Security commentary from SuspectFile analyst Marco A. De Felice challenges a persistent habit in incident response: treating the identity of the attacker as the central question while giving far less attention to why the breach caused so much damage in the first place. The argument has direct relevance for healthcare, where organizations routinely hold large volumes of sensitive patient data long after its primary clinical purpose has passed.
The structural problem
De Felice describes what he calls structural fragility — a condition in which organizations accumulate and centralize sensitive data at a scale that guarantees outsized harm whenever a security control fails. The framing shifts accountability away from the moment of intrusion and toward the data-governance decisions that preceded it by months or years.
For healthcare practices, that framing lands with particular weight. HIPAA's minimum-necessary standard has always required limiting data collection and access to what is operationally required, but enforcement patterns show the rule is unevenly applied. Patient records, billing histories, and demographic files are frequently retained well beyond any clinical or legal requirement, creating what amounts to a standing inventory of exploitable information.
Where incident response falls short
The conventional post-incident workflow — identify the threat actor, patch the exploited vulnerability, notify affected individuals — addresses the how of a breach without addressing the why the consequences were so large. When a ransomware group or data-extortion actor succeeds in exfiltrating years of consolidated records, the harm multiplier is not primarily a function of the attacker's sophistication. It is a function of how much data was available to take.
De Felice's analysis suggests that organizations investing heavily in threat detection while underinvesting in data minimization and retention controls are solving a downstream problem. Detection fails sometimes; when it does, a minimal-footprint data environment limits the damage. A dense, centralized archive does the opposite.
What this signals for compliance operations
The piece arrives at a moment when HHS and OCR continue to refine expectations around the HIPAA Security Rule's administrative safeguards, including formal risk analysis requirements that are meant to account for data inventory and access scope — not just technical controls at the perimeter.
Independent practices reviewing their risk analysis this year should consider whether the document addresses:
- Data inventory scope — what categories of patient information are held, in what systems, and for how long.
- Retention schedules — whether written policies exist and are being followed, and whether retention periods are grounded in legal requirements rather than default system behavior.
- Centralization decisions — whether consolidating records across locations or platforms has created single points of high-value exposure that warrant compensating controls or architectural changes.
- Incident response planning — whether response plans include steps to assess data-exposure volume, not only to determine the technical cause of access.
The argument is not that threat intelligence or attacker attribution is worthless. It is that neither discipline substitutes for the organizational discipline of not holding more sensitive data than necessary in the first place. For small and independent practices with limited security staff, that discipline is also among the more tractable improvements available — one that requires policy decisions and workflow changes rather than additional technology spending.