Cybersecurity concerns run high

YARMOUTH, Maine – Recent cybersecurity incidents at AdaptHealth and McKesson have put data security back in the home medical equipment (HME) spotlight. According to a recent HME Newspoll, 82% of respondents said they are either very concerned or somewhat concerned about cybersecurity threats facing their organizations.

AdaptHealth disclosed in July that it was investigating a security incident in which a threat actor gained unauthorized access to company systems and exfiltrated certain data. The affected data included passwords associated with insurance billing and certain personally identifiable information and protected health information (PHI) of patients.

During a conference call in August to discuss financial results for the second quarter, CEO Suzanne Foster said the company had resolved the matter.

“There is no additional risk,” she said. “It’s kind of old news for us right now, meaning we’ve gotten through it and closed that chapter.”

The concerns reflected in the poll come amid a continued rise in reported data breaches nationwide. There were 1,803 reported data compromises in the first half of 2026, compared to 1,732 during the same period in 2025, according to the Identity Theft Resource Center.

Only 13% of respondents said their organizations have experienced cybersecurity incidents such as phishing, ransomware, data breaches or compromised emails. Another 20% said they were unsure whether their organizations had experienced a cybersecurity incident, while 67% said they had not.

Providers strengthening cybersecurity defenses

Reflecting growing awareness of cybersecurity risks, 75% of respondents said their organizations have implemented new safeguards during the past 12 months, including employee training and multi-factor authentication. Nineteen percent said they are evaluating additional options, while 6% said they are not implementing new safeguards.

One respondent noted that their organization is HITRUST certified, which they described as the gold standard for HIPAA security.

“This means we have hundreds of controls in place to protect PHI both in our technology infrastructure and physically in our offices,” they wrote.

AI introduces new security considerations

The respondent also said advances in artificial intelligence (AI) require additional layers of protection.

“Most recently, we have been focused on our enterprise AI rollout strategy – both blocking shadow AI and enforcing the use of company-approved, HIPAA-security AI systems,” they wrote.

Providers take layered approach to cybersecurity

Another respondent noted that their organization has implemented a comprehensive Written Information Security Plan (WISP) to protect sensitive information through administrative, technical and physical safeguards.

Current and planned measures include multi-factor authentication, encryption, access controls, audit logging, endpoint protection and VPN use.

“(We) also conduct ongoing risk assessments, compliance monitoring and corrective action planning to continuously improve cybersecurity readiness and protect patient information,” wrote Elise Pallotta Wilson, acting compliance officer for Freedom Mobility Center in Rodeo, Calif.

• Related: Read Jason Kirkhart's Smart Column series on cybersecurity.