Search

Purpose: Hospitals are increasingly the target of cybersecurity threats, including ransomware attacks. Little is known about how ransomware attacks affect care at rural hospitals., Methods: We used data on hospital ransomware attacks from the Tracking Healthcare Ransomware Events and Traits database, linked to American Hospital Association survey data and Medicare fee-for-service (FFS) claims data from 2016 to 2021. We measured Medicare FFS volume and revenue in the inpatient, outpatient, and emergency room setting-at the hospital-week level. We then conducted a stacked event study analysis, comparing hospital volume and revenue at ransomware-attacked and nonattacked hospitals before and after attacks., Findings: Ransomware attacks severely disrupted hospital operations-with comparable effects observed at rural versus urban hospitals. During the first week of the attack, inpatient admissions volume fell by 14.7% at rural hospitals (P = .04) and 16.9% at urban hospitals (P = .01)-recovering to preattack levels within 2-3 weeks. Outpatient visits fell by 35.3% at rural hospitals (P<.01) and 22.0% at urban hospitals (P = .03) during the first week. Emergency room visits fell by 10.0% at rural hospitals (P = .04) and 19.3% at urban hospitals (P = .01). Travel time and distance to the closest nonattacked hospital was 4-7 times greater for rural ransomware-attacked hospitals than for urban ransomware-attacked hospitals., Conclusions: Ransomware attacks disrupted hospital operations in rural and urban areas. Disruptions of similar magnitudes may be more detrimental in rural areas, given the greater distances patients must travel to receive care and the outsized impact that lost revenue may have on rural hospital finances., (© 2024 The Author(s). The Journal of Rural Health published by Wiley Periodicals LLC on behalf of National Rural Health Association.)

Due to the high amount of electronic health records, hospitals have prioritized data protection. Because it uses parallel computing and is distributed, the security of the cloud cannot be guaranteed. Because of the large number of e-health records, hospitals have made data security a major concern. The cloud's security cannot be guaranteed because it uses parallel processing and is distributed. The blockchain (BC) has been deployed in the cloud to preserve and secure medical data because it is particularly prone to security breaches and attacks such as forgery, manipulation, and privacy leaks. An overview of blockchain (BC) technology in cloud storage to improve healthcare system security can be obtained by reading this paper. First, we will look at the benefits and drawbacks of using a basic cloud storage system. After that, a brief overview of blockchain cloud storage technology will be offered. Many researches have focused on using blockchain technology in healthcare systems as a possible solution to the security concerns in healthcare, resulting in tighter and more advanced security requirements being provided. This survey could lead to a blockchain-based solution for the protection of cloud-outsourced healthcare data. Evaluation and comparison of the simulation tests of the offered blockchain technology-focused studies can demonstrate integrity verification with cloud storage and medical data, data interchange with reduced computational complexity, security, and privacy protection. Because of blockchain and IT, business warfare has emerged, and governments in the Middle East have embraced it. Thus, this research focused on the qualities that influence customers' interest in and approval of blockchain technology in cloud storage for healthcare system security and the aspects that increase people's knowledge of blockchain. One way to better understand how people feel about learning how to use blockchain technology in healthcare is through the United Theory of Acceptance and Use of Technology (UTAUT). A snowball sampling method was used to select respondents in an online poll to gather data about blockchain technology in Middle Eastern poor countries. A total of 443 randomly selected responses were tested using SPSS. Blockchain adoption has been shown to be influenced by anticipation, effort expectancy, social influence (SI), facilitation factors, personal innovativeness (PInn), and a perception of security risk (PSR). Blockchain adoption and acceptance were found to be influenced by anticipation, effort expectancy, social influence (SI), facilitating conditions, personal innovativeness (PInn), and perceived security risk (PSR) during the COVID-19 pandemic, as well as providing an overview of current trends in the field and issues pertaining to significance and compatibility., Competing Interests: The authors declare that there is no conflict of interest regarding the publication of this paper., (Copyright © 2022 Malik Mustafa et al.)

Public key encryption with equality test enables the user to determine whether two ciphertexts contain the same information without decryption. Therefore, it may serve as promising cryptographic technique for cloud-assisted wireless sensor networks (CWSNs) to maintain data privacy. In this paper, an efficient RSA with equality test algorithm is proposed. The presented scheme also handles the attackers based on their authorization ability. Precisely, the proposed scheme is proved to be one-way against chosen-ciphertext attack security and indistinguishable against chosen ciphertext attacks. Moreover, the experimental evaluations depict that the underlying scheme is efficient in terms of encryption, decryption, and equality testing. Thus, this scheme may be used as a practical solution in context of CWSNs, where the users may compare two ciphertexts without decryption., Competing Interests: The authors have declared that no competing interests exist.

Satellite communication has played an important part in many different industries because of its advantages of wide coverage, strong disaster tolerance and high flexibility. The security of satellite communication systems has always been the concern of many scholars. Without authentication, user should not obtain his/her required services. Beyond that, the anonymity also needs to be protected during communications. In this study, we design an efficient and provably secure key agreement scheme for satellite communication systems. In each session, we replace user's true identity by a temporary identity, which will be updated for each session, to guarantee the anonymity. Because the only use of lightweight algorithms, our proposed scheme has high performance. Furthermore, the security of the proposed scheme is proved in the real-or-random model and the performance analysis shows that the proposed scheme is more efficient than some other schemes for satellite communication systems., Competing Interests: The authors have declared that no competing interests exist.

