Cyberattacks in health care can threaten patient safety

Cyberattacks are a significant concern for health care organizations. These can include e-mail phishing attacks, which are used to steal data by tricking the recipients into entering personal details for accessing files or systems; potential attacks on medical devices, which could introduce malware into the equipment to access settings and data; and ransomware, which can prevent access to files or systems until the user pays a ransom. Not only can cyberattacks compromise hospital operations and revenue, they also can threaten patient safety.1 Any disruption, corruption, or leak of health care data can affect patient care and has the potential to result in negative effects and adverse outcomes for patients.1 Cyberattacks could cause implanted and networked medical devices, such as ventilators, infusion pumps, pacemakers, and monitors, to malfunction.1-3 For example, a pacemaker could be turned off or have its pacing behavior changed, an infusion pump could be modified to deliver an incorrect medication dose, or a ventilator could be manipulated to fail during a surgical procedure.1 Attackers can remotely access entire health care systems to disrupt operations, including slowing down access to or tampering with health data and manipulating heating, ventilation, and air conditioning or power systems.1, 2 Health care personnel may not be able to access time-sensitive patient health information, such as test results or medication allergies, or the information could be changed. Personnel without access to information or with access to incorrect information may diagnose or treat patients incorrectly.1, 2 The heating, ventilation, and air conditioning or power systems of a facility can be disrupted at essential times, such as during surgery, or elevators could be deactivated.1 Data breaches are often overlooked threats to patient safety that can result in the loss of patients’ protected health information. Inappropriate access to or stolen health records can disclose patient names, addresses, social security numbers, health insurance information, health conditions, medical photographs, and financial information. This not only infringes on patient privacy, but the information can be used to jeopardize patient safety by compromising their identities and making them vulnerable to blackmailing and fraudulent activities.2 As outlined by this month’s lead feature article, three-fourths of health care leaders reported that they have experienced a significant cybersecurity threat in the past year.4 These attacks often increase during crises like the COVID-19 pandemic because attackers try to take advantage of the urgent need to have operations running smoothly to maintain care quality and patient safety. Because patient safety is the overriding objective for all health care personnel, it is essential that they understand how cyberattacks can threaten patient safety and learn and implement cybersecurity best practices to help prevent them. This month’s lead feature article describes two of the most common cyberattacks in health care (i.e., e-mail phishing, ransomware) and provides recommendations to help protect organizations against these threats. It also provides a list of resources to guide individuals and facilities in instituting cybersecurity best practices.