Transforming Healthcare Cybersecurity from Reactive to Proactive: Current Status and Future Recommendations

Insights into trehalose mediated physiological and biochemical mechanisms in Zea mays L. under chromium stress

BACKGROUND

Chromium (Cr) toxicity significantly threatens agricultural ecosystems worldwide, adversely affecting plant growth and development and reducing crop productivity. Trehalose, a non-reducing sugar has been identified as a mitigator of toxic effects induced by abiotic stressors such as drought, salinity, and heavy metals. The primary objective of this study was to investigate the influence of exogenously applied trehalose on maize plants exposed to Cr stress.

RESULTS

Two maize varieties, FH-1046 and FH-1453, were subjected to two different Cr concentrations (0.3 mM, and 0.5 mM). The results revealed significant variations in growth and biochemical parameters for both maize varieties under Cr-induced stress conditions as compared to the control group. Foliar application of trehalose at a concentration of 30 mM was administered to both maize varieties, leading to a noteworthy reduction in the detrimental effects of Cr stress. Notably, the Cr (0.5 mM) stress more adversely affected the shoot length more than 0.3mM of Cr stress. Cr stress (0.5 mM) significantly reduced the shoot length by 12.4% in FH-1046 and 24.5% in FH-1453 while Trehalose increased shoot length by 30.19% and 4.75% in FH-1046 and FH-1453 respectively. Cr stress significantly constrained growth and biochemical processes, whereas trehalose notably improved plant growth by reducing Cr uptake and minimizing oxidative stress caused by Cr. This reduction in oxidative stress was evidenced by decreased production of proline, SOD, POD, MDA, H2O2, catalase, and APX. Trehalose also enhanced photosynthetic activities under Cr stress, as indicated by increased values of chlorophyll a, b, and carotenoids. Furthermore, the ameliorative potential of trehalose was demonstrated by increased contents of proteins and carbohydrates and a decrease in Cr uptake.

CONCLUSIONS

The study demonstrates that trehalose application substantially improved growth and enhanced photosynthetic activities in both maize varieties. Trehalose (30 mM) significantly increased the plant biomass, reduced ROS production and enhanced resilience to Cr stress even at 0.5 mM.

Cybersecurity in radiology: Cautionary Tales, Proactive Prevention, and What to do When You Get Hacked

To improve awareness and understanding of cybersecurity threats to radiology practice and better equip healthcare practices to manage cybersecurity risks associated with medical imaging, this article reviews topics related to cybersecurity in healthcare, with emphasis on common vulnerabilities in radiology operations. This review is intended to assist radiologists and radiology administrators who are not information technology specialists to attain an updated overview of relevant cybersecurity concepts and concerns relevant to safe and effective practice of radiology and provides a succinct reference for individuals interested in learning about imaging-related vulnerabilities in healthcare settings. As cybersecurity incidents have become increasingly common in healthcare, we first review common cybersecurity threats in healthcare and provide updates on incidence of healthcare data breaches, with emphasis on the impact to radiology. Next, we discuss practical considerations on how to respond to a healthcare data breach, including notification and disclosure requirements, and elaborate on a variety of technical, organizational, and individual actions that can be adopted to minimize cybersecurity risks applicable to radiology professionals and administrators. While emphasis is placed on specific vulnerabilities within radiology workflow, many of the preventive or mitigating strategies are also relevant to cybersecurity within the larger digital healthcare arena. We anticipate that readers, upon completing this review article, will gain a better appreciation of cybersecurity issues relevant to radiology practice and be better equipped to mitigate cybersecurity risks associated with medical imaging.

Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review

BACKGROUND

Health care organizations worldwide are faced with an increasing number of cyberattacks and threats to their critical infrastructure. These cyberattacks cause significant data breaches in digital health information systems, which threaten patient safety and privacy.

OBJECTIVE

From a sociotechnical perspective, this paper explores why digital health care systems are vulnerable to cyberattacks and provides sociotechnical solutions through a systematic literature review (SLR).

METHODS

An SLR using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) was conducted by searching 6 databases (PubMed, Web of Science, ScienceDirect, Scopus, Institute of Electrical and Electronics Engineers, and Springer) and a journal (Management Information Systems Quarterly) for articles published between 2012 and 2022 and indexed using the following keywords: "(cybersecurity OR cybercrime OR ransomware) AND (healthcare) OR (cybersecurity in healthcare)." Reports, review articles, and industry white papers that focused on cybersecurity and health care challenges and solutions were included. Only articles published in English were selected for the review.

RESULTS

In total, 5 themes were identified: human error, lack of investment, complex network-connected end-point devices, old legacy systems, and technology advancement (digitalization). We also found that knowledge applications for solving vulnerabilities in health care systems between 2012 to 2022 were inconsistent.

CONCLUSIONS

This SLR provides a clear understanding of why health care systems are vulnerable to cyberattacks and proposes interventions from a new sociotechnical perspective. These solutions can serve as a guide for health care organizations in their efforts to prevent breaches and address vulnerabilities. To bridge the gap, we recommend that health care organizations, in partnership with educational institutions, develop and implement a cybersecurity curriculum for health care and intelligence information sharing through collaborations; training; awareness campaigns; and knowledge application areas such as secure design processes, phase-out of legacy systems, and improved investment. Additional studies are needed to create a sociotechnical framework that will support cybersecurity in health care systems and connect technology, people, and processes in an integrated manner.

