Search

Objective: Cyberattacks on healthcare systems are increasing in frequency and severity. Hospitals need to integrate cybersecurity preparedness into their emergency operations planning and response to mitigate adverse outcomes during increasingly likely cyber events. No data currently exist regarding the level of preparedness of United States hospital systems for cybersecurity attacks. We surveyed hospital emergency managers to assess cybersecurity preparedness for these events. Methods: Fifty-seven emergency managers representing hospitals across the United States participated in an online Qualtrics survey regarding current preparedness and response procedures for cybersecurity hazards. Results: Survey responses between April 2019 and May 2021 demonstrated that a majority of hospital systems surveyed included cybersecurity disasters in their HVA (82.4%; 47/57), and most ranked it as 1 of their top 5 priorities (57.4%; 27/47). However, over half denied specifically mentioning cybersecurity in their Emergency Operations Plans (EOPs; 52.6%; 30/57). Fourteen of the 57 hospital systems (24.5%) endorsed previously activating an emergency response for a cybersecurity incident unrelated to information technology (IT) failure. Conclusions: The survey results suggest that American hospitals are currently underprepared for cybersecurity disasters. We emphasize the importance of prioritizing cybersecurity in Hazard Vulnerability Analyses (HVAs) and implementing specific EOP annexes for cybersecurity emergencies.

As a result of the extensive integration of technology into the healthcare system, cybersecurity incidents have become an increasing challenge for the healthcare industry. Recent examples include WannaCry, a nontargeted ransomware attack on more than 150 countries worldwide that temporarily crippled parts of the National Health Service in the United Kingdom, and the 2016 ransomware attack on Los Angeles's Hollywood Presbyterian Medical Center. The attacks cost millions of dollars in lost revenue and fines, as well as significant reputational damage. Efforts are needed to devise tools that allow experts to more accurately quantify the actual impact of such events on both individual patients and healthcare systems as a whole. While the United States has robust disaster preparedness and response systems integrated throughout the healthcare and government sectors, the rapidly evolving cybersecurity threat against healthcare entities is outpacing existing countermeasures and challenges in the "all-hazards" disaster preparedness paradigm. Further epidemiologic research of clinical cybersecurity attacks and their effects on patient care and clinical outcomes is necessary to prevent and mitigate future attacks.

UNSTRUCTURED The practice of medicine has become increasingly dependent on connected medical technology and nearly every clinical environment requires physicians to be proficient in using computerized workflows for patient care. Cyberattacks affecting healthcare delivery organizations (HDOs) have evolved in frequency, sophistication, and scale. These attacks often involve the theft of protected health information (PHI) and disrupt the function and availability of critical resources such as diagnostic technologies, therapeutic devices, and electronic health records (EHRs). This review aims to describe cybersecurity threats as they impact the delivery of patient care by affecting the operational, financial, and clinical systems of HDOs and associated entities. It will highlight the challenges that remain in developing a database of evidence focused on classifying and comparing cybersecurity attacks by clinical relevance and effect on patient outcomes. Attackers have focused on health care as a key sector of critical infrastructure because the opportunity for financial gain has been reliably demonstrated. That cyberattacks have continued, and in many cases been precisely targeted to affect hospitals during the COVID-19 pandemic, demonstrates the persistent and malicious nature of cybersecurity challenges. The existing literature has discussed the theoretical clinical implications of vulnerabilities discovered in connected medical devices including insulin pumps and pacemakers, and media reports have prominently featured coverage of HDOs affected by cyberattacks. Yet there remains a paucity of data describing such events that can be used to quantitatively characterize effects on patient outcomes. The complex interplay of varying regulatory oversights, embryonic surveillance mechanisms, and organization-specific policies have made obtaining the data needed for formal epidemiological studies difficult. Despite these challenges, multiple United States government agencies, healthcare delivery organization industry groups, and healthcare advocacy groups have recognized cybersecurity threats as a key safety and operational concern worthy of expanded study and dedicated resources.

On September 1, 2019, Hurricane Dorian made landfall as a category 5 hurricane on Great Abaco Island, Bahamas. Hurricane Dorian matched the “Labor Day” hurricane of 1935 as the strongest recorded Atlantic hurricane to make landfall with maximum sustained winds of 185 miles/h.1 At the request of the Government of the Bahamas, Team Rubicon activated a World Health Organization Type 1 Mobile Emergency Medical Team and responded to Great Abaco Island. The team provided medical care and reconnaissance of medical clinics on the island and surrounding cays…

Background Cybersecurity risks in health care systems have traditionally been measured in data breaches of protected health information, but compromised medical devices and critical medical infrastructure present risks of disruptions to patient care. The ubiquitous prevalence of connected medical devices and systems may be associated with an increase in these risks. Objective This article details the development and execution of three novel high-fidelity clinical simulations designed to teach clinicians to recognize, treat, and prevent patient harm from vulnerable medical devices. Methods Clinical simulations were developed that incorporated patient-care scenarios featuring hacked medical devices based on previously researched security vulnerabilities. Results Clinicians did not recognize the etiology of simulated patient pathology as being the result of a compromised device. Conclusions Simulation can be a useful tool in educating clinicians in this new, critically important patient-safety space.

Not only did COVID-19 give rise to a global pandemic, but also it resulted in an infodemic comprising misinformation, rumor, and propaganda. The consequences of this infodemic can erode public trust, impede the containment of the virus, and outlive the pandemic itself. The evolving and fragmented media landscape, particularly the extensive use of social media, is a crucial driver of the spread of misinformation. Focusing on the Chinese social media Weibo, we collected four million tweets, from December 9, 2019, to April 4, 2020, examining misinformation identified by the fact-checking platform Tencent–a leading Chinese tech giant. Our results show that the evolution of misinformation follows an issue-attention cycle pertaining to topics such as city lockdown, cures and preventive measures, school reopening, and foreign countries. Sensational and emotionally reassuring misinformation characterizes the whole issue-attention cycle, with misinformation on cures and prevention flooding social media. We also study the evolution of sentiment and observe that positive sentiment dominated over the course of Covid, which may be due to the unique characteristic of “positive energy” on Chinese social media. Lastly, we study the media landscape during Covid via a case study on a controversial unproven cure known as Shuanghuanglian, which testifies to the importance of scientific communication in a plague. Our findings shed light on the distinct characteristics of misinformation and its cultural, social, and political implications, during the COVID-19 pandemic. The study also offers insights into combating misinformation in China and across the world at large.

BACKGROUND Cybersecurity risks in healthcare systems have traditionally been measured in data breaches of protected health information but compromised medical devices and critical medical infrastructure raises questions about the risks of disrupted patient care. The increasing prevalence of these connected medical devices and systems implies that these risks are growing. OBJECTIVE This paper details the development and execution of three novel high fidelity clinical simulations designed to teach clinicians to recognize, treat, and prevent patient harm from vulnerable medical devices. METHODS Clinical simulations were developed which incorporated patient care scenarios with hacked medical devices based on previously researched security vulnerabilities. RESULTS Clinician participants universally failed to recognize the etiology of their patient’s pathology as being the result of a compromised device. CONCLUSIONS Simulation can be a useful tool in educating clinicians in this new, critically important patient safety space.