Federated learning (FL) as a distributed machine learning (ML) technique has lately attracted increasing attention of healthcare stakeholders as FL is perceived as a promising decentralized approach to address data privacy and security concerns. The FL approach stores and maintains the privacy-sensitive data locally while allows multiple sites to train ML models collaboratively. We aim to describe the most recent real-world cases using the FL in both COVID-19 and non-COVID-19 scenarios and also highlight current limitations and practical challenges of FL., (© The Author(s) 2021. Published by Oxford University Press on behalf of International Society for Quality in Health Care. All rights reserved. For permissions, please e-mail: journals.permissions@oup.com.)

Background: General data protection regulation (GDPR) provides rules according to which data should be managed and processed in a secure and appropriate way for patient requirements and security. Currently, everyone in Europe is covered by GDPR. Thus, the medical practice also requires access to patient data in a safe and secure way., Methods: Holographic technology allows users to see everything visible on a computer screen in a new and less restricted way, i.e. without the limitations of traditional computers and screens., Results: In this study, a three-dimensional holographic doctors' assistant is designed and implemented in a way that meets the GDPR requirements. The HoloView application, which is tailored to run on Microsoft HoloLens, is proposed toallow display and access to personal data and so-called sensitive information of all individual patients without the risk that it will be presented to unauthorized persons., Conclusions: To enhance the user experience and remain consistent with GSPR, a holographic desk is proposed that allows displaying patient data and sensitive information only in front of the doctor's eyes using mixed reality glasses. Last but not least, it boasts of a reduction in infection risk for the staff during the COVID-19 pandemic, affording medical care to be carried out by as few doctors as possible.

Modern-day Connected and Autonomous Vehicles (CAVs) with more than 100 million code lines, running up-to a hundred Electronic Control Units (ECUs) will create and exchange digital information with other vehicles and intelligent transport networks. Consequently, ubiquitous internal and external communication (controls, commands, and data) within all CAV-related nodes is inevitably the gatekeeper for the smooth operation. Therefore, it is a primary vulnerable area for cyber-attacks that entails stringent and efficient measures in the form of "cybersecurity". There is a lack of systematic and comprehensive review of the literature on cyber-attacks on the CAVs, respective mitigation strategies, anticipated readiness, and research directions for the future. This study aims to analyse, synthesise, and interpret critical areas for the roll-out and progression of CAVs in combating cyber-attacks. Specifically, we described in a structured way a holistic view of potentially critical avenues, which lies at the heart of CAV cybersecurity research. We synthesise their scope with a particular focus on ensuring effective CAVs deployment and reducing the probability of cyber-attack failures. We present the CAVs communication framework in an integrated form, i.e., from In-Vehicle (IV) communication to Vehicle-to-Vehicle (V2X) communication with a visual flowchart to provide a transparent picture of all the interfaces for potential cyber-attacks. The vulnerability of CAVs by proximity (or physical) access to cyber-attacks is outlined with future recommendations. There is a detailed description of why the orthodox cybersecurity approaches in Cyber-Physical System (CPS) are not adequate to counter cyber-attacks on the CAVs. Further, we synthesised a table with consolidated details of the cyber-attacks on the CAVs, the respective CAV communication system, its impact, and the corresponding mitigation strategies. It is believed that the literature discussed, and the findings reached in this paper are of great value to CAV researchers, technology developers, and decision-makers in shaping and developing a robust CAV-cybersecurity framework., (Copyright © 2020 Elsevier Ltd. All rights reserved.)

Cybersecurity threats are estimated to cost the world US $6 trillion a year by 2021, and the number of attacks has increased five-fold after COVID-19. Although there is substantial literature on the threats technological vulnerabilities have on the health care industry, less research exists on how pandemics like COVID-19 are opportunistic for cybercriminals. This paper outlines why cyberattacks have been particularly problematic during COVID-19 and ways that health care industries can better protect patient data. The Office for Civil Rights has loosened enforcement of the Health Insurance Portability and Accountability Act, which, although useful in using new platforms like Zoom, has also loosened physical and technical safeguards to cyberattacks. This is especially problematic given that 90% of health care providers had already encountered data breaches. Companies must implement well-defined software upgrade procedures, should use secure networks like virtual local area networks, and conduct regular penetration tests of their systems. By understanding factors that make individuals, health care organizations, and employers more susceptible to cyberattacks, we can better prepare for the next pandemic., (©Christina Meilee Williams, Rahul Chaturvedi, Krishnan Chakravarthy. Originally published in the Journal of Medical Internet Research (http://www.jmir.org), 17.09.2020.)

