A recent cyberattack on the University of Mississippi Medical Center shut down clinic operations for nine days, disrupting appointments and access to care across Mississippi. According to the center’s own official system update, scheduling, communications, and clinical workflows were all impacted.
Nine days without normal access to care is not just a cybersecurity problem. It is a market structure problem.
The University of Mississippi Medical Center is not simply another hospital. It is Mississippi’s only academic medical center and serves as the state’s primary hub for specialty care, physician training, and complex services. By its own description, it provides levels of care “unavailable anywhere else in the state.” That concentration means when UMMC goes down, much of Mississippi’s advanced care capacity goes down with it.
In a competitive system, that should not happen.
When a major provider in most industries goes offline, others step in. Capacity shifts. Customers reroute. The system bends but does not break. In Mississippi, it broke.
A System Built to Concentrate
That fragility is not an accident. It is the result of policy.
Mississippi has long enforced certificate-of-need laws that require government approval before new hospitals, surgical centers, or major medical services can open or expand. These laws are often justified as cost-control measures. In practice, they limit entry and protect incumbents.
Mississippi’s version is among the more restrictive. Applications can cost tens of thousands of dollars, and existing providers are allowed to challenge potential competitors. The effect is predictable. Fewer entrants. Slower expansion. Less redundancy.
Policy analysis by the Mississippi Center for Public Policy found that, without CON restrictions, Mississippi could have supported 30 percent more rural hospitals and 13 percent more ambulatory surgical centers, thereby increasing access in underserved areas. A comparable state without such restrictions would have roughly 165 hospitals, compared with Mississippi’s 116, a difference of more than 30 percent in total capacity in 2017.
That missing capacity matters most when something goes wrong.
Fragility Has Consequences
The cyberattack did not create Mississippi’s access problem. It exposed it.
When a single institution serves as the backbone of a state’s healthcare system, any disruption becomes systemic. Patients do not simply go elsewhere. In many cases, there is nowhere else to go.
That means delayed diagnoses, postponed treatments, and worsening conditions. It means longer wait times in an already strained system. And in extreme cases, it can mean preventable harm.
Across the country, wait times for physician appointments are already rising, particularly for primary and specialty care. Systems with limited competition are less able to absorb shocks, making those delays even more severe when disruptions occur.
This is what lack of competition looks like in practice. Not just higher prices, but reduced resilience.
The Financing Problem
Market structure is only part of the story. The way healthcare is financed amplifies the problem.
Most healthcare dollars do not flow through patients. They flow through insurers, employers, and government programs. That disconnect weakens the most important signal in any market: price.
When patients are not paying out of pocket, providers compete less on value and more on navigating reimbursement systems. Administrative costs rise. Innovation slows. Capacity becomes rigid rather than responsive.
This is the core issue identified in the Empower Patients framework. Healthcare in the United States is dominated by third-party control rather than patient decision-making.
The result is a system that is both expensive and fragile.
What Competition Looks Like
When competition is allowed, the results differ.
Transparent providers such as the Surgery Center of Oklahoma publish prices upfront and often deliver care at significantly lower cost than traditional hospital systems. Direct Primary Care practices offer faster access, longer visits, and predictable pricing by operating outside insurance billing.
These models do more than reduce costs. They add capacity. They create alternatives. They make the system more resilient.
If one provider goes offline, others are available.
Mississippi has fewer alternatives because policy has limited their growth. Even when regulators approved a new hospital in Biloxi, the process revealed how difficult it is to add capacity. The state issued a certificate of need in 2012 for a replacement facility, but incumbent hospitals sued to block the project, delaying it for years, arguing it was not a true replacement. That prolonged fight stemmed from the original plan to build a new hospital to replace Gulf Coast Medical Center after it was destroyed by Hurricane Katrina. In short, even obvious community needs can be slowed by legal challenges from existing providers.
The pattern continues: recent consolidation has further strengthened dominant systems on the Gulf Coast, and policymakers pursue only incremental changes to certificate-of-need laws, while others call for a broader overhaul of the state’s restrictions.
A map depicting states where an incumbent competitor may object to a new facility. Image credit: The Mississippi Center for Public Policy.
A Warning for Policymakers
The Mississippi cyberattack should be viewed as a warning, not an anomaly. It revealed how vulnerable a healthcare system becomes when competition is restricted and capacity is concentrated. What looks efficient on paper can be fragile in practice.
Mississippi is not an outlier. 35 states and DC operate under certificate-of-need laws that limit the number of new providers and expansion. States have been working to improve their CON laws, reflecting a growing recognition that the current structure is too rigid. But incremental reform will not solve a structural problem.
A Better Path Forward
A more resilient healthcare system that empowers patients requires more than cybersecurity upgrades. It requires policy change.
First, remove barriers to entry that prevent new providers from entering the market. In Mississippi, the state could support 30 percent more rural hospitals and 13 percent more ambulatory surgical centers, meaning more options for patients and more capacity when disruptions occur.
Second, shift financing toward patient control. When individuals manage their own healthcare dollars, they have an incentive to seek value, compare options, and demand better service.
Third, reduce regulatory burdens that divert resources from care to compliance.
These changes would not only lower costs. They would make the system stronger.
The Real Lesson
Mississippi’s healthcare system did not fail because of a cyberattack alone. It failed because it lacked the flexibility and redundancy to respond. One hospital system should never be a single point of failure for an entire state.
The way to prevent that is not more centralization. It is more competition, more capacity, and more patient control. That is the lesson Mississippi offers — and it is one policymakers across the country should take seriously.
