How Does Infrastructure Modernization Impact Healthcare Security?

This fragmentation can lead to blind spots, and in healthcare, where protected health information (PHI) is a prime target, that’s a dangerous gap to leave unguarded.

As systems expand into the cloud, the attack surface grows, making consistent, centralized security policy enforcement essential.

“Sensitive patient data like PHI is a prime target for threats such as ransomware, phishing attacks and insider breaches,” says Gagan Gulati, senior vice president and general manager of data services at NetApp. “These risks not only jeopardize data but can lead to severe financial repercussions and damage to patient trust.”

As organizations deploy hybrid and multicloud infrastructure, they encounter another layer of complexity: inconsistent security tools, multiple administrative consoles and varied access models.

Connors notes that public cloud providers offer native security tools, but they often lack the healthcare-specific visibility or integration required for enterprisewide oversight. In multicloud configurations, these disparities multiply.

“Security challenges in healthcare vary significantly across public cloud, hybrid cloud and multicloud environments,” Connors explains. “Cloud providers’ native security tools often don’t offer the necessary visibility or control.”

To address this, IT teams are turning to unified security platforms that span infrastructure types and provide a consistent policy layer.

EXPLORE: How are health systems managing security in the cloud?

Oversight Across Healthcare Infrastructure Environments

Connors emphasizes the importance of centralized oversight, particularly when healthcare organizations are managing sensitive workloads across multiple environments.

“Leveraging platforms that unify security policies and provide centralized management — a ‘single pane of glass’ — is critical,” he says.

For Gulati, visibility and governance are just as important as encryption.

“Hybrid and multicloud environments add another layer of complexity with multiple control levels and the challenge of managing data sprawl,” he says.

A key concern with modernization is not only internal misconfiguration but the increased exposure to third-party risk.

Open-source libraries and external vendors become part of the attack surface. Without adequate controls, a weak link in the supply chain can expose critical systems.

“Modernizing workloads often involves using third-party or open-source libraries, which may come with their own vulnerabilities,” Connors says. “Organizations must secure their applications as well as the surrounding environment.”

Gulati recommends beginning any infrastructure modernization effort with a comprehensive security assessment, explaining that alignment with standards such as HIPAA and encrypting data in transit and at rest are baseline practices.

“It’s critical to choose a HIPAA-compliant cloud provider and encrypt data using the latest industry-standard protocols,” he says.

NIST, HITRUST and Zero Trust

While security frameworks provide the blueprint, implementation still varies widely, with the National Institute of Standards and Technology’s Cybersecurity Framework and the Health Information Trust Alliance’s framework serving as foundations for healthcare-specific compliance.

Connors also points to zero trust as an essential model for reducing exposure.

“Zero trust operates on the principle of assuming the network is already compromised,” he says. “This ensures that every user, device and system can access only what it needs and do so securely.”

This identity-centric model replaces traditional perimeter-based defenses, which are increasingly ineffective in distributed environments. Rather than relying on IP addresses or static firewall rules, zero trust continuously evaluates the legitimacy of access requests and behavior.

“Traditional methods relied heavily on IPs, ports and firewall rules,” Connors says. “Modern security focuses on concepts such as identity and least privileged access.”

Meanwhile, continuous monitoring, real-time alerts and automation have become essential to a modern security posture.

“Continuous monitoring delivers real-time visibility and swift threat detection to protect sensitive data,” Gulati says. “Organizations must continuously monitor for changes in a user’s risk profile to detect and respond to threats quickly.”

DISCOVER: A successful cloud migration begins with an IT infrastructure assessment.

An Identity-Centric Approach

Ultimately, the move to cloud-based and hybrid infrastructure cannot be decoupled from security strategy. Healthcare providers can’t treat modernization and security as parallel tracks; they must be designed together from the start.

“Successful modernization is about selecting trusted, proven vendors who offer comprehensive data security across hybrid and multicloud environments,” Gulati says. “Tackling vulnerabilities requires standardized practices, not disparate, bolted-on solutions.”

Ending with disconnected tools and reactive monitoring only recreates the same fragmented risk that legacy systems were meant to eliminate.

A forward-looking security model — based on zero trust principles, real-time monitoring and unified governance — must become the standard for healthcare infrastructure modernization.

“Modernization is not just about adopting new software; it’s about adopting a new approach to security,” Connors says. “An identity-centric approach helps prevent new vulnerabilities from emerging while addressing issues inherent to legacy infrastructure.”