Background: Since August 2018, Irish health research is regulated by the European General Data Protection Act (GDPR) 2016 with the (Irish) Data Protection Act and Health Research Regulations (HRR) 2018. The Irish application of GDPR has been criticised by consultants and academics as overly restrictive; however, Non-consultant Hospital Doctor's (NCHD's) perspectives have not been explored., Objectives/aims: This project aimed to collect the views of NCHDs in Ireland in relation to health research and the impact of GDPR and HRR. Internationally barriers to engagement with health research have been identified; however, to our knowledge, no previous studies have been conducted in Ireland., Methods: Agreeable Irish specialty colleges and faculties distributed an online survey to their NCHDs. Social media platforms were also used to promote the survey. All data collected was anonymised., Results: A total of 192 NCHDs completed the survey; respondents included doctors from 13 specialties, with representation from each NCHD grade. Ninety-nine percent had previously participated in research, and 87% acknowledged the importance for doctors to be involved in research. Forty-four percent of NCHDs stated they would consider travelling abroad to complete research. Eighty-six percent agreed training relating to the new regulations would be useful; however, only 25% had received training., Conclusions: Our results confirm that NCHDs in Ireland are enthusiastic about engaging in research. The majority acknowledge the value of research in career development. Engaging in research abroad could be further explored as a factor impacting emigration. Our findings show that NCHDs in Ireland are concerned about the impact of GDPR and HRR and are seeking further training.

Randomness beacons are services that periodically emit a random number, allowing users to base decisions on the same random value without trusting anyone: ideally, the randomness beacon does not only produce unpredictable values, but is also of low computational complexity for the users, bias-resistant and publicly verifiable. Such randomness beacons can serve as an important primitive for smart contracts in a variety of contexts. This paper first presents a structured security analysis, based on which we then design, implement, and evaluate a trustworthy and efficient randomness beacon. Our approach does not require users to register or run any computationally intensive operations. We then compare different implementation and deployment options on distributed ledgers, and report on an Ethereum smart contract-based lottery using our beacon., Competing Interests: There are no competing interests. In particular, the affiliation of Yvonne-Anne Pignolet with DFINITY does not alter our adherence to PLOS ONE policies on sharing data and materials.

The existing tamper detection schemes for absolute moment block truncation coding (AMBTC) compressed images are able to detect the tampering. However, the marked image qualities of these schemes can be enhanced, and their authentication methods may fail to detect some special tampering. We propose a secure AMBTC tamper detection scheme that preserves high image fidelity with excellent detectability. In the proposed approach, a bit in bitmaps of AMBTC codes is sequentially toggled to generate a set of authentication codes. The one that causes the least distortion is embedded into the quantization levels with the guidance of a key-generated reference table (RT). Without the correct key, the same reference table cannot be constructed. Therefore, the proposed method is able to detect various kinds of malicious tampering, including those special tampering techniques designed for RT-based authentication schemes. The proposed method not only offers better image quality, but also provides an excellent and satisfactory detectability as compared with previous works., Competing Interests: The authors have declared that no competing interests exist.

In recent years, powered by state-of-the-art achievements in a broad range of areas, machine learning has received considerable attention from the healthcare sector. Despite their ability to provide solutions within personalized medicine, strict regulations on the confidentiality of patient health information have in many cases hindered the adoption of deep learning-based solutions in clinical workflows. To allow for the processing of sensitive health information without disclosing the underlying data, we propose a solution based on fully homomorphic encryption (FHE). The considered encryption scheme, MORE (Matrix Operation for Randomization or Encryption), enables the computations within a neural network model to be directly performed on floating point data with a relatively small computational overhead. We consider the well-known MNIST digit recognition problem to evaluate the feasibility of the proposed method and show that performance does not decrease when deep learning is applied on MORE homomorphic data. To further evaluate the suitability of the method for healthcare applications, we first train a model on encrypted data to estimate the outputs of a whole-body circulation (WBC) hemodynamic model and then provide a solution for classifying encrypted X-ray coronary angiography medical images. The findings highlight the potential of the proposed privacy-preserving deep learning methods to outperform existing approaches by providing, within a reasonable amount of time, results equivalent to those achieved by unencrypted models. Lastly, we discuss the security implications of the encryption scheme and show that while the considered cryptosystem promotes efficiency and utility at a lower security level, it is still applicable in certain practical use cases., Competing Interests: The authors declare that they have no conflicts of interest., (Copyright © 2020 Anamaria Vizitiu et al.)

A common theme among previously proposed models for network epidemics is the assumption that the propagating object (e.g., a pathogen [in the context of infectious disease propagation] or a piece of information [in the context of information propagation]) is transferred across network nodes without going through any modification or evolutionary adaptations. However, in real-life spreading processes, pathogens often evolve in response to changing environments and medical interventions, and information is often modified by individuals before being forwarded. In this article, we investigate the effects of evolutionary adaptations on spreading processes in complex networks with the aim of 1) revealing the role of evolutionary adaptations on the threshold, probability, and final size of epidemics and 2) exploring the interplay between the structural properties of the network and the evolutionary adaptations of the spreading process., Competing Interests: The authors declare no competing interest.

