Threats to Information Security - Public Health Implications

Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US

Importance

Cyberattacks on health care delivery organizations are increasing in frequency and sophistication. Ransomware infections have been associated with significant operational disruption, but data describing regional associations of these cyberattacks with neighboring hospitals have not been previously reported, to our knowledge.

Objective

To examine an institution's emergency department (ED) patient volume and stroke care metrics during a month-long ransomware attack on a geographically proximal but separate health care delivery organization.

Design, Setting, and Participants

This before and after cohort study compares adult and pediatric patient volume and stroke care metrics of 2 US urban academic EDs in the 4 weeks prior to the ransomware attack on May 1, 2021 (April 3-30, 2021), as well as during the attack and recovery (May 1-28, 2021) and 4 weeks after the attack and recovery (May 29 to June 25, 2021). The 2 EDs had a combined mean annual census of more than 70 000 care encounters and 11% of San Diego County's total acute inpatient discharges. The health care delivery organization targeted by the ransomware constitutes approximately 25% of the regional inpatient discharges.

Exposure

A month-long ransomware cyberattack on 4 adjacent hospitals.

Main Outcomes and Measures

Emergency department encounter volumes (census), temporal throughput, regional diversion of emergency medical services (EMS), and stroke care metrics.

Results

This study evaluated 19 857 ED visits at the unaffected ED: 6114 (mean [SD] age, 49.6 [19.3] years; 2931 [47.9%] female patients; 1663 [27.2%] Hispanic, 677 [11.1%] non-Hispanic Black, and 2678 [43.8%] non-Hispanic White patients) in the preattack phase, 7039 (mean [SD] age, 49.8 [19.5] years; 3377 [48.0%] female patients; 1840 [26.1%] Hispanic, 778 [11.1%] non-Hispanic Black, and 3168 [45.0%] non-Hispanic White patients) in the attack and recovery phase, and 6704 (mean [SD] age, 48.8 [19.6] years; 3326 [49.5%] female patients; 1753 [26.1%] Hispanic, 725 [10.8%] non-Hispanic Black, and 3012 [44.9%] non-Hispanic White patients) in the postattack phase. Compared with the preattack phase, during the attack phase, there were significant associated increases in the daily mean (SD) ED census (218.4 [18.9] vs 251.4 [35.2]; P < .001), EMS arrivals (1741 [28.8] vs 2354 [33.7]; P < .001), admissions (1614 [26.4] vs 1722 [24.5]; P = .01), patients leaving without being seen (158 [2.6] vs 360 [5.1]; P < .001), and patients leaving against medical advice (107 [1.8] vs 161 [2.3]; P = .03). There were also significant associated increases during the attack phase compared with the preattack phase in median waiting room times (21 minutes [IQR, 7-62 minutes] vs 31 minutes [IQR, 9-89 minutes]; P < .001) and total ED length of stay for admitted patients (614 minutes [IQR, 424-1093 minutes] vs 822 minutes [IQR, 497-1524 minutes]; P < .001). There was also a significant increase in stroke code activations during the attack phase compared with the preattack phase (59 vs 102; P = .01) as well as confirmed strokes (22 vs 47; P = .02).

Conclusions and Relevance

This study found that hospitals adjacent to health care delivery organizations affected by ransomware attacks may see increases in patient census and may experience resource constraints affecting time-sensitive care for conditions such as acute stroke. These findings suggest that targeted hospital cyberattacks may be associated with disruptions of health care delivery at nontargeted hospitals within a community and should be considered a regional disaster.

Cybersecurity and Information Assurance for the Clinical Laboratory

BACKGROUND

Network-connected medical devices have rapidly proliferated in the wake of recent global catalysts, leaving clinical laboratories and healthcare organizations vulnerable to malicious actors seeking to ransom sensitive healthcare information. As organizations become increasingly dependent on integrated systems and data-driven patient care operations, a sudden cyberattack and the associated downtime can have a devastating impact on patient care and the institution as a whole. Cybersecurity, information security, and information assurance principles are, therefore, vital for clinical laboratories to fully prepare for what has now become inevitable, future cyberattacks.

