As data volume surges, so do threats: from cyberattacks and insider misuse to ill defined sharing practices. As of 2024 and 2025, the new statistics on breaches, legal provisions, and technological strategies hardened the approach toward patient information protection on the one side and preserving improvement on the other.
The Growing Scope of Digital Health and Data Collection
The digital health market is booming: in the U.S. alone, it’s valued between USD 54 billion and USD 95 billion in 2025. More ways to generate various types of data not only involve PHI data at the most fundamental level such as in telehealth visits but also include continuous sensor data through wearables and genomic information. This expansion means that healthcare entities manage millions of records daily, making robust data governance essential.
Alarming Trends in Breaches and Exposed Records
Recent breach statistics reveal the urgency of the privacy challenge. In 2024, over 276 million individuals had their protected health information exposed, averaging nearly 758,300 records per day. Since 2009 and through the year 2024, there were 6,759 breaches of healthcare data that have breached 500 or more records reported to Office for Civil Rights (OCR).
At the same time, the number of reported large breaches (affecting 500+ individuals) rose from 663 in 2020 to 734 in 2024, with total exposed records ballooning from under 50 million to over 250 million.
Compared to 2018, hacking-related breaches increased by 239 percent by 2023, and ransomware by 278. Meanwhile, internal actors now account for roughly 70% of breach incidents in 2024, a sharp rise from 39% in 2022. These trends underscore that both external threats and insider risks must be addressed.
Regulatory Developments: Federal, State, and International
In the United States, HIPAA remains the cornerstone of health data regulation but is undergoing significant updates. In 2025, the Office for Civil Rights proposed modernizing the HIPAA Security Rule following a 264% increase in ransomware attacks in 2024. Proposed mandates include multi factor authentication, mandatory encryption, enhanced risk analysis procedures, and social engineering training.
Meanwhile, the FTC’s Health Breach Notification Rule continues to apply to health apps not covered by HIPAA, filling gaps for many direct‑to‑consumer digital health products.
At the state level, new legislation has emerged. New York’s NYHIPA extends privacy protections beyond HIPAA, similar to Washington State’s My Health My Data Act which took effect in March 2024. Maryland, Nevada, Connecticut, and Washington DC are also advancing consumer health data privacy laws, while Michigan has introduced protections specifically targeting reproductive health data.
On the international front, the European Union’s European Health Data Space (EHDS) regulation (Regulation EU 2025/327) formally entered into force on March 26, 2025. It establishes cross border healthcare data access rights, requires member states to create national Health Data Access Bodies, and enables interoperable access for both primary clinical use and secondary research use, all with built in privacy governance structures.
Balancing Data Sharing and Patient Rights
Regulations increasingly emphasize patient rights, data minimization, and transparent governance. Under EHDS, Europeans can download their electronic health record data free of charge, restrict access to professionals, request corrections, see who has accessed their data, and opt in or out of specific uses.
In the U.S., recent final rules strengthen patients’ right to access health records and clarify exceptions under the Information Blocking Rule. These rights driven frameworks are essential to preserving trust.
Best Practices for Digital Health Platforms
Leading platforms are adopting a layered privacy strategy: first, by applying privacy by design, only collecting minimal data required for functionality; second, encrypting data at rest and in transit; third, implementing role‑based and risk‑based access controls, MFA, and zero‑trust identity verification as mandated by New York’s cybersecurity rules and proposed HIPAA updates.
They regularly do security risk evaluation, educate employees on social engineering and privacy policy, and establish breach response procedures that involve the timely reporting as well. Clear and binding data sharing agreements, especially for digital therapeutics, are essential to define permitted use, minimize misuse, and comply with regulatory requirements.
Recent Case: Breach at Healthcare Clinic
In late May 2025, a ransomware attack on a Texas gastrointestinal clinic exposed 41,521 patient records, including Social Security numbers and medical details. The FBI and CISA attributed the attack to dark web group InterLock, prompting federal investigations and offering victims credit monitoring services. This violation is an example of the fact that even small size clinics are under threat and require an ultimate level of protection.
Conclusion
The dual necessities of privacy and innovation continue to gain urgency, as digital health platforms process more personal and clinical data than ever before. Information leakage trends demonstrate the need to have strong security.
But 2024 and 2025 regulatory responses provide indicators of a more mature legislative sphere that can empower patients and allow responsible uses of data. New privacy preserving technologies present viable avenues through which platforms can find ethical ways of innovating.