Recently, brain-machine interfacing is very popular that link humans and artificial devices through brain signals which lead to corresponding mobile application as supplementary. The Android platform has developed rapidly because of its good user experience and openness. Meanwhile, these characteristics of this platform, which cause the amazing pace of Android malware, pose a great threat to this platform and data correction during signal transmission of brain-machine interfacing. Many previous works employ various behavioral characteristics to analyze Android application (or app) and detect Android malware to protect signal data secure. However, with the development of Android app, category of Android app tends to be diverse, and the Android malware behavior tends to be complex. This situation makes existing Android malware detections complicated and inefficient. In this paper, we propose a broad analysis, gathering as many behavior characteristics of an app as possible and compare these behavior characteristics in several metrics. First, we extract static and dynamic behavioral characteristic from Android app in an automatic manner. Second, we explain the decision we made in each kind of behavioral characteristic we choose for Android app analysis and Android malware detection. Third, we design a detailed experiment, which compare the efficiency of each kind of behavior characteristic in different aspects. The results of experiment also show Android malware detection performance of these behavior characteristics combine with well-known machine learning algorithms., Competing Interests: The authors declare that they have no conflicts of interest., (Copyright © 2020 Xin Su et al.)

Objectives: To evaluate the data breaches incidents in the U.S. between 2010 and 2018, identify the characteristics of breaches involving more than a million records, and compare the changes before and after wide adoption of EHR in 2015., Materials and Methods: Incidents of data breaches between 2010 to 2018 were retrieved from the Office of Civil Rights portal. Descriptive statistical analyses were performed to assess the trends and characteristics, and changes between states from 2015 to 2018 were assessed and mapped., Results: From 2010 to 2018, a total of 2,529 breaches affected 194.74 million individual records. Overall, 72.08% incidents involved healthcare providers; theft (32.94%) and hacking (22.7%) were major types of breaches. Large cases affecting more than a million records happened due to compromised internal structures and systems. After 2015, the magnitude of the data breaches has changed at varying levels in the U.S. states necessitating further research and actions., (©2019 AMIA - All rights reserved.)

Much work has focused on the basic reproduction ratio [Formula: see text] for a variety of compartmental population models, but the theory of [Formula: see text] remains unsolved for periodic and time-delayed impulsive models. In this paper, we develop the theory of [Formula: see text] for a class of such impulsive models. We first introduce [Formula: see text] and show that it is a threshold parameter for the stability of the zero solution of an associated linear system. Then we apply this theory to a time-delayed computer virus model with impulse treatment and obtain a threshold result on its global dynamics in terms of [Formula: see text]. Numerically, it is found that the basic reproduction ratio of the time-averaged delayed impulsive system may overestimate the spread risk of the virus.

Healthcare domain has emerged as one of the most preferred use cases of IoT and its related technologies. However, its widespread adoption is still a distant dream. The primary reason behind this is the security and privacy of the data and the participating entities. To overcome this, blockchain technology has emerged as a convenient means to improve the security and privacy of the data and its users. With the deluge of medical data generated through electronic medical records and other ICT based mechanisms, blockchain has found innumerable opportunities in the healthcare domain. The traditional healthcare systems are radically adopting modern day technologies for transitioning into the smart healthcare ecosystems. The convenience of the users and ease of use are the primary factors driving this transition. Even with smart healthcare systems (SHS) there exist numerous challenges and issues related to the security, transparency and privacy of the data and users. This paper explores the technological and social barriers in adoption of SHS by analyzing state-of-the-art expert views and user's perception. It further proposes a blockchain based SHS framework to provide intrinsic security and integrity of the system. Finally, the future research directions and use cases of blockchain in healthcare domain are discussed., Competing Interests: Declaration of competing interest The authors declare that there is “No Conflict of Interest” in the current manuscript., (Copyright © 2019 Elsevier Inc. All rights reserved.)

In recent years, the number of vulnerabilities discovered and publicly disclosed has shown a sharp upward trend. However, the value of exploitation of vulnerabilities varies for attackers, considering that only a small fraction of vulnerabilities are exploited. Therefore, the realization of quick exclusion of the non-exploitable vulnerabilities and optimal patch prioritization on limited resources has become imperative for organizations. Recent works using machine learning techniques predict exploited vulnerabilities by extracting features from open-source intelligence (OSINT). However, in the face of explosive growth of vulnerability information, there is room for improvement in the application of past methods to multiple threat intelligence. A more general method is needed to deal with various threat intelligence sources. Moreover, in previous methods, traditional text processing methods were used to deal with vulnerability related descriptions, which only grasped the static statistical characteristics but ignored the context and the meaning of the words of the text. To address these challenges, we propose an exploit prediction model, which is based on a combination of fastText and LightGBM algorithm and called fastEmbed. We replicate key portions of the state-of-the-art work of exploit prediction and use them as benchmark models. Our model outperforms the baseline model whether in terms of the generalization ability or the prediction ability without temporal intermixing with an average overall improvement of 6.283% by learning the embedding of vulnerability-related text on extremely imbalanced data sets. Besides, in terms of predicting the exploits in the wild, our model also outperforms the baseline model with an F1 measure of 0.586 on the minority class (33.577% improvement over the work using features from darkweb/deepweb). The results demonstrate that the model can improve the ability to describe the exploitability of vulnerabilities and predict exploits in the wild effectively., Competing Interests: The authors have declared that no competing interests exist.

