The Healthcare Cybersecurity Forum at this year’s HIMSS25 in Las Vegas will bring together industry leaders to address rising cyber threats and the need for stronger protections in healthcare.

Experts will share real-world insights from recent attacks and highlight strategies to strengthen cybersecurity defenses.

In collaboration with the Health Sector Coordinating Council, discussions will focus on the Health Industry Cybersecurity Strategic Plan 2024-2029, emphasizing shared responsibility and best practices to enhance resilience across the sector.

The day kicks off with a session led by Chris Tyberg, chair of the HSCC Cyber Working Group, discussing the Health Industry Cybersecurity Strategic Plan.

The session will outline a roadmap to move healthcare cybersecurity from a state of critical risk to greater stability by 2029.

Tyberg will highlight key strategies for addressing emerging cyber threats, leveraging advanced technologies, and fostering international collaboration.

Other topics will include the strengthening IT infrastructure, safeguarding patient data, and ensuring operational resilience in an increasingly complex threat landscape.

Later in the morning, Josh Howell, healthcare CTO at Rubrik, will discuss the critical role of cyber resilience in safeguarding patient data and ensuring uninterrupted care.

While prevention and security remain essential, they are no longer enough to protect healthcare organizations from growing cyber threats.

This session will explore key principles of cyber resilience, focusing on strategies for rapid recovery after an attack, with Howell highlighting the financial, legal, and reputational risks of cyber incidents.

Erik Decker, vice president and CISO at Intermountain Health and Shawn Anderson, the organization’s cybersecurity director will discuss proactive defense strategies against healthcare cyber threats, breaking down common infiltration tactics used by cybercriminals and identifying vulnerabilities from initial access to pre-attack stages.

The speakers will also explore the Bell-LaPadula security model and other established cybersecurity principles to fortify critical IT systems like Active Directory with secure-by-design and secure-by-default approaches.

Another roundtable discussion will focus on protecting data integrity and privacy standards for secure, interoperable health data.

Moderated by Dr. Hannah K. Galvin, CMIO at Cambridge Health Alliance, the panel features Erika Riethmiller, vice president and chief privacy officer at UCHealth, Keith Busby, acting CISO at CMS and Alex Enriquez, cyber security solution lead at Avanade.

The discussion will focus on unified privacy standards to safeguard patient data integrity while ensuring secure health data exchange, with the panel exploring TEFCA’s role in advancing interoperability and fostering a consent-driven, patient-centered data-sharing ecosystem. P

Panelists will also outline strategies to balance data privacy with seamless data exchange, enabling collaboration across healthcare organizations and improving patient care outcomes.

Johnson & Johnson’s vice president of MedTech security, Ashley Mancuso, will host a fireside chat on securing medical devices and addressing cybersecurity challenges in healthcare. The discussion will cover strategies for mitigating risks, ensuring compliance, and strengthening resilience in medical device security.

The final session of the day is a discussion between Erik Decker, vice president and CISO at Intermountain Health, and Nate Couture, network AVP information security and CISO at the University of Vermont Health Network, on managing major ransomware attacks.

They will cover operational challenges, including shifts to paper-based workflows, critical decision points in system restoration, and collaboration with law enforcement, and offer insights into effective recovery strategies, strengthening resilience, and applying lessons learned to future cybersecurity threats.