Healthcare organizations keep treating security as a cost center, but the reasoning no longer supports that position. One breach can expose thousands of patient records and erase years of accumulated trust in an afternoon. Nick F. Hernandez, Chief Technology Officer at Zydoc, a clinical documentation company regulated under the Health Insurance Portability and Accountability Act (HIPAA), has watched that calculation shift over 27 years in technology, 14 of them at the same firm, moving from systems engineer to chief security officer to his current role. His argument is blunter than most vendor messaging on the subject: in regulated sectors, compliance and security are not functions that sit alongside the business. They are the surface the business is built on, and organizations that treat them as a box to tick are quietly accumulating risk they cannot see.
Compliance Is A Foundation, Not A Finish Line
The most common failure Hernandez describes is structural rather than technical. Organizations run compliance as a project. They staff it, scope it, pass the audit, and move the team onto something else. That model works for a software migration. It does not work for a regulatory regime that keeps changing underneath you. “Too many organizations treat it like a project. They pass the audit, move on,” he says. “But HIPAA keeps evolving, and in 2025 there were 770 reported breaches, the highest on record. Compliance has to be something you work at every day.”
That figure deserves more attention than it usually gets in board conversations. A record year for reported breaches is not a story about unlucky organizations. It is evidence that the gap between audit-passing and actual resilience has widened to the point where the certificate on the wall tells you relatively little about what happens when someone probes the environment on a Tuesday afternoon. The practical consequence for leadership is a change in cadence. Continuous work means controls get reviewed when systems change, not when the auditor schedules a visit, and it means someone owns the regulatory watch rather than discovering a requirement shifted 18 months after the fact. Organizations that build that rhythm can absorb regulatory change as routine maintenance. The ones running on an audit cycle just absorb it as a crisis.
Know Your Frameworks, Then Pick Your Level Of Rigor
Regulated industries breed a particular confusion between what is required and what is sufficient. Hernandez draws the line sharply. “HIPAA is the legal floor, but mandatory doesn’t mean enough,” he says. “HITRUST is widely seen as the gold standard, and hospitals, payers, and insurers increasingly expect it.” The distinction matters because, within the Health Information Trust Alliance (HITRUST) framework, the legal minimum was written to establish a baseline across an enormously varied sector, not to describe what a credible vendor handling clinical data should be doing in 2025.
The second half of his point reframes the whole investment. Certification at the higher tier is usually sold internally as risk mitigation, putting it in direct competition with every other defensive line item on the budget, and it loses most of those fights. Hernandez positions it differently. “Reaching that level isn’t just about managing risk; it’s opening doors.” When hospitals, payers, and insurers increasingly expect a specific standard before they will sign, that standard stops being an insurance policy and becomes a condition of market access. The question for the executive team is no longer whether the spend is justified by the risk reduction alone. It is whether the organization intends to sell to buyers who have already decided what they will and will not accept from a vendor. Procurement teams in healthcare have become effective gatekeepers, and the cheapest way to lose a deal is to discover their requirements during the diligence phase.
Security And Innovation Have To Move Together
The sharpest part of Hernandez’s position concerns how security relates to product development, particularly as healthcare companies push into AI. Zydoc turned its internal tooling into a commercial AI platform, and he is specific about the sequencing. “Security was built in from day one, not bolted on at the end.” That ordering is not a stylistic preference. Retrofitting controls onto a shipped product means working around architectural decisions made for other reasons, and the result is often weaker and more expensive than designing for the constraint from the start.
The threat environment makes the point urgent. “Healthcare now accounts for 22 percent of ransomware attacks worldwide, and vendors are increasingly the target,” Hernandez says. That second clause is the one vendors should sit with. Attackers have worked out that a supplier serving many healthcare clients is a more efficient target than any single client, which means every vendor in the chain is now carrying risk on behalf of customers who may not have priced it. His framing collapses the distinction entirely: healthcare security architecture is product architecture. There is no separate security layer to negotiate with later. Underneath all of it sits the human factor, which no architecture fully solves. Most breaches, Hernandez notes, come down to human error, a phishing email, or a misconfigured system. His response is cultural rather than technical. It starts with leadership setting the standard and investing in people so they feel able to speak up. That last phrase carries weight. An employee who clicked the wrong link and says nothing for six hours is a far more expensive problem than one who reports it in six minutes, and whether they speak up is determined by what leadership has signaled about blame long before the incident occurs.
Follow Nick F. Hernandez on LinkedIn for more insights on healthcare security architecture, regulatory compliance, and building secure AI platforms in regulated industries.