CONTENT

This review aims to provide a basic understanding of cybersecurity, information security, and information assurance principles as they relate to healthcare and the clinical laboratories. Common cybersecurity risks and threats are defined in addition to current proactive and reactive cybersecurity controls. Information assurance strategies are reviewed, including traditional castle-and-moat and zero-trust security models. Finally, ways in which clinical laboratories can prepare for an eventual cyberattack with extended downtime are discussed.

SUMMARY

The future of healthcare is intimately tied to technology, interoperability, and data to deliver the highest quality of patient care. Understanding cybersecurity and information assurance is just the first preparative step for clinical laboratories as they ensure the protection of patient data and the continuity of their operations.

Awareness of, attitudes towards, and practices of health information management professionals in South Korea relating to privacy of personal health information

Background: While information and communication technology has continued to advance, privacy of personal health information (PHI) has remained a challenge for health information management (HIM) professionals. Objective: This study aims to examine the awareness, attitude and practice relating to PHI privacy among HIM professionals in South Korea. Method: A survey questionnaire was developed for the study based on critical appraisal of relevant literature and expert consensus. It was completed by a sample of 312 respondents who were members of the Korean Health Information Management Association, over the age of 21, and worked in a healthcare organisation. Demographic data and questionnaire items (assessed on a 5-point Likert-type scale) were analysed using descriptive statistics, t-tests and ANOVA. Results: Mean scores and SDs for awareness, attitude and practice related to PHI privacy were calculated: 4.21 (0.60) for awareness, 4.17 (0.60) for attitude and 4.31 (0.63) for practice. Significant positive correlations were found between awareness and attitude scores (r = 0.765, p < 0.01); awareness and practice scores (r = 0.585; p < 0.01); and attitude and action scores (r = 0.672; p < 0.01). HIM professionals' awareness, attitude, and practice towards PHI privacy differed significantly according to age, level of education, years of HIM experience, type of employment, main task, number of completed privacy education activities within the previous 3 years and whether or not they had signed a pledge of confidentiality on PHI. More highly-educated, full-time employed respondents, those who had completed a greater number of privacy education activities and had more experience as HIM professionals, achieved higher scores on awareness, attitude and practice than did other respondents. These differences were all statistically significant (p < 0.01). Conclusion: Although causality cannot be inferred from results of this study, findings suggest that there is a relationship between PHI being a core responsibility of HIM professionals and their subsequent awareness, attitude and practice to ensure its privacy and confidentiality. To improve privacy practice, educational efforts should be prioritised and supported at all levels, including national, organisational, individual, and by professional HIM associations.

Effectiveness of Email Warning on Reducing Hospital Employees' Unauthorized Access to Protected Health Information: A Nonrandomized Controlled Trial

This nonrandomized controlled trial evaluates whether email warnings for employees who access protected health information are associated with a reduction in subsequent unauthorized access.

A scoping review of internal hospital crises and disasters in the Netherlands, 2000-2020

BACKGROUND

Internal hospital crises and disasters (IHCDs) are events that disrupt the routine functioning of a hospital while threatening the well-being of patients and staff. IHCDs may cause hospital closure, evacuations of patients and loss of healthcare capacity. The consequences may be ruinous for local communities. Although IHCDs occur with regularity, information on the frequency and types of these events is scarcely published in the medical literature. However, gray literature and popular media reports are widely available. We therefore conducted a scoping review of these literature sources to identify and characterize the IHCDs that occurred in Dutch hospitals from 2000 to 2020. The aim is to develop a systematic understanding of the frequency of the various types of IHCDs occurring in a prosperous nation such as the Netherlands.

METHODS

A systematic scoping review of news articles retrieved from the LexisNexis database, Google, Google News, PubMed and EMBASE between 2000 and 2020. All articles mentioning the closure of a hospital department in the Netherlands were analyzed.

RESULTS

A total of 134 IHCDs were identified in a 20-year time period. Of these IHCDs, there were 96 (71.6%) emergency department closures, 76 (56.7%) operation room closures, 56 (41.8%) evacuations, 26 (17.9%) reports of injured persons, and 2 (1.5%) reported casualties. Cascading events of multiple failures transpired in 39 (29.1%) IHCDs. The primary causes of IHCDs (as reported) were information and communication technology (ICT) failures, technical failures, fires, power failures, and hazardous material warnings. An average of 6.7 IHCDs occurred per year. From 2000-2009 there were 32 IHCDs, of which one concerned a primary ICT failure. Of the 102 IHCDs between 2010-2019, 32 were primary ICT failures.

