In the 2026 Ponemon Healthcare Cybersecurity Report, 69% of respondents whose organizations were hit by business email compromise (BEC) said the attack affected patient care. In the same survey, 68% said BEC attacks delayed procedures and tests, according to HIPAA Journal's October 16 write-up.

BEC is usually filed under finance. The FBI's 2025 Internet Crime Report logged about $3 billion in reported BEC losses, second only to investment fraud. These survey figures put BEC in the clinical column too.

The survey reports the delay, not the cause

The Ponemon Institute surveyed 705 IT and IT security practitioners who set security policy, select vendors and manage security budgets. Respondents came from public and private healthcare providers, insurers, payers, and life sciences companies.

BEC landed close to ransomware on patient impact: 69% for BEC against 72% for ransomware. BEC usually leaves every system running and works through the trust between the people using them, so its route to a delayed procedure is harder to picture than ransomware's.

HIPAA Journal's write-up doesn't say how BEC led to delayed procedures and tests. If your own team can't trace it either, your BEC response plan probably stops at the finance office.

Your BEC response plan needs a clinical owner

Start with the part most BEC plans leave out:

  • Map which clinical workflows run through email, such as referrals, orders, and scheduling changes, and which mailboxes carry them
  • Name a clinical owner in the BEC response plan, alongside the finance and IT owners
  • Decide in advance how those workflows keep moving if one of those mailboxes has to be locked or investigated

Then confirm the basics from the Health Sector Cybersecurity Coordination Center (HC3) at the Department of Health and Human Services (HHS), set out in its BEC and healthcare briefing:

  • Independent verification from a second employee before anyone sends money or sensitive information, or changes bank details
  • Multifactor authentication on all email accounts
  • Labels on external email
  • Registered lookalike versions of your own domains

BEC runs on the requests healthcare sends every day

HC3 describes BEC as an attack that does "not rely solely on technical vulnerabilities, but exploit[s] the human tendency to trust authority, act impulsively, and respond emotionally to urgent requests."

Paubox's analysis of 2025 HHS breach data found that vendor and business associate email exposure was the most common email breach pattern, at 28% of all email incidents reported to HHS. The Top 3 Healthcare Attacks in 2025 report also found that impersonation repeatedly acted "as the trigger that turns access into disclosure."

An attacker who sends a convincing message from a partner's real or lookalike address is asking staff to do something they already do every day.

Authentication stops at the domains you own

In the 2026 Healthcare Email Security Report, Paubox found that 74% of healthcare organizations breached through email in 2025 lacked effective DMARC enforcement.

Enforcement keeps attackers from sending as your domain. It can't stop a message from a lookalike domain or from a partner's account that has already been taken over, and those messages often carry no malware or link to scan.

That is the gap Paubox's ExecProtect+ is built for: it blocks lookalike domains and compromised accounts that impersonate colleagues.

How Paubox reads the message

Paubox Inbound Email Security uses generative AI to analyze tone, sender behavior, and message intent, which is where BEC gives itself away when there is no malicious link or attachment to catch.

Inbound protection is one part of HIPAA compliant email. Encryption, a signed BAA, and audit logs cover the rest.

Related: Business email compromise tactics used against healthcare staff in 2026