Background: Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients., Objective: This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data., Methods: We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees' survey results with their actual clicking data from phishing campaigns., Results: Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees' workload is positively associated with the likelihood of employees clicking on a phishing link., Conclusions: This is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees' workload to increase information security. Our findings can help health care organizations augment employees' compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links., (©Mohammad S S. Jalali, Maike Bruckes, Daniel Westmattelmann, Gerhard Schewe. Originally published in the Journal of Medical Internet Research (http://www.jmir.org), 23.01.2020.)

Optimizing the workflow of a complex organization such as a hospital is a difficult task. An accurate option is to use a real-time locating system to track locations of both patients and staff. However, privacy regulations forbid hospital management to assess location data of their staff members. In this exploratory work, we propose a secure solution to analyze the joined location data of patients and staff, by means of an innovative cryptographic technique called Secure Multi-Party Computation, in which an additional entity that the staff members can trust, such as a labour union, takes care of the staff data. The hospital, owning location data of patients, and the labour union perform a two-party protocol, in which they securely cluster the staff members by means of the frequency of their patient facing times. We describe the secure solution in detail, and evaluate the performance of our proof-of-concept. This work thus demonstrates the feasibility of secure multi-party clustering in this setting.

Objective: To estimate the relationship between breach remediation efforts and hospital care quality., Data Sources: Department of Health and Human Services' (HHS) public database on hospital data breaches and Medicare Compare's public data on hospital quality measures for 2012-2016., Materials and Methods: Data breach data were merged with the Medicare Compare data for years 2012-2016, yielding a panel of 3025 hospitals with 14 297 unique hospital-year observations., Study Design: The relationship between breach remediation and hospital quality was estimated using a difference-in-differences regression. Hospital quality was measured by 30-day acute myocardial infarction mortality rate and time from door to electrocardiogram., Principal Findings: Hospital time-to-electrocardiogram increased as much as 2.7 minutes and 30-day acute myocardial infarction mortality increased as much as 0.36 percentage points during the 3-year window following a breach., Conclusion: Breach remediation efforts were associated with deterioration in timeliness of care and patient outcomes. Thus, breached hospitals and HHS oversight should carefully evaluate remedial security initiatives to achieve better data security without negatively affecting patient outcomes., (© Health Research and Educational Trust.)

We present the work towards strengthening the security of DNA-sequencing functionality of future bioinformatics systems against bio-computing attacks. Recent research has shown how using common tools, a perpetrator can synthesize biological material, which upon DNA-analysis opens a cyber-backdoor for the perpetrator to hijack control of a computational resource from the DNA-sequencing pipeline. As DNA analysis finds its way into practical everyday applications, the threat of bio-hacking increases. Our wetlab experiments establish that malicious DNA can be synthesized and inserted into E. coli, a common contaminant. Based on that, we propose a new attack, where a hacker to reach the target hides the DNA with malicious code on common surfaces (e.g., lab coat, bench, rubber glove). We demonstrated that the threat of bio-hacking can be mitigated using dedicated input control techniques similar to those used to counter conventional injection attacks. This article proposes to use genetic similarity of biological samples to identify material that has been generated for bio-hacking. We considered freely available genetic data from 506 mammary, lymphocyte and erythrocyte samples that have a bio-hacking code inserted. During the evaluation we were able to detect up to 95% of malicious DNAs confirming suitability of our method.

The rapid development of digital health poses a critical challenge to the personal health data protection of patients. The European Union General Data Protection Regulation (EU GDPR) works in this context; it was passed in April 2016 and came into force in May 2018 across the European Union. This study is the first attempt to test the effectiveness of this legal reform for personal health data protection. Using the difference-in-difference (DID) approach, this study empirically examines the policy influence of the GDPR on the financial performance of hospitals across the European Union. Results show that hospitals with the digital health service suffered from financial distress after the GDPR was published in 2016. This reveals that during the transition period (2016⁻2018), hospitals across the European Union indeed made costly adjustments to meet the requirements of personal health data protection introduced by this new regulation, and thus inevitably suffered a policy shock to their financial performance in the short term. The implementation of GDPR may have achieved preliminary success.

Importance: Cybersecurity is an increasingly important threat to health care delivery, and email phishing is a major attack vector against hospital employees., Objective: To describe the practice of phishing simulation and the extent to which health care employees are vulnerable to phishing simulations., Design, Setting, and Participants: Retrospective, multicenter quality improvement study of a convenience sample of 6 geographically dispersed US health care institutions that ran phishing simulations from August 1, 2011, through April 10, 2018. The specific institutions are anonymized herein for security and privacy concerns., Exposures: Simulated phishing emails received by employees at US health care institutions., Main Outcomes and Measures: Date of phishing campaign, campaign number, number of emails sent, number of emails clicked, and email content. Emails were classified into 3 categories (office related, personal, or information technology related)., Results: The final study sample included 6 anonymized US health care institutions, 95 simulated phishing campaigns, and 2 971 945 emails, 422 062 of which were clicked (14.2%). The median institutional click rates for campaigns ranged from 7.4% (interquartile range [IQR], 5.8%-9.6%) to 30.7% (IQR, 25.2%-34.4%), with an overall median click rate of 16.7% (IQR, 8.3%-24.2%) across all campaigns and institutions. In the regression model, repeated phishing campaigns were associated with decreased odds of clicking on a subsequent phishing email (adjusted OR, 0.511; 95% CI, 0.382-0.685 for 6-10 campaigns; adjusted OR, 0.335; 95% CI, 0.282-0.398 for >10 campaigns)., Conclusions and Relevance: Among a sample of US health care institutions that sent phishing simulations, almost 1 in 7 simulated emails sent were clicked on by employees. Increasing campaigns were associated with decreased odds of clicking on a phishing email, suggesting a potential benefit of phishing simulation and awareness. With cyberattacks increasing against US health care systems, these click rates represent a major cybersecurity risk for hospitals.

