Development of Rapid Response Plan for Radiation Oncology in Response to Cyberattack

Readiness for Radiation Treatment Continuity: Survey on Contingency Plans Against Cyberattacks

Purpose

Cyberattacks on health care systems have been on the rise over the past 5 years. Formulation and implementation of a robust postattack business continuity plan and/or contingency plan (CP) is essential for minimal disruption to patient care. The level of awareness and planning within the radiation oncology community for cyberattacks is not clear. This study was undertaken to survey and assess cyberattack CP awareness and preparedness.

Methods and Materials

A survey instrument comprising 5 questions on awareness and preparedness of cyberattack CPs was e-mailed to 150 radiation oncology departments. Recipients included 105 institutions with residency programs in therapeutic medical physics, as listed by the Commission on Accreditation of Medical Physics Education Program (usually either school-based or large institutional settings), and 45 additional smaller settings within the United States, representing community practices.

Results

Forty-three responses were deemed evaluable for analysis. Forty-two percent (18 respondents) of respondents responded that they are well-aware of the concept of a cyberattack CP. A large discrepancy in awareness exists between larger hospitals (LH) that have 5 or more treatment machines and smaller hospitals (SH) that have 4 or fewer, 54% versus 24 % (P < .05). Fifty-eight percent of respondents considered it “essential” to have such a plan in place, and 28% considered it “desirable” to do so but not practical. Nine percent regarded a cyberattack CP as unnecessary. No significant differences in responses were noted among different types or sizes of institutions on this issue. Sixty-two percent of LH responded that they were either preparing or evaluating a CP, compared with only 29% of SH (P = .03). However, no respondents explicitly replied that they already had a CP in place in their practices.

Conclusions

The importance of cyberattack preparedness and implementation does not seem to be well-recognized in radiation oncology. Both the awareness and the preparedness of SH are substantially less than those of LH. Specific and ongoing education efforts in parallel with development of appropriate programs are needed to counter the increasingly pervasive and complex threat of cyberattacks.

Anatomy of a Cyberattack: Part 2: Managing a Clinical Pathology Laboratory During 25 Days of Downtime

OBJECTIVES

Our academic health care institution was the victim of a cyberattack that led to a complete shutdown of major patient care, operational, and communication systems, including our electronic health record (EHR), laboratory information system, pharmacy, scheduling, billing and coding, imaging software, internet, hospital shared computer drives, payroll, and digital communications. The EHR remained down for 25 days, significantly affecting our clinical pathology (CP) laboratory operations.

METHODS

During the downtime, our CP laboratory incorporated manual interventions for patient specimen testing, recruited additional staff for reporting results, and employed multiple communication modalities to support patient care. The crisis required a swift response, employing innovative approaches to mitigate patient harm; regular, multidisciplinary engagement; and consistent, broad-reaching communications. CP leadership worked with hospital administration, staff, and our referral clients to provide the timely laboratory results needed for acute patient care.

RESULTS

During this downtime, the laboratory lacked accurate information about the number of patient samples diverted to other laboratories, the number of specimens processed, and the number of test results reported.

CONCLUSIONS

This paper focuses on the approaches the CP division took to develop and maintain downtime operations. Laboratories should consider these strategies in preparation for a prolonged downtime.

Anatomy of a Cyberattack: Part 4: Quality Assurance and Error Reduction, Billing and Compliance, Transition to Uptime

OBJECTIVES

Our institution was the victim of a cyberattack that necessitated use of manual laboratory systems for more than 25 days. These manual processes had to be created not only to enable us to process our case volume without bottlenecks but also to maintain patient safety and allow for billing.

METHODS

Our laboratory needed to create a safe reporting process to ensure ongoing patient safety and error reduction during the downtime. Additionally, we needed to ensure the ability to bill for performed tests in some areas of the lab and maintain compliance with regulatory policies.

RESULTS

Amendment rates in our system were higher than before the attack, but no patient harm was observed. Intraoperative assessments declined, but high-acuity cases continued with a discrepancy rate comparable with the normal state. Many hours and resources (human and otherwise) were necessary to reconcile the work done to bill for services, but we were able to capture revenue through careful planning.

CONCLUSIONS

This article records the challenges we faced and the successes we achieved in maintaining compliance and a low error rate in the face of manual processes, the steps necessary to bring the cases into the newly restored electronic health record, and how we billed for the services we rendered.

Emerging Cybersecurity Threats in Radiation Oncology

Purpose

Modern image guided radiation therapy is dependent on information technology and data storage applications that, like any other digital technology, are at risk from cyberattacks. Owing to a recent escalation in cyberattacks affecting radiation therapy treatments, the American Society for Radiation Oncology's Advances in Radiation Oncology is inaugurating a new special manuscript category devoted to cybersecurity issues.

Methods and Materials

We conducted a review of emerging cybersecurity threats and a literature review of cyberattacks that affected radiation oncology practices.

Results

In the last 10 years, numerous attacks have led to an interruption of radiation therapy for thousands of patients, and some of these catastrophic incidents have been described as being worse than the coronavirus disease of 2019 impact on centers in New Zealand.

Conclusions

Cybersecurity threats continue to evolve, making combatting these attacks more difficult for health care organizations and requiring a change in strategies, tactics, and culture around cyber security in health and radiation oncology. We recommend an assume breach mentality (threat-informed defense posture) and adopting a cloud-first and zero-trust security strategy. A reliance on computer-driven technology makes radiation oncology practices more vulnerable to cyberattacks. Health care providers should increase their resilience and cyber security maturity. The increase in the diversity of these attacks demands improved preparedness and collaboration between oncologic treatment centers both nationwide and internationally to protect patients.