Hospitals will see modest gains in 2025, but face higher costs, including cybersecurity, Moody’s says

Nonprofit hospitals should continue to see some financial improvement in 2025, but they will also continue to see difficulties with high labor costs, according to projections from Moody’s Ratings.

Hospitals will see some financial improvements in 2025, according to Moody's Ratings. But they'll also be challenged by higher labor and supply costs, and the need to invest more in cybersecurity.

In addition, hospitals are going to need to invest more in cybersecurity, as ransomware groups target health systems, according to Moody’s.

Looking at the coming year, Moody’s projects a stable outlook for nonprofit hospitals and sees the median operating cash flow margin approaching 7%.

“But the pace of margin improvement is slowing, and not all hospitals have reached this level of profitability,” the Moody’s report states.

Hospitals should see modest improvement in patient admissions and surgical procedures, but health systems should continue to see more robust growth in outpatient services. Hospitals have seen faster growth in outpatient services in recent years, as more patients prefer options that don’t require an overnight stay in a hospital.

While more patients are opting for outpatient options, health systems receive smaller reimbursements for such care. As a result, nonprofit health systems are probably going to concentrate on more profitable outpatient service lines, such as oncology, to boost revenue and make up for the reduced reimbursements, Moody’s projects.

Labor costs are expected to remain a considerable challenge for nonprofit hospitals, according to Moody’s. The pace of pay increases should be slower than the past couple of years, but wages will continue to reach record levels.

“High expenses, particularly related to labor, will remain a major hurdle for the sector because labor costs account for a median 53% of operating expenses. A steep rise in healthcare wages over the last three years will remain a structural issue,” Moody’s stated in the report.

Hospitals could see battles with union workers over new contracts, which could lead to bigger wage increases or strikes. But hospitals have seen some success in recruiting and retention and have reduced their reliance on staffing agencies, which can be more costly for providers. Analysts have noted that hospitals have shown willingness to absorb bigger salary bumps for more stability in their labor forces.

Health systems will also wrestle with high supply costs in the coming year, and should expect prices in drugs to rise “in the mid-to-high-single-digit percentage range,” according to Moody’s.

Total operations costs are expected to rise 5.5% in 2025, which represents a slower pace of growth than in 2022 (9.2%), when the labor shortage was at its worst, Moody’s says.

Hospitals are also spending more to defend against cyberattacks, and Moody’s says that’s an area where health systems are going to have to invest due to the high risk of breaches. Moody’s pointed to the widespread disruption tied to the Change Healthcare cyberattack, which affected 100 million Americans and impacted virtually all hospitals and health systems.

Ransomware groups have targeted hospitals because they have highly valuable health data, and because health systems have shown they’re willing to pay to protect patients.

“Healthcare remains a top target for cyber criminals due to the importance and sensitivity of information that can be stolen,” the Moody’s report states. “Moreover, the increasing digitization of the sector means these risk-mitigation strategies will remain a priority, necessitating continuous investment in cybersecurity.” 

Healthcare organizations are spending about 7% of their technology budgets on cybersecurity, according to a survey from HIMSS released in March.

Hospitals are expected to continue to invest in cyber insurance protection, possibly as they brace for a wave of lawsuits tied to data breaches, the Moody’s report stated. However, insurers could impose higher premiums and tougher standards as they see more claims - and bigger claims - from ransomware attacks, according to Moody’s.