Objectives: To estimate the relationship between data breaches and hospital advertising expenditures., Study Design: Observational data on hospital expenditures were analyzed using a propensity score-matched regression. The regression was specified as a generalized linear model using a gamma distribution and log link., Methods: The study sample included Medicare hospitals captured by a survey of traditional media outlets. Hospitals included were nonfederal acute care inpatient hospitals from 2011 to 2014. Voicetrak provided data on hospital advertising expenditures. The Healthcare Cost Report Information System provided data on hospital characteristics and financial variables. Study groups were matched using observable characteristics, such as revenue, number of beds, discharges, ownership, and teaching status. The study excluded hospitals in Maryland and the US territories for financial reporting consistency. Data breaches included theft, loss, unauthorized access/disclosure, improper disposal, and hacking. Advertising expenditures were collected from media outlets including television, radio, newspapers and business journals, and local magazines in a city/metropolitan area., Results: Breached hospitals (n = 72) were more likely to be large, teaching, and urban hospitals relative to the control group (unweighted n = 915). A data breach was associated with a 64% (95% CI, 7.2%-252%; P = .023) increase in annual advertising expenditures, holding observable characteristics constant., Conclusions: Breached hospitals were associated with significantly higher advertising expenditures in the 2 years after the breach. Efforts to repair the hospital's image and minimize patient loss to competitors are potential drivers of the increased spending. Advertising costs subsequent to a breach are another cost to the healthcare system that could be avoided with better data security.

A state feedback impulsive model is set up to discuss the spreading and control of the computer worm and virus. Considering the transmission features, saturated infectious is adopted to describe the spreading in the model, and all the treatment measures, such as patching operating system and updating antivirus software, are assumed to take effect instantly. Then the model is analyzed with a novel method, and the existence and stability of order-1 limit cycle are discussed. Finally, the numerical simulation is listed to verify the result of the paper.

Dental students must be skilled in the use and application of information technology (IT), but there are few studies of IT use and knowledge among U.S. dental students. The aim of this study was to retrospectively analyze survey data regarding IT use and knowledge collected from first-year dental students at one U.S. dental school in 2009, 2012, and 2017. Data were collected from an anonymous survey of these students as part of a D1 course called Informatics and Evaluation of Dental Literature. All students participated in the survey each year, for a response rate of 100%. Annual numbers of participants were 80 (2009), 90 (2012), and 97 (2017), for a total 267 respondents. The students reported that they frequently accessed Internet resources multiple times per day and that frequency of use had increased over time, principally from access via smartphones. These students reported feeling comfortable with higher education IT applications such as learning management systems and computerized testing. However, despite their frequent IT use, the students reported low levels of knowledge about IT security, and the three years of survey data showed that IT security knowledge had declined over time. These findings have implications for dental educators, including the need for methods for training students to protect their personal data and that of their patients.

Background and Objectives: Telecare Medicine Information System (TMIS) enables physicians to efficiently and conveniently make certain diagnoses and medical treatment for patients over the insecure public Internet. To ensure patients securely access to medicinal services, many authentication schemes have been proposed. Although numerous cryptographic authentication schemes for TMIS have been proposed with the aim to ensure data security, user privacy and authentication, various forms of attacks make these schemes impractical., Methods: To design a truly secure and practical authentication scheme for TMIS, a new biometrics-based authentication key exchange protocol for multi-server TMIS without sharing the system private key with distributed servers is presented in this work., Results: Our proposed protocol has perfect security features including mutual authentication, user anonymity, perfect forward secrecy and resisting various well-known attacks, and these security feathers are confirmed by the BAN logic and heuristic cryptanalysis, respectively., Conclusions: A secure biometrics-based authentication key exchange protocol for multi-server TMIS is presented in this work, which has perfect security properties including perfect forward secrecy, supporting user anonymity, etc., and can withstand various attacks such as impersonation attack, off-line password guessing attack, etc.. Considering security is the most important factor for an authentication scheme, so our scheme is more suitable for multi-server TMIS., (Copyright © 2018 Elsevier B.V. All rights reserved.)

