56% of breached healthcare organizations had permissive or missing SPF records (9% missing, 46% soft fail).