If your healthcare organization doesn't currently have senior security leadership, the path forward doesn't have to be complicated. It starts with acknowledging the gap and making a deliberate decision about how to fill it.

For some organizations, hiring a full-time CISO makes sense. If you're a large health system with complex operations, significant IT infrastructure, and the budget to support an executive-level security leader, that's the right move. But for smaller hospitals, specialty practices, behavioral health organizations, and mid-sized healthcare companies, the math often doesn't work. You need the judgment and accountability of a CISO, but you don't need or can't afford a $250,000 salary plus benefits.

That's where a vCISO engagement becomes the pragmatic answer. You get experienced healthcare security leadership, board-ready reporting, regulatory compliance oversight, and strategic risk management — on a fractional basis that fits your organization's size and budget. The vCISO becomes an extension of your leadership team, attending board meetings, working with your IT staff, managing audits and assessments, and providing the governance layer that IT alone can't deliver.

I've worked with healthcare organizations ranging from single-location practices to multi-state behavioral health companies, and the pattern is consistent: when boards get clear, strategic security reporting from someone who knows what regulatory compliance actually looks like in practice, governance improves, risk visibility improves, and the organization stops scrambling every time an audit or incident occurs.

The decision to bring in a vCISO isn't about admitting failure. It's about recognizing that healthcare security leadership is a specialized discipline, that boards have a fiduciary obligation to exercise meaningful oversight, and that the cost of getting it wrong — in regulatory fines, breach notification expenses, reputation damage, and patient trust — far exceeds the cost of getting it right.

If you're reading this as a board member or healthcare executive, the question you should be asking isn't whether you can afford a vCISO. It's whether you can afford not to have one. Because the risks you don't see are the ones most likely to hurt you, and the oversight you think you're getting may not be what you actually need.

The healthcare boards that do this well have made security and compliance a standing agenda item, have established clear accountability for the function, and have ensured that the person reporting to them has the experience to know what matters and the independence to say what's true. That's the standard your organization should be holding itself to. Anything less is governance theater, and in healthcare, that's a risk you can't afford to take.