I (John Riggi) recently moderated a webinar discussion as session three of the American Hospital Association’s Convening Leaders for Emergency and Response (CLEAR) Crisis Leadership Series. CLEAR’s purpose is to strengthen health care organizations’ ability to prepare for, respond to and recover from future emergencies and disasters — in the case of this webinar, cyberattacks on hospitals and health systems, and in particular, ransomware attacks.

Potential Impacts of Ransomware and Other Cyberattacks

Ransomware attacks have increased in recent years due to health care’s reliance on network and internet-connected technology. They often result in the disruption and delay of health care delivery, resulting in a risk to patient safety and outcomes. For instance, ambulances must often divert stroke or trauma patients to distant emergency departments, negatively affecting patient outcomes and creating a regional stress on care delivery.

As a real-life example, Stephen Leffler, MD, President and COO at University of Vermont Medical Center, described the clinical impact of a cyberattack on his hospital, after an employee downloaded their home email on their work computer:

  • The medical center’s electronic health record system went down for 28 days.
  • Its regional lab could not get lab results back to other hospitals in its network or across the state.
  • Its radiology system went down for six weeks.

Such a cyberattack can also result in compromised medical records, data theft, identity theft, fraud and financial repercussions.

Three other health care leaders joined the conversation with Dr. Leffler and me:

  • Brian Gragnolati, President & CEO, Atlantic Health System
  • Mark Sullivan, President & CEO, Catholic Health
  • Christian Dameff, M.D., Asst. Professor of Emergency Medicine, Biomedical Informatics & Computer Science and Medical Director of Cybersecurity, University of California San Diego Health

What can your hospital or health system do to proactively prepare for a cyberattack with plans to maintain both business continuity and, more importantly, clinical continuity?

4 Keys to Effectively Preparing for a Cyberattack

  1. Collaborate. Collaboration is key to creating emergency response plans for cyber incidents.
    • Within your organization, take a multidisciplinary approach — involve not just IT teams, but all leadership across your organization as well as clinical staff, emergency managers and other stakeholders.
    • To mitigate the effects of a cyberattack across your region, engage with your local community and coordinate with other health care organizations and relevant stakeholders. That includes establishing prearranged channels of communication for sharing information.
  2. Expect cyberattacks to occur and plan for longer recovery periods, as attacks can last for several weeks.
    • Prioritize cybersecurity investments and consider the long-term effectiveness and reliability of technology solutions.
    • Educate and train staff; conduct phishing exercises; and have robust incident response, disaster recovery and business continuity plans in place.
    • Integrate cyber incident response planning with emergency response planning.
    • Also develop department-specific cyber disaster plans to help identify high-risk patients and ensure continuity of care during an attack.
    • Work closely with staff throughout all efforts to refine processes and gather feedback.
  3. Build an evidence base of best cybersecurity practices.
    • Invest in research to evaluate the effectiveness of cybersecurity interventions.
    • Share findings to elevate cybersecurity in the entire health care sector.
  4. Evaluate new technologies and vendors carefully.
    • Conduct due diligence when evaluating third-party resources to reduce attack surfaces.
    • Foster accountability, evidence-based practices and stronger security measures from technology vendors.

By following these steps, your organization will be better prepared to protect patient safety, ensure continuity of care and mitigate the impacts of cyberattacks. To learn more, listen to the Webinar.

Learn how the exclusive, highly vetted panel of service providers in our AHA Preferred Cybersecurity Provider (APCP) Program can help your organization prepare for, prevent and respond to today’s pressing cyberthreats.

Related News Articles

The Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, Multi-State Information Sharing and Analysis Center and international…
The Food and Drug Administration on Nov. 16 announced a new report from government contractor MITRE, Next Steps Toward Managing Legacy Medical Device…
The FBI and Cybersecurity and Infrastructure Security Agency Nov. 16 recommended health care and other critical infrastructure take steps to protect their…
The FBI, Cybersecurity and Infrastructure Security Agency, and Multi-State Information Sharing and Analysis Center Nov. 15 issued a warning about Rhysida…
The FBI and Cybersecurity and Infrastructure Security Agency today released an update on Royal ransomware and encouraged health care and other critical…
The Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) this week alerted the sector to a new ransomware threat…