August 2026 seemed promising. Large healthcare data breaches reported to the Office for Civil Rights (OCR) dropped 34% from the previous month, down to 52 incidents. However, the year-to-date figure tells a different story: 593 large breaches compared to 556 at the same time last year, marking a 6.7% increase. Last year was already the worst on record with 807 incidents.
If you're assessing or advising on HITRUST CSF programs, this discrepancy between a good month and a bad trend raises a critical question. When your client has a limited security budget, should it focus on preventing breaches or on minimizing damage when breaches occur?
The Question at Hand
The data points in a clear direction. Hacking and IT incidents accounted for 78.8% of August's breaches and affected 98% of individuals. Year to date, hacking incidents are up only 0.9% in count, but the number of individuals affected has risen by 18.7%. Fewer new attack paths are being reported, but each successful intrusion is exposing far more Protected Health Information (PHI).
This shift reframes the debate. If breach frequency is roughly flat but breach severity is climbing, the argument over where to invest becomes sharper. One camp argues that controls to stop initial access still deserve funding. The other camp suggests assuming compromise and spending on containment, detection, and recovery.
The Case for Prevention-First
Prevention advocates start with a simple observation: the breach you stop never needs a notification letter. Under the Breach Notification Rule, a confirmed incident triggers reporting to OCR and notice to affected individuals, leading to downstream costs like forensics, legal review, and regulatory scrutiny, regardless of whether ten records or ten million were compromised.
They also note that many of August's incidents trace back to familiar entry points. Several involved compromised email accounts, including unauthorized access to six employee email accounts at one provider and a single compromised account at another. Others involved data theft from a cloud customer relationship environment or an insider attempting to sell data. These are failures of identity, access management, and monitoring, the kinds of controls the HIPAA Security Rule expects you to have through risk analysis, access controls, and audit controls.
The prevention argument is practical for assessors. Preventive controls are the easiest to test and evidence. Multifactor authentication either covers an account or it doesn't. A patch either went on or it didn't. When a client's HITRUST CSF scope is limited, preventive controls give you clean, defensible Control Maturity Scoring.
The weakness in this argument is the word "never." No prevention stack is airtight, and the largest incidents this year suggest well-funded, organized extortion groups only need one gap.
The Case for Resilience-First
Resilience advocates start from the opposite premise: breaches are a matter of when, so the controls that determine how bad it gets matter most.
Their evidence is the severity trend. Two incidents in August accounted for more than 6.9 million affected individuals. One involved a data theft and extortion group that informed the victim organization its network had been accessed and data exfiltrated, meaning the intrusion was complete before the organization knew. The other involved a hacker reaching parts of a network holding millions of patient records. In both cases, the question isn't only how the attacker got in. It's why so much PHI was accessible once they did.
This points to segmentation, data minimization, encryption, retention limits, logging that actually gets reviewed, and tested incident response and contingency plans. These map directly to HIPAA Security Rule requirements, including the Required Specifications for a contingency plan and security incident procedures. Resilience advocates also note that ransomware is as much an availability problem as a confidentiality one. Two August incidents were reported as ransomware, and the response in those cases depends on backups and recovery speed, not on whether the perimeter held.
The weakness here is measurability. It's harder to show a regulator, or a client's board, the value of an incident that was contained to a small slice of data. Resilience spending can look like insurance, and insurance is easy to defer.
Where Practitioners Actually Land
Most experienced practitioners reject the either/or framing, but they disagree on the weighting.
Those closer to HIPAA compliance work tend to anchor on the risk analysis. OCR has consistently treated a thorough, current risk analysis as the foundation of Security Rule compliance, and NIST SP 800-66 walks through how to tie safeguard selection to identified risk. For these practitioners, the answer to "prevention or resilience" is "whatever your risk analysis says," and the real failure is organizations that don't have a risk analysis honest enough to say.
Practitioners closer to HITRUST work often argue for sequencing. Get the baseline preventive controls to a defensible maturity level first, because assessors and cyber insurers will expect them. Then invest the next increment in detection and recovery, where improvement in the PRISMA Maturity Model tends to be least developed.
There's also growing agreement on one point: Business Associate exposure belongs in both buckets. Several of August's incidents originated at a vendor or management company rather than at the reporting Covered Entity. You can't prevent your way out of a vendor's weak controls, and you can't contain an incident whose scope you can't see. That argues for contractual, assessment, and monitoring investment aimed at the supply chain.
Our Take
If we had to put a number on the split, we wouldn't. But we'll take a position: for most organizations, the next marginal dollar belongs on resilience, specifically on limiting how much PHI a single compromise can expose.
The reasoning comes straight from the trend. Breach counts are roughly steady while affected individuals climb. That's the signature of environments where one foothold leads to a large data store. Prevention controls address the front door. They do little about the size of the room behind it. Shrinking that room, through segmentation, retention discipline, encryption, and access scoping, reduces both the regulatory exposure and the harm to patients.
The tradeoff is real. Resilience spending is harder to evidence, and it won't help a client who has skipped the basics. If MFA isn't enforced on email and remote access, fix that before anything else. A resilience program built on a weak perimeter is just an expensive way to practice breach response.
For assessors, the practical move is to stop treating these as separate conversations. When you review a client's risk analysis, ask two questions of every high-risk system: how would an attacker reach it, and how much would they get if they did? If the second answer is "everything," that's your finding, whatever the first answer looks like.
