This week, Black Hat and HIMSS did something the industry should have done years ago: they put offensive security researchers and hospital technology leaders in the same room, on the same agenda. The catalyst was peer-reviewed data showing that ransomware attacks raise patient mortality by 38%. That is no longer an IT statistic. It is a clinical one.
For a region that has spent the last decade digitizing at a pace few health systems anywhere can match, that single number reframes the conversation. Every EHR go-live, every HIE connection, every RPM and TeleICU rollout has been sold, correctly, as a growth story. What is less discussed is that each of those systems also widens the surface an adversary can reach, and in healthcare, a breach does not just cost data. It costs clinical continuity.
+38%
mortality increase following a ransomware attack
99%
of hospitals still running at least one device with a known, exploited vulnerability
$24B
projected size of the GCC digital health market by 2035
The three systems most responsible for the GCC's digitization dividend, EHR platforms, HIE interoperability layers, and RPM/TeleICU networks, are also the three that expand exposure fastest. Growth and resilience have to be designed around each other, not sequenced. A perimeter has to be built around the growth, not bolted on after it.
1. The reckoning at Black Hat
On August 4, Black Hat USA and HIMSS launched their first joint Healthcare Cybersecurity Summit in Las Vegas, pairing the world's leading vulnerability researchers with the body that writes healthcare's operational playbooks. It took a mortality statistic to force that convergence. It shouldn't have. Offensive security and clinical operations have operated as separate disciplines for too long, reporting up different chains, measured against different KPIs, rarely in the same steering committee. The summit is a signal that the industry now treats them as one problem.
2. The GCC's digitization dividend, and its exposure
Qatar's national EHR now reaches roughly 80% of providers and is projected to save the system QAR 1.5 billion annually. The wider GCC digital health market is forecast to grow from $6.3 billion to nearly $24 billion by 2035. Every one of those gains widens the attack surface a CIO is accountable for defending. The mistake is treating that growth and that exposure as two separate line items on two separate budgets, when they are two properties of the same infrastructure.
3. Interoperability without a security blueprint is a liability
The UAE's Riayaty platform, federating Dubai's NABIDH and Abu Dhabi's Malaffi, is exactly the direction national HIE should move. But every new integration point is a new perimeter. Regional mandates for unified records need to ship with cyber-resilience mandates attached, not bolted on after go-live. An interoperability roadmap that does not include a threat model for every new connection point is an incomplete roadmap, however complete it looks on the systems integration side.
4. What this means for CIOs now
With 99% of hospitals still running devices carrying known, exploited vulnerabilities, and average breach dwell time exceeding 240 days, resilience cannot live in a quarterly IT report. It belongs on the same board agenda as clinical quality: tabletop exercises scoped to patient continuity rather than system recovery alone, and cyber-resilience KPIs reported alongside uptime, not underneath it.
Resilience is designed, not retrofitted.
None of this argues for slowing digitization down. Ambient AI documentation, national health command centers, and connected device ecosystems are the right direction for GCC health systems, and the ones already committed to them are ahead of where most of the world's health systems stood a decade ago. The argument is narrower and more urgent: every one of those initiatives needs a security architecture as a design input from day one, not a compliance exercise appended after the facility is already live.
Is your organization treating cybersecurity as a clinical safety issue, or still filing it under IT overhead? We would welcome your view.
Healthcare Cybersecurity · Digital Health · Health IT · GCC Healthcare · Patient Safety
About the author
Asim Khan, MBA, CHCIO, PMP, CPHIMS — Partner, Lusail Advisory
Government and healthcare technology advisory across Qatar and the GCC: EMR and data systems, AI-enabled diagnostics, and health technology strategy.
info@lusailadvisory.com