Frequently, port scans are early indicators of more serious attacks. Unfortunately, the detection of slow port scans in company networks is challenging due to the massive amount of network data. This paper proposes an innovative approach for preprocessing flow-based data which is specifically tailored to the detection of slow port scans. The preprocessing chain generates new objects based on flow-based data aggregated over time windows while taking domain knowledge as well as additional knowledge about the network structure into account. The computed objects are used as input for the further analysis. Based on these objects, we propose two different approaches for detection of slow port scans. One approach is unsupervised and uses sequential hypothesis testing whereas the other approach is supervised and uses classification algorithms. We compare both approaches with existing port scan detection algorithms on the flow-based CIDDS-001 data set. Experiments indicate that the proposed approaches achieve better detection rates and exhibit less false alarms than similar algorithms., Competing Interests: The authors have declared that no competing interests exist.

Protecting personally identifiable information is important in clinical research. The authors, two faculty members involved in developing and implementing research infrastructure for a medical school, observed challenges novice researchers encountered in recognizing, collecting, and managing Protected Health Information (PHI) for clinical research. However, we had difficulty finding resources that provide practical strategies for novice clinical researchers for this topic. Common issues for beginners were: 1. Recognition of PHI, e.g. lack of recognition of 'indirect' PHI, i.e., that the combination of two or more non-PHI data types or other specific information could result in identifiable data requiring protection; 2. Collection of PHI, e.g., proposed collection of data not necessary for fulfillment of the project's objectives or potential inadvertent collection of PHI in free text response items; and 3. Management of PHI, e.g., proposed use of coding systems that directly included PHI, or proposed data collection techniques, electronic data storage, or software with inadequate protections. From these observations, the authors provide the following in this paper: 1. A brief review of the elements of PHI, particularly 'indirect' PHI; 2. Sample data management plans for common project types relevant to novice clinical researchers to ensure planning for data security; 3. Basic techniques for avoiding issues related to the collection of PHI, securing and limiting access to collected PHI, and management of released PHI; and 4. Methods for implementing these techniques in the Research Electronic Data Capture (REDCap) system, a commonly used and readily available research data management software system., (Copyright © 2018 Elsevier Inc. All rights reserved.)

Background and Objective: Advances in information and communication technologies boost the sharing and remote access to medical images. Along with this evolution, needs in terms of data security are also increased. Watermarking can contribute to better protect images by dissimulating into their pixels some security attributes (e.g., digital signature, user identifier). But, to take full advantage of this technology in healthcare, one key problem to address is to ensure that the image distortion induced by the watermarking process does not endanger the image diagnosis value. To overcome this issue, reversible watermarking is one solution. It allows watermark removal with the exact recovery of the image. Unfortunately, reversibility does not mean that imperceptibility constraints are relaxed. Indeed, once the watermark removed, the image is unprotected. It is thus important to ensure the invisibility of reversible watermark in order to ensure a permanent image protection., Methods: We propose a new fragile reversible watermarking scheme for digital radiographic images, the main originality of which stands in masking a reversible watermark into the image quantum noise (the dominant noise in radiographic images). More clearly, in order to ensure the watermark imperceptibility, our scheme differentiates the image black background, where message embedding is conducted into pixel gray values with the well-known histogram shifting (HS) modulation, from the anatomical object, where HS is applied to wavelet detail coefficients, masking the watermark with the image quantum noise. In order to maintain the watermark embedder and reader synchronized in terms of image partitioning and insertion domain, our scheme makes use of different classification processes that are invariant to message embedding., Results: We provide the theoretical performance limits of our scheme into the image quantum noise in terms of image distortion and message size (i.e. capacity). Experiments conducted on more than 800 12 bits radiographic images of different anatomical structures show that our scheme induces a very low image distortion (PSNR∼ 76.5 dB) for a relatively important capacity (capacity∼ 0.02 bits of message per pixel)., Conclusions: The proposed watermarking scheme, while being reversible, preserves the diagnosis value of radiographic images by masking the watermark into the quantum noise. As theoretically and experimentally established our scheme offers a good capacity/image quality compromise that can support different watermarking based security services such as integrity and authenticity control. The watermark can be kept into the image during the interpretation of the image, offering thus a continuous protection. Such a masking strategy can be seen as the first psychovisual model for radiographic images. The reversibility allows the watermark update when necessary., (Copyright © 2018 Elsevier B.V. All rights reserved.)

Due to recent advancements and appealing applications, the purchase rate of smart devices is increasing at a higher rate. Parallely, the security related threats and attacks are also increasing at a greater ratio on these devices. As a result, a considerable number of attacks have been noted in the recent past. To resist these attacks, many password-based authentication schemes are proposed. However, most of these schemes are not screen size independent; whereas, smart devices come in different sizes. Specifically, they are not suitable for miniature smart devices due to the small screen size and/or lack of full sized keyboards. In this paper, we propose a new screen size independent password-based authentication scheme, which also offers an affordable defense against shoulder surfing, brute force, and smudge attacks. In the proposed scheme, the Press Touch (PT)-a.k.a., Force Touch in Apple's MacBook, Apple Watch, ZTE's Axon 7 phone; 3D Touch in iPhone 6 and 7; and so on-is transformed into a new type of code, named Press Touch Code (PTC). We design and implement three variants of it, namely mono-PTC, multi-PTC, and multi-PTC with Grid, on the Android Operating System. An in-lab experiment and a comprehensive survey have been conducted on 105 participants to demonstrate the effectiveness of the proposed scheme.

