Healthfirst is a not-for-profit health insurer built on the Medicaid system, serving over two million members across New York City, Long Island, and the lower Hudson Valley. With 6,000-plus employees, the company administers Medicaid plans, Medicare Advantage, long-term care coverage, ACA-compliant Qualified Health Plans, and lower-income Essential Plans. The provider network spans more than 40,000 providers and 80-plus hospitals, meaning a compromise doesn't just hit a database - it touches clinical workflows, claims processing, and member PII at scale across one of the most regulated industries in the country.
The threat model is real: healthcare data is a primary target, and the regulatory surface area is massive - HIPAA, state insurance law, and CMS requirements all apply simultaneously. Security teams here aren't protecting a single product; they're defending an enterprise that processes sensitive health and financial data across multiple plan types, integrates with tens of thousands of provider endpoints, and operates 28 community offices with direct member access. The attack surface ranges from claims and eligibility systems to provider portals and internal clinical tooling.
Healthfirst operates as a mission-driven organization, prioritizing health outcomes over profit margins. That model creates specific constraints and incentives for the security function: uptime and data integrity directly affect member care. The company is headquartered in New York and hires in-region, serving a dense, diverse, and heavily regulated urban market where the margin for error on data protection is effectively zero.
