Advocate Health is a nonprofit integrated health system formed in 2022, now operating as the third-largest of its kind in the U.S. The system spans 69 hospitals and over 1,000 sites of care across six states in the Midwest and Southeast, with a headquarters in Charlotte, North Carolina. It serves nearly 6 million patients annually with a workforce of 162,000 teammates, including 35,000+ physicians and 42,000 nurses.
For cybersecurity professionals, the threat model here is the modern healthcare attack surface writ large: a sprawling network of clinical systems, patient data repositories, connected medical devices, and digital innovation platforms across six states. The stakes are tangible - protecting the integrity and availability of systems that directly support patient care, while securing the data of millions. The organization's scope encompasses clinical operations, academic research, and community health initiatives, each with distinct security requirements and risk profiles.
The technical environment is anchored in digital innovation and research alongside core clinical delivery. Security teams operating at this scale confront the convergence of legacy healthcare infrastructure, regulatory compliance pressures (HIPAA and beyond), and the expanding footprint of cloud-connected care delivery. With over $6 billion in community benefit delivered, the operational mandate is clear: the security posture must match the breadth of a system designed to tackle healthcare's biggest challenges around access, affordability, and equity.