Introduction: Despite tremendous growth in the number of health applications (apps), little is known about how well these apps protect their users' health-related data. This gap in knowledge is of particular concern for apps targeting people with dementia, whose cognitive impairment puts them at increased risk of privacy breaches. In this article, we determine how many dementia apps have privacy policies and how well they protect user data., Methods: Our analysis included all iPhone apps that matched the search terms "medical + dementia" or "health & fitness + dementia" and collected user-generated content. We evaluated all available privacy policies for these apps based on criteria that systematically measure how individual user data is handled., Results: Seventy-two apps met the above search teams and collected user data. Of these, only 33 (46%) had an available privacy policy. Nineteen of the 33 with policies (58%) were specific to the app in question, and 25 (76%) specified how individual-user as opposed to aggregate data would be handled. Among these, there was a preponderance of missing information, the majority acknowledged collecting individual data for internal purposes, and most admitted to instances in which they would share user data with outside parties., Conclusions: At present, the majority of health apps focused on dementia lack a privacy policy, and those that do exist lack clarity. Bolstering safeguards and improving communication about privacy protections will help facilitate consumer trust in apps, thereby enabling more widespread and meaningful use by people with dementia and those involved in their care., (Copyright © 2017. Published by Elsevier Inc.)

Background: Single patient room design is not yet implemented in German neonatal intensive care units. Surveys from other countries revealed positive and negative implications on the staff, the patients and their families. The survey examines the perceptions of parents who experienced both facilities - the traditional multipatient ward and the individual patient room - during their babies' hospital stays., Methods: A standardized questionnaire was used to assess the perceptions of parents. The results were compared to international surveys., Results: During their stay in the single patient room, parents noticed improvements in privacy and data protection and a reduction in harmful environmental stimuli affecting their babies. These results are comparable to those of international surveys., Conclusions: Single patient room design is mostly perceived as an improvement by parents. The room design can complement an implemented concept of developmental and family-centered care., (© Georg Thieme Verlag KG Stuttgart · New York.)

Sri Lanka is planning to move towards an Electronic Health Record (EHR) system. This research argues that the public preparedness should be considered in order to implement a functioning and an effective EHR system in a country. When asked about how concerned the participants were about the security of their health records, 40.5% stated they were concerned and 38.8% were very concerned. They were asked to rate the 'level of trust' they have on health institutes in Sri Lanka on a scale from 1 to 10 (1 lowest level of trust and 10 highest), 66.1% rated at level 5 or less.

The purpose of this study is to ascertain if patients will accept an electronic patient record system that temporarily conceals their private information. We interviewed 11 outpatients at a core hospital in Shizuoka prefecture of Japan. Most patients agree with our idea using temporary mosaic on the screen to protect their privacy.

Purpose: We examined the role of privacy in collaborative clinical work and how it is understood by hospital IT staff. The purpose of our study was to identify the gaps between hospital IT staff members' perceptions of how electronic health record (EHR) users' protect the privacy of patient information and how users actually protect patients' private information in their daily collaborative activities. Since the IT staff play an important role in implementing and maintaining the EHR, any gaps that exist between the IT staff's perceptions of user work practices and the users' actual work practices can result in a number of problems in the configuration, implementation, or customization of the EHR, which can lead to collaboration challenges, interrupted workflow, and privacy breaches., Methods: We used qualitative data collection methods for this study. We conducted semi-structured interviews with 20 hospital IT staff members. We also conducted observations of EHR users in the in-patient units of the same hospital., Results: We identified gaps in IT staff's understandings of users' work activities, especially in regards to privacy-compromising workarounds that are used by users and why they are used., Discussion: We discuss the reasons why this gap may exist between IT staff and users and ways to improve IT staff's understanding of why users perform certain privacy-compromising workarounds., Conclusion: A hospital's IT staff face a daunting task in ensuring users' collaborative work practices are supported by the system while providing effective privacy mechanisms. In order to achieve both goals, the IT staff must have a clear understanding of their users' practices. However, as this study highlights, there may be a mismatch between the IT staff's understandings of how users protect patient privacy and how users actually protect privacy., (Copyright © 2015. Published by Elsevier Ireland Ltd.)

Health and medical data are increasingly being generated, collected, and stored in electronic form in healthcare facilities and administrative agencies. Such data hold a wealth of information vital to effective health policy development and evaluation, as well as to enhanced clinical care through evidence-based practice and safety and quality monitoring. These initiatives are aimed at improving individuals' health and well-being. Nevertheless, analyses of health data archives must be conducted in such a way that individuals' privacy is not compromised. One important aspect of protecting individuals' privacy is protecting the confidentiality of their data. It is the purpose of this paper to provide a review of a number of approaches to reducing disclosure risk when making data available for research, and to present a taxonomy for such approaches. Some of these methods are widely used, whereas others are still in development. It is important to have a range of methods available because there is also a range of data-use scenarios, and it is important to be able to choose between methods suited to differing scenarios. In practice, it is necessary to find a balance between allowing the use of health and medical data for research and protecting confidentiality. This balance is often presented as a trade-off between disclosure risk and data utility, because methods that reduce disclosure risk, in general, also reduce data utility., (Copyright © 2015 John Wiley & Sons, Ltd.)