CONCLUSIONS

IHCDs occur with some regularity in the Netherlands and have marked effects on hospital critical care departments, particularly emergency departments. Cascading events of multiple failures transpire nearly a third of the time, limiting the ability of a hospital to stave off closure due to failure. Emergency managers should therefore prioritize the risk of ICT failures and cascading events and train hospital staff accordingly.

Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review

BACKGROUND

COVID-19 has challenged the resilience of the health care information system, which has affected our ability to achieve the global goal of health and well-being. The pandemic has resulted in a number of recent cyberattacks on hospitals, pharmaceutical companies, the US Department of Health and Human Services, the World Health Organization and its partners, and others.

OBJECTIVE

The aim of this review was to identify key cybersecurity challenges, solutions adapted by the health sector, and areas of improvement needed to counteract the recent increases in cyberattacks (eg, phishing campaigns and ransomware attacks), which have been used by attackers to exploit vulnerabilities in technology and people introduced through changes to working practices in response to the COVID-19 pandemic.

METHODS

A scoping review was conducted by searching two major scientific databases (PubMed and Scopus) using the search formula "(covid OR healthcare) AND cybersecurity." Reports, news articles, and industry white papers were also included if they were related directly to previously published works, or if they were the only available sources at the time of writing. Only articles in English published in the last decade were included (ie, 2011-2020) in order to focus on current issues, challenges, and solutions.

RESULTS

We identified 9 main challenges in cybersecurity, 11 key solutions that health care organizations adapted to address these challenges, and 4 key areas that need to be strengthened in terms of cybersecurity capacity in the health sector. We also found that the most prominent and significant methods of cyberattacks that occurred during the pandemic were related to phishing, ransomware, distributed denial-of-service attacks, and malware.

CONCLUSIONS

This scoping review identified the most impactful methods of cyberattacks that targeted the health sector during the COVID-19 pandemic, as well as the challenges in cybersecurity, solutions, and areas in need of improvement. We provided useful insights to the health sector on cybersecurity issues during the COVID-19 pandemic as well as other epidemics or pandemics that may materialize in the future.

Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system

OBJECTIVE

The study sought to understand the impact of a phishing training program on phishing click rates for employees at a single, anonymous US healthcare institution.

MATERIALS AND METHODS

We stratified our population into 2 groups: offenders and nonoffenders. Offenders were defined as those that had clicked on at least 5 simulated phishing emails and nonoffenders were those that had not. We calculated click rates for offenders and nonoffenders, before and after a mandatory training program for offenders was implemented.

RESULTS

A total of 5416 unique employees received all 20 campaigns during the intervention period; 772 clicked on at least 5 emails and were labeled offenders. Only 975 (17.9%) of our set clicked on 0 phishing emails over the course of the 20 campaigns; 3565 (65.3%) clicked on at least 2 emails. There was a decrease in click rates for each group over the 20 campaigns. The mandatory training program, initiated after campaign 15, did not have a substantial impact on click rates, and the offenders remained more likely to click on a phishing simulation.

DISCUSSION

Phishing is a common threat vector against hospital employees and an important cybersecurity risk to healthcare systems. Our work suggests that, under simulation, employee click rates decrease with repeated simulation, but a mandatory training program targeted at high-risk employees did not meaningfully decrease the click rates of this population.

CONCLUSIONS

Employee phishing click rates decrease over time, but a mandatory training program for the highest-risk employees did not decrease click rates when compared with lower-risk employees.

Cybersecurity features of digital medical devices: an analysis of FDA product summaries

OBJECTIVES

To more clearly define the landscape of digital medical devices subject to US Food and Drug Administration (FDA) oversight, this analysis leverages publicly available regulatory documents to characterise the prevalence and trends of software and cybersecurity features in regulated medical devices.

DESIGN

We analysed data from publicly available FDA product summaries to understand the frequency and recent time trends of inclusion of software and cybersecurity content in publicly available product information.

SETTING

The full set of regulated medical devices, approved over the years 2002-2016 included in the FDA's 510(k) and premarket approval databases.

