A practical cyberattack contingency plan for radiation oncology

Abstract

Purpose This article presents a solution for continuing radiation therapy without interruption in the event of a cyberattack to the radiation oncology information systems (ROIS). This process could be easily deployed to any radiation oncology practice, with little clinical overhead or burden. Methods and Materials The solution automatically retrieves all essential information from the clinical ROIS for each under‐treatment patient and periodically (e.g., daily) saves these data to a dedicated secure server for recovery. In the event that the clinical ROIS is not functioning as a result of a cyberattack, this essential information is used to build a new secondary ROIS server to continue radiotherapy treatments until the main ROIS is recovered. Once the cyberattack threat is cleared, the clinical ROIS server is rebuilt from the institution’s enterprise backup. The newly accumulated treatment information for each patient is then exported from the secondary ROIS to bring the clinical ROIS up to date. Results The Department of Radiation Oncology at the University of Maryland Medical System implemented this solution for clinical use with the Varian ARIA ROIS in the management of ~250 daily radiotherapy treatments, inclusive of a proton center. This solution was determined to be a feasible and affordable business continuity plan for the radiation oncology practice by minimizing radiation treatment downtime to a couple of hours in a simulated cyberattack drill. Conclusions The proposed solution can achieve continuation of radiation therapy treatment without treatment breaks in the event of a cyberattack. It also provides cushion time for radiation oncology departments to rebuild their clinical ROIS systems from the enterprise data backup.

A Safe and Practical Cycle for Team-Based Development and Implementation of In-House Clinical Software

“…There are other considerations that are outside the scope of the current work related to data integrity (Integrating the Healthcare Enterprise -Radiation Oncology and Digital Imaging and Communications in Medicine efforts); data transfer where applicable, such as addressed in the AAPM Task Group 201 33 ; usability; security concerns 34 ; and information assurance. The policy supports transparency in the process.…”

Toward automation of initial chart check for photon/electron EBRT: the clinical implementation of new AAPM task group reports and automation techniques

“…Then, the tool parses all the prescription information as shown in [Fig. 1(a)] (The readers are referred to a recently published paper 35 for more details.). Meanwhile, our institution has produced a series of clinical practice guidelines for prescribing, simulation, contouring, planning, and evaluation of EBRT for each stage of various diseases.…”

Impact of and Response to Cyberattacks in Radiation Oncology

“…[17][18][19] In a previous publication and in the previous sections of this article, we discussed specific challenges we faced and unique solutions we implemented to quickly and safely resume treating patients. 20 The lessons learned from this experience prompted us to further develop suggested practices for a radiation oncology department to prepare for, and be more responsive to, any future cyberattacks (Table 2).…”