Weathering Every Storm: What Industry-Leading Cyber Resilience Looks Like

Every health IT company will tell you that it takes security seriously. But what does that actually look like in practice? At Surescripts, it looks like round-the-clock network monitoring, systems that are deployed across multiple active zones and regions and a message queue that holds prescriptions in place during an outage.

Cyber resilience is built into the Surescripts network—the connective layer of the Surescripts platform that carries prescriptions, clinical histories and benefit information between the organizations that care for patients. Plus, network redundancy means that a single failure in the system doesn’t become a failure for everyone on it.

That architecture is built to hold against the three main types of disruption Surescripts plans for; cyberattacks, outages that begin on a customer's system and natural disasters.

The healthcare forecast is not calm

Healthcare is the most targeted sector in the country. In 2025, 20% of all data breach and ransomware complaints received by the FBI's Internet Crime Complaint Center came from the healthcare and public health sector—more than any other sector.

The reason is economics. Researchers estimate that a single medical record sells for about $60 on the dark web, compared with roughly $15 for a Social Security number and $3 for credit card information.

Those numbers are abstract until you stand at a pharmacy counter. Then they look like a patient with a new prescription, a pharmacist who can’t retrieve it and a conversation that starts with "Our system is down. Can you come back tomorrow?" In healthcare, disruption means delayed care.

That’s why we plan for three types of major storms: cyberattacks, outages that begin on someone else's system and the issues that show up on a radar map. And we meet each one the same way—by detecting, protecting and responding.

Storm one: The attack aimed at us

Detecting a threat early is most of the work. We monitor the network 24/7 for suspicious activity and anomalies, while a dedicated security team proactively collects cybersecurity threat intelligence.

Protection happens at every level, including:

• Rigorous privacy, security and network access standards for our network and the Surescripts Network Alliance^®
• Adherence to standards set by leading privacy and security organizations including the NIST Cybersecurity Framework, which is considered the gold standard of cybersecurity
• A HITRUST r2 Certification, as well as certifications from the Electronic Healthcare Network Accreditation Commission (EHNAC) and DirectTrust
• Tightly controlled access to the network, transmitting only the data needed for agreed-upon use cases
• Advanced identity management tools that help confirm the right information reaches the right healthcare provider
• Close work with our partners to help protect against illicit activity such as fraudulent prescribing
• Regular tabletop exercises that put our teams through realistic attack scenarios, so the response is practiced before it’s needed

And if something does get through, redundant systems and robust cyber resilience plans are designed to keep critical information flowing without disruption.

Storm two: The outage that starts somewhere else

Sometimes the system on the receiving end of a prescription is the one that goes down. On a network without safeguards, a single receiver's outage becomes a failed transaction for every sender routing to it—requiring prescriptions to be written and routed again.

The Surescripts network is designed to absorb that failure rather than pass it along. Our message queue service holds e-prescribing messages in a queue when an outage or service interruption prevents them from being processed by the receiver. This means that when the receiving system is restored, the prescriptions are still there—in order and intact.

Storm three: The issue you can see on radar

Hurricanes, wildfires and winter storms displace patients, close pharmacies and scatter care teams across state lines, often with little warning.

Surescripts treats emergency responses as part of resilience, not a separate department. We proactively offer resources and assistance to federal and state agencies during emergencies and equip network participants with action plans for disaster response, so they know what to do before an emergency occurs.

What it looks like when the engineering holds

In 2025, Surescripts maintained 99.998% average network uptime—with only roughly two minutes of downtime per month.

That level of consistently doesn’t just happen. It’s the byproduct of multiple active regions and zones, a dedicated disaster recovery region, defenses at every level and teams that prepare and practice for what could happen, before it does.

A network you can trust to keep care on track

Cyber resilience isn't a single safeguard. It's a 24/7 security operations center and multi-factor authentication at the front door. It's a message queue that holds a prescription until the pharmacy system on the other end is back up and running. It's an action plan in the hands of a health system before the storm makes landfall. Detecting, protecting and responding are three parts of one discipline, and network redundancy is what connects them—because a defense that can't recover isn't a defense.

In the world of healthcare IT security, storms are a given. That’s why it’s crucial to choose a network that stays standing through them—and gets back up fast when something breaks. That’s the difference Surescripts is built on and it’s how we help ensure business continuity holds every day and patient care stays connected and on track.