PRIMARY AND SECONDARY OUTCOME MEASURES

The primary outcome was the share of devices containing software that included cybersecurity content in their product summaries. Secondary outcomes were differences in these shares (a) over time and (b) across regulatory areas.

RESULTS

Among regulated devices, 13.79% were identified as including software. Among these products, only 2.13% had product summaries that included cybersecurity content over the period studied. The overall share of devices including cybersecurity content was higher in recent years, growing from an average of 1.4% in the first decade of our sample to 5.5% in 2015 and 2016, the most recent years included. The share of devices including cybersecurity content also varied across regulatory areas from a low of 0% to a high of 22.2%.

CONCLUSIONS

To ensure the safest possible healthcare delivery environment for patients and hospitals, regulators and manufacturers should work together to make the software and cybersecurity content of new medical devices more easily accessible.

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions

IMPORTANCE

Cybersecurity is an increasingly important threat to health care delivery, and email phishing is a major attack vector against hospital employees.

OBJECTIVE

To describe the practice of phishing simulation and the extent to which health care employees are vulnerable to phishing simulations.

DESIGN, SETTING, AND PARTICIPANTS

Retrospective, multicenter quality improvement study of a convenience sample of 6 geographically dispersed US health care institutions that ran phishing simulations from August 1, 2011, through April 10, 2018. The specific institutions are anonymized herein for security and privacy concerns.

EXPOSURES

Simulated phishing emails received by employees at US health care institutions.

MAIN OUTCOMES AND MEASURES

Date of phishing campaign, campaign number, number of emails sent, number of emails clicked, and email content. Emails were classified into 3 categories (office related, personal, or information technology related).

RESULTS

The final study sample included 6 anonymized US health care institutions, 95 simulated phishing campaigns, and 2 971 945 emails, 422 062 of which were clicked (14.2%). The median institutional click rates for campaigns ranged from 7.4% (interquartile range [IQR], 5.8%-9.6%) to 30.7% (IQR, 25.2%-34.4%), with an overall median click rate of 16.7% (IQR, 8.3%-24.2%) across all campaigns and institutions. In the regression model, repeated phishing campaigns were associated with decreased odds of clicking on a subsequent phishing email (adjusted OR, 0.511; 95% CI, 0.382-0.685 for 6-10 campaigns; adjusted OR, 0.335; 95% CI, 0.282-0.398 for >10 campaigns).

CONCLUSIONS AND RELEVANCE

Among a sample of US health care institutions that sent phishing simulations, almost 1 in 7 simulated emails sent were clicked on by employees. Increasing campaigns were associated with decreased odds of clicking on a phishing email, suggesting a potential benefit of phishing simulation and awareness. With cyberattacks increasing against US health care systems, these click rates represent a major cybersecurity risk for hospitals.

Health Care and Cybersecurity: Bibliometric Analysis of the Literature

Background

Over the past decade, clinical care has become globally dependent on information technology. The cybersecurity of health care information systems is now an essential component of safe, reliable, and effective health care delivery.

Objective

The objective of this study was to provide an overview of the literature at the intersection of cybersecurity and health care delivery.

Methods

A comprehensive search was conducted using PubMed and Web of Science for English-language peer-reviewed articles. We carried out chronological analysis, domain clustering analysis, and text analysis of the included articles to generate a high-level concept map composed of specific words and the connections between them.

Results

Our final sample included 472 English-language journal articles. Our review results revealed that majority of the articles were focused on technology: Technology–focused articles made up more than half of all the clusters, whereas managerial articles accounted for only 32% of all clusters. This finding suggests that nontechnological variables (human–based and organizational aspects, strategy, and management) may be understudied. In addition, Software Development Security, Business Continuity, and Disaster Recovery Planning each accounted for 3% of the studied articles. Our results also showed that publications on Physical Security account for only 1% of the literature, and research in this area is lacking. Cyber vulnerabilities are not all digital; many physical threats contribute to breaches and potentially affect the physical safety of patients.

Conclusions

Our results revealed an overall increase in research on cybersecurity and identified major gaps and opportunities for future work.

Evaluation of Causes of Protected Health Information Breaches

This study evaluates the internal and external sources of and preventive steps for data breaches in health care organizations from 2009 to 2017.

