Strategic attackers, insider and privacy–utility conflicts pose persisting problems to healthcare data protection frameworks. In this study we envision a Game-Theoretic Healthcare Data Protection Model (GHDPM) to make optimal defensive decisions in dynamic cyber-risk scenarios. The methodology models the interactions between the healthcare defenders and attackers as a non-cooperative Stackelberg security game where attacks, expected utility, privacy loss and defense costs are modeled. The best protection strategies are chosen using the concepts of nash equilibrium and payoff optimization. Analysis shows that an equilibrium-based defense strategy will decrease the probability of successful attack by 31.8%, the expected privacy loss by 27.4% with respect to static strategies while at the same time increasing security utility by 22.6%. The essence of the novelty is that adaptive strategic defense modeling takes place. The framework provides quantitative support for decision making in healthcare cybersecurity, showcasing the ability of game theoretic optimization to achieve resilient data protection of healthcare systems that is cost-effective and private.