Cutting Cybersecurity to Save Money Is Costing Healthcare Practices More

Imagine you run a 40-person medical practice, and the budget meeting lands on your desk with one line highlighted in red: security spend. Renewals are up. Reimbursements are flat. Someone across the table asks the question that feels reasonable in the moment, “We haven’t had an incident, so do we really need all of this?” That conversation is happening in practices across the country right now, and the data suggests a lot of them are answering it the wrong way.

According to The CyberSmart MSP Survey 2026, economic pressure is pushing cybersecurity down the priority list for many small and midsize businesses. The survey found that 46% of MSP customers have asked to reduce or delay security spending to cut costs. That is nearly half of the client base treating protection as the line item to trim when money is tight. For a general business, that is a gamble. For a healthcare practice holding protected health information under HIPAA, it is a gamble with a regulator, a patient population, and a business all on the same table.

What the survey actually found

CyberSmart’s 2026 survey of managed service providers points to a pattern that anyone in IT has watched play out before. When budgets tighten, security is one of the first places owners look to save, because it feels like insurance you are paying for a fire that never came. According to CyberSmart, MSPs are fielding requests to pause endpoint tools, stretch renewal cycles, drop backup tiers, and delay planned upgrades. The logic is understandable. The math is not.

The problem is that attackers are not tightening their budgets. Ransomware crews and access brokers have gotten more efficient, not less, and small healthcare organizations sit in a sweet spot they actively hunt for: enough valuable data to be worth encrypting, not enough staff to defend it around the clock. The U.S. Department of Health and Human Services Office for Civil Rights has repeatedly flagged that smaller healthcare entities are frequent targets precisely because their defenses are thinner. Cutting the budget does not make you a smaller target. It makes you an easier one.

Why this hits healthcare harder than most

A general business that gets breached loses data, time, and trust. A healthcare practice that gets breached loses all of that plus a regulatory obligation that does not care why the budget was cut.

HIPAA’s Security Rule requires covered entities to maintain reasonable and appropriate administrative, physical, and technical safeguards. “We were saving money” is not a defense the OCR recognizes. If a delayed patch or a dropped backup tier contributes to a breach of unsecured protected health information, the practice owns the notification requirements, the potential civil penalties, and the reputational damage in a community where word travels fast. HHS OCR breach settlements over the past several years have repeatedly cited failures in basic safeguards, the exact controls that get cut first when a budget is under pressure.

There is also the operational reality. When a clinic’s systems go down, patients do not get seen. Schedules collapse. Providers revert to paper, billing stalls, and the revenue you were trying to protect by cutting security disappears anyway, just through a different door. The average cost of downtime in a small practice dwarfs the annual savings from a deferred security renewal. You are not choosing between spending and saving. You are choosing between a known, budgeted cost and an unknown, uncapped one.

What smart practices are doing instead

The answer to budget pressure is not to spend more indiscriminately, and it is not to spend less blindly. It is to spend deliberately. The practices weathering this well are doing three things.

First, they are separating the controls that reduce the most risk per dollar from the ones that are nice to have. Multifactor authentication, tested backups, endpoint detection, and email filtering stop the overwhelming majority of attacks aimed at small healthcare organizations. Those are not the place to cut.

Second, they are asking their IT partner to show them where the money actually goes and what each control protects against. If your provider cannot map spend to risk in plain language, that is a conversation worth having before the next renewal.

Third, they are treating the annual security review as a chance to right-size, not just to cut. Consolidation, better licensing, and removing tools that overlap can free up real money without lowering the floor of protection. That is how you cut cost without cutting safety.

Common Questions

Is it ever safe to reduce cybersecurity spending? Yes, when the reduction comes from removing redundant tools, consolidating licenses, or renegotiating renewals, not from removing controls that stop attacks. The distinction is whether the cut lowers cost or lowers protection.

What are the core controls a healthcare practice should never cut? Multifactor authentication, tested and isolated backups, endpoint detection and response, email security, and timely patching. These stop the large majority of attacks that target small healthcare organizations.

Does HIPAA require a specific security budget? No. HIPAA requires reasonable and appropriate safeguards. There is no dollar figure, but there is an expectation that safeguards match the risk. A budget cut that removes required safeguards can become a compliance problem if a breach follows.

How do I know if my practice is over- or under-spending on security? A security review that maps each control to the risk it addresses will show you overlap, gaps, and waste. If your IT provider cannot produce that map, that is the first thing to fix.

centrexIT has been the IT team Healthcare organizations across the West have trusted since 2002. If budget pressure has your practice weighing what to cut, the smartest first move is knowing exactly where your gaps are before you touch a single line item. Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/

Sources

• 46% of MSP customers have asked to reduce or delay security spending to cut costs: CyberSmart, “The CyberSmart MSP Survey 2026” (2026), https://cybersmart.co.uk/
• Smaller healthcare entities are frequent ransomware targets due to thinner defenses: HHS Office for Civil Rights, “HIPAA and Cybersecurity” (2026), https://www.hhs.gov/hipaa/for-professionals/security/index.html
• HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards: HHS Office for Civil Rights, “Summary of the HIPAA Security Rule” (2025), https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html