"A Tool, Not a Crutch": Patient Perspectives About IBM Watson for Oncology Trained by Memorial Sloan Kettering

PURPOSE

IBM Watson for Oncology trained by Memorial Sloan Kettering (WFO) is a clinical decision support tool designed to assist physicians in choosing therapies for patients with cancer. Although substantial technical and clinical expertise has guided the development of WFO, patients' perspectives of this technology have not been examined. To facilitate the optimal delivery and implementation of this tool, we solicited patients' perceptions and preferences about WFO.

METHODS

We conducted nine focus groups with 46 patients with breast, lung, or colorectal cancer with various treatment experiences: neoadjuvant/adjuvant chemotherapy, chemotherapy for metastatic disease, or systemic therapy through a clinical trial. In-depth qualitative and quantitative data were collected and analyzed to describe patients' attitudes and perspectives concerning WFO and how it may be used in clinical care.

RESULTS

Analysis of the qualitative data identified three main themes: patient acceptance of WFO, physician competence and the physician-patient relationship, and practical and logistic aspects of WFO. Overall, participant feedback suggested high levels of patient interest, perceived value, and acceptance of WFO, as long as it was used as a supplementary tool to inform their physicians' decision making. Participants also described important concerns, including the need for strict processes to guarantee the integrity and completeness of the data presented and the possibility of physician overreliance on WFO.

CONCLUSION

Participants generally reacted favorably to the prospect of WFO being integrated into the cancer treatment decision-making process, but with caveats regarding the comprehensiveness and accuracy of the data powering the system and the potential for giving WFO excessive emphasis in the decision-making process. Addressing patients' perspectives will be critical to ensuring the smooth integration of WFO into cancer care.

EARS to cyber incidents in health care

Background

Connected medical devices and electronic health records have added important functionality to patient care, but have also introduced a range of cybersecurity concerns. When a healthcare organization suffers from a cybersecurity incident, its incident response strategies are critical to the success of its recovery.

Objective

In this article, we identify gaps in research concerning cybersecurity response plans in healthcare. Through a systematic literature review, we develop aggregated strategies that professionals can use to construct better response strategies in their organizations.

Methods

We reviewed journal articles on cyber incident response plans in healthcare published in PubMed and Web of Science. We sought to collect articles on the intersection of cybersecurity and healthcare that focused on incident response strategies.

Results

We identified and reviewed 13 articles for cybersecurity response recommendations. We then extracted information such as research methods, findings, and implications. Finally, we synthesized the recommendations into a framework of eight aggregated response strategies (EARS) that fall under managerial and technological categories.

Conclusions

We conducted a systematic review of the literature on cybersecurity response plans in healthcare and developed a novel framework for response strategies that could be deployed by healthcare organizations. More work is needed to evaluate incident response strategies in healthcare.

The Safe and Effective Use of Shared Data Underpinned by Stakeholder Engagement and Evaluation Practice

Objectives:  The paper draws attention to: i) key considerations involving the confidentiality, privacy, and security of shared data; and ii) the requirements needed to build collaborative arrangements encompassing all stakeholders with the goal of ensuring safe, secure, and quality use of shared data.

Method:  A narrative review of existing research and policy approaches along with expert perspectives drawn from the International Medical Informatics Association (IMIA) Working Group on Technology Assessment and Quality Development in Health Care and the European Federation for Medical Informatics (EFMI) Working Group for Assessment of Health Information Systems.

Results:  The technological ability to merge, link, re-use, and exchange data has outpaced the establishment of policies, procedures, and processes to monitor the ethics and legality of shared use of data. Questions remain about how to guarantee the security of shared data, and how to establish and maintain public trust across large-scale shared data enterprises. This paper identifies the importance of data governance frameworks (incorporating engagement with all stakeholders) to underpin the management of the ethics and legality of shared data use. The paper also provides some key considerations for the establishment of national approaches and measures to monitor compliance with best practice.

Conclusion:  Data sharing endeavours can help to underpin new collaborative models of health care which provide shared information, engagement, and accountability amongst all stakeholders. We believe that commitment to rigorous evaluation and stakeholder engagement will be critical to delivering health data benefits and the establishment of collaborative models of health care into the future.