A Systematic Literature Review on Cybersecurity Threats to Healthcare Data and Mitigation Strategies

Abstract

The incidence of cyberattacks on healthcare institutions has seen a steady increase over the years, with a massive increase of 42% in 2020. More specifically, INTERPOL reported a substantial increase in ransomware attacks on healthcare institutions at the height of the Covid-19 pandemic. This increase can be attributed to the rise in the adoption of digital technologies, such as the Medical Internet of Things (MIoT), to support healthcare services. The sensitive nature of healthcare data and the volume of data handled by healthcare institutions make them attractive to cybercriminals. When compared to financial data, healthcare data has more value on the dark web. Because a cyberattack on healthcare data could have far-reaching consequences, healthcare institutions should have effective strategies to safeguard unauthorized access. This paper presents the results of a systematic literature review (SLR) that investigated the strategies that can be used to mitigate cybersecurity threats to healthcare data. Forty-one research papers retrieved from three databases were analyzed based on specific inclusion/exclusion criteria. Synthesis of the sources yielded three main themes, namely, (i) emerging technology trends that contribute to cybersecurity vulnerability in the healthcare sector, (ii) current cybersecurity challenges in the healthcare sector, and (iii) cybersecurity countermeasures and mitigation strategies. The research results showed that a holistic approach that incorporates people, technology and adherence to regulations is required to mitigate cybersecurity threats in the healthcare sector. The study has implications for policymakers, vendors/designers of healthcare technologies, and healthcare institution managers.

The need for cybersecurity self-evaluation in healthcare

“…Sardi et al [38] literature review strengthens the themes raised by the previous two literature reviews [34,35] regarding the growing cyber-risk in healthcare. Their analysis identified four key themes: human actions, system failures, internal process breakdowns, and external events.…”

“…Vilakazi and Adebesin [34] conducted a systematic literature review to explore mitigation strategies for cybersecurity threats targeting healthcare data. The review identified several critical vulnerabilities in healthcare cybersecurity.…”

“…While Aldossri and Rahman [35] identified similar cybersecurity challenges in healthcare as Vilakazi and Adebesin [34], their research identified several key areas of concern in healthcare cybersecurity: human factors, technological vulnerabilities, data security and privacy, insider threats, and external attacks. The studies reviewed highlighted the critical need for staff training and awareness programs.…”

Cybersecurity for Sustainable Smart Healthcare: State of the Art, Taxonomy, Mechanisms, and Essential Roles

“…Because humans are considered the weakest link, smart healthcare providers must conduct regular training and awareness programs to educate healthcare professionals, patients, and other stakeholders about cyber threats and best security practices through lectures, seminars, and games [139][140] [168]. Smart healthcare users need high-quality education and training programs that include up-to-date information, tips, recommendations, and campaigns that are simple to remember and apply to prevent healthcare user-related cyber-attacks.…”

“…For example, healthcare users are trained on phishing attacks, patient rights, sensitive patient medical data security, SHS or end-user device security, IoMT device and application protection, the risks associated with data breaches and cyberattacks, and best security practices for strong login credentials and network and Wi-Fi security [141]. Training healthcare professionals and patients on best security practices and potential cyber threats in SHSs can help reduce human error, prevent security breaches caused by social engineering attacks, avoid unintended medical data leaks, reduce cybersecurity incidents, and improve patient safety and well-being [168].…”