Readiness for Health Information Technology is Associated to Information Security in Healthcare Institutions

Dönmez, Elif; Kitapçı, Nur Şişman; KİTAPÇI, Okan Cem; Yay, Meral; AKSU, Pınar KILIÇ; Köksal, Leyla; Mumcu, Gonca

doi:10.5455/aim.2020.28.265-271

Cited by 3 publications

(1 citation statement)

References 27 publications

(28 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The delivery of health services has become increasingly digital, partially due to the introduction of information systems (ISs) [ 1 ]. Despite the focus on significantly reshaping the quality and efficiency of the provision of health care, the adoption of ISs did not come without risks [ 2 - 5 ].…”

Section: Introductionmentioning

confidence: 99%

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

Portela¹,

Nogueira-Leite²,

Almeida³

et al. 2023

JMIR Form Res

View full text Add to dashboard Cite

Background Over the last decade, the frequency and size of cyberattacks in the health care industry have increased, ranging from breaches of processes or networks to encryption of files that restrict access to data. These attacks may have multiple consequences for patient safety, as they can, for example, target electronic health records, access to critical information, and support for critical systems, thereby causing delays in hospital activities. The effects of cybersecurity breaches are not only a threat to patients’ lives but also have financial consequences due to causing inactivity in health care systems. However, publicly available information on these incidents quantifying their impact is scarce. Objective We aim, while using public domain data from Portugal, to (1) identify data breaches in the public national health system since 2017 and (2) measure the economic impact using a hypothesized scenario as a case study. Methods We retrieved data from multiple national and local media sources on cybersecurity from 2017 until 2022 and built a timeline of attacks. In the absence of public information on cyberattacks, reported drops in activity were estimated using a hypothesized scenario for affected resources and percentages and duration of inactivity. Only direct costs were considered for estimates. Data for estimates were produced based on planned activity through the hospital contract program. We use sensitivity analysis to illustrate how a midlevel ransomware attack might impact health institutions’ daily costs (inferring a potential range of values based on assumptions). Given the heterogeneity of our included parameters, we also provide a tool for users to distinguish such impacts of different attacks on institutions according to different contract programs, served population size, and proportion of inactivity. Results From 2017 to 2022, we were able to identify 6 incidents in Portuguese public hospitals using public domain data (there was 1 incident each year and 2 in 2018). Financial impacts were obtained from a cost point of view, where estimated values have a minimum-to-maximum range of €115,882.96 to €2,317,659.11 (a currency exchange rate of €1=US $1.0233 is applicable). Costs of this range and magnitude were inferred assuming different percentages of affected resources and with different numbers of working days while considering the costs of external consultation, hospitalization, and use of in- and outpatient clinics and emergency rooms, for a maximum of 5 working days. Conclusions To enhance cybersecurity capabilities at hospitals, it is important to provide robust information to support decision-making. Our study provides valuable information and preliminary insights that can help health care organizations better understand the costs and risks associated with cyber threats and improve their cybersecurity strategies. Additionally, it demonstrates the importance of adopting effective preventive and reactive strategies, such as contingency plans, as well as enhanced investment in improving cybersecurity capabilities in this critical area while aiming to achieve cyber-resilience.

show abstract

Section: Introductionmentioning

confidence: 99%

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

Portela¹,

Nogueira-Leite²,

Almeida³

et al. 2023

JMIR Form Res

View full text Add to dashboard Cite

show abstract

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study (Preprint)

Portela¹,

Nogueira-Leite²,

Almeida³

et al. 2022

Preprint

View full text Add to dashboard Cite

BACKGROUND Following the recent cyberattack on a mid-level hospital in Portugal (around five years later first major cyberattack on an institution of the National Health Service on a scale this group of scientists was dedicated to estimating the economic impact of cyberattacks on the Portuguese health system. OBJECTIVE In the absence of public information on the cyberattacks that occurred, we aim, while using public domain data, to (i) identify the data breaches on the Portugues National Health System since 2017 and (ii) estimate and measure its economic impact using an attack simulation as a case study. METHODS Facing unavailable public domain data to sustain such information as a pressing constraint, we hypothesize such attack to support our estimates for our calculations. RESULTS As a result, we estimated a daily cost impact which highlights that, for an institution with HGO (served population of ca. 350,000 people), postponing 50% of external consultations (amounting to a yearly contract value of €22,700,338.00) may have a daily cost impact of 45,400.66 € to the institution. We further developed an open source Economic Impact Simulator on healthcare cyber-attacks. CONCLUSIONS Our study demonstrates the importance of adopting effective preventive and reactive strategies, such as contingency plans, as well as a superior investment in improving cybersecurity capabilities in this critical area.

show abstract

Cybersecurity interventions in low- and middle-income country healthcare organizations: A scoping review (Preprint)

Hasegawa¹,

O’Brien²,

Prendergast³

et al. 2023

Preprint

View full text Add to dashboard Cite

BACKGROUND Healthcare organizations globally have seen a significant increase in the frequency of cyber-attacks in recent years. Cyber-attacks cause massive disruption to health service delivery and directly impact patient safety through disruption and treatment delays. Given increasing cyber-attacks in low- and middle-income countries (LMICs), there is a need to explore the interventions put in place to plan for cyber-attacks and develop cyber-resilience. OBJECTIVE To describe cybersecurity interventions implemented in LMICs to date and to evaluate their impact on the likelihood and impact of attacks. Secondary objective was to describe the main barriers and facilitators for the implementation of such interventions, where reported. METHODS A systematic search of the literature published between January 2017 and September 2022 was performed on Ovid Medline, Embase, Global Health and Scopus, using a combination of controlled terms and free text. A search of grey literature within the same time parameters was undertaken on the websites of relevant stakeholder organizations to identify possible additional studies that meet the inclusion criteria. Findings from included papers were mapped against dimension areas of the Essentials of Cybersecurity for Healthcare Organizations (ECHO framework) and presented as a narrative synthesis. RESULTS Seventeen studies were included in this review. The sample size of the majority of studies (58.8%) was 1-5 facilities and the studies were conducted in 13 countries. Studies were categorized into the thematic dimensions of the ECHO framework, including Context; Governance; Organizational strategy; Risk management; Awareness, education, and training; and Technical capabilities. Few studies (29.4%) discussed cybersecurity intervention(s) as the primary focus of the paper and so information on intervention(s) implemented had to be deduced. There was no attempt to report on the impact and outcomes in all but one paper. Facilitators and barriers identified were grouped and presented across national/regional, organizational, and individual staff levels. CONCLUSIONS The scoping review findings highlight the limited body of research published on cybersecurity interventions implemented in healthcare organizations in LMICs and large heterogeneity across existing studies in interventions, research objectives, methods, and outcome measures used. The impact of cybersecurity interventions on likelihood and impact of cyber-attacks remains unclear. Future research should specifically focus on the evaluation of cybersecurity interventions and objectively evaluate their impact to build a robust evidence base to inform evidence-based policy and practice.

show abstract

Readiness for Health Information Technology is Associated to Information Security in Healthcare Institutions

Cited by 3 publications

References 27 publications

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study (Preprint)

Cybersecurity interventions in low- and middle-income country healthcare organizations: A scoping review (Preprint)

Contact Info

Product

Resources

About