The need for cybersecurity self-evaluation in healthcare

The Australian healthcare sector is a complex mix of government departments, associations, providers, professionals, and consumers. Cybersecurity attacks, which have recently increased, challenge the sector in many ways; however, the best approaches for the sector to manage the threat are unclear. This study will report on a semi-structured focus group conducted with five representatives from the Australian healthcare and computer security sectors. An analysis of this focus group transcript yielded four themes: 1) the challenge of securing the Australian healthcare landscape; 2) the financial challenges of cybersecurity in healthcare; 3) balancing privacy and transparency; 4) education and regulation. The results indicate the need for sector-specific tools to empower the healthcare sector to mitigate cybersecurity threats, most notably using a self-evaluation tool so stakeholders can proactively prepare for incidents. Despite the vast amount of research into cybersecurity, little has been conducted on proactive cybersecurity approaches where security weaknesses are identified weaknesses before they occur.

Perspectives on Cybersecurity and Plastic Surgery: A Survey of Plastic Surgeons and Scoping Review of the Literature

BACKGROUND

Data breach costs in the United States are among the highest in the world, making robust cybersecurity an important bulwark of national defense. Healthcare is a popular target for cyber threats, and there is increasing emphasis on cybersecurity safeguards to protect sensitive patient data.

OBJECTIVES

The objective of this national survey and scoping review is to (1) identify cybersecurity awareness, preparedness, and practices among plastic surgeons, and (2) to provide guidelines to mitigate the threat of cyberattacks.

METHODS

A 16-question, anonymous online survey was developed and distributed to The Aesthetic Society registrants to ascertain plastic surgeons' cybersecurity practices. Utilizing PubMed, CINAHL, and Embase databases, eligible articles were identified as part of this scoping review.

RESULTS

Of 89 individuals who began the survey, 69 completed it (77.5%). Sixty respondents agreed or strongly agreed that cybersecurity is an important issue in plastic surgery. The greatest perceived limitations for protection against cyberattacks were insufficient expertise (41.7%), followed by lack of funding and insufficient time to dedicate to this goal. Most respondents (78.7%) had cybersecurity policies incorporated into their practice. Those who agreed or strongly agreed they had technology to prevent data theft/breach were significantly more likely to be older than 54 years of age (P < .001). No articles identified in the literature specifically addressed cybersecurity in plastic surgery; however, 12 articles detailing cybersecurity in healthcare were identified and included.

CONCLUSIONS

Despite possessing adequate technology and procedures in place to prevent cyberattacks, plastic surgeons perceive significant barriers to cybersecurity protection, including insufficient expertise and lack of dedicated funding. It is imperative that our field establishes standards and protocols to protect our patients.

Clinicians' Perspectives on Healthcare Cybersecurity and Cyber Threats

INTRODUCTION

In today's world, healthcare systems face various risks, including data breaches, theft, and damage. This is where cybersecurity comes in, as it helps protect sensitive personal and financial data, such as electronic health records. This study delved into the perspectives of clinicians on cybersecurity in healthcare, exploring how it impacts patient safety and the functioning of organizations. The study also identified challenges associated with implementing cybersecurity measures and the risks of not doing so.

METHOD

This is a qualitative study in which clinical informaticians from different health science backgrounds were asked to share their opinions using the Delphi technique, with 48 participants engaging in all three rounds.

RESULTS

The study highlighted that 96% of participants deemed cybersecurity in healthcare critical for protecting data. Compliance with regulations (91.7%), reduced disruptions (69%), improved patient care (65%), trust (58.3%), and reputation (54%) were additional advantages. However, the study also identified top challenges to cybersecurity implementation, such as time/resource constraints (65%) and disruption to workflows/services (60.4%). Staff resistance, insider threats, and legacy system issues were also anticipated obstacles. Neglecting to implement cybersecurity measures in healthcare could lead to a higher risk of data breaches (96%), financial/legal penalties for hospitals (79%), and concerns about patient safety (65%).

CONCLUSION

It is imperative to prioritize cybersecurity in the healthcare industry to mitigate these risks and ensure patient confidence, health system stability, and, ultimately, save lives. A unified approach is required to enforce policies, modify behaviors, and adopt innovative practices to combat cyberattacks effectively.

Machine learning models for diagnosis and prognosis of Parkinson's disease using brain imaging: general overview, main challenges, and future directions

Parkinson's disease (PD) is a progressive and complex neurodegenerative disorder associated with age that affects motor and cognitive functions. As there is currently no cure, early diagnosis and accurate prognosis are essential to increase the effectiveness of treatment and control its symptoms. Medical imaging, specifically magnetic resonance imaging (MRI), has emerged as a valuable tool for developing support systems to assist in diagnosis and prognosis. The current literature aims to improve understanding of the disease's structural and functional manifestations in the brain. By applying artificial intelligence to neuroimaging, such as deep learning (DL) and other machine learning (ML) techniques, previously unknown relationships and patterns can be revealed in this high-dimensional data. However, several issues must be addressed before these solutions can be safely integrated into clinical practice. This review provides a comprehensive overview of recent ML techniques analyzed for the automatic diagnosis and prognosis of PD in brain MRI. The main challenges in applying ML to medical diagnosis and its implications for PD are also addressed, including current limitations for safe translation into hospitals. These challenges are analyzed at three levels: disease-specific, task-specific, and technology-specific. Finally, potential future directions for each challenge and future perspectives are discussed.

Designing an Effective Organizational Culture to Guard Against the Cyber Risks of Emerging Technologies

The Internet of Medical Things (IoMT) and interoperable technologies have transformed how patient data affect medical care; such technological innovations revolutionize how healthcare organizations (HCOs) improve cost, quality, and access. New cyber risks, however, accompany developing cyber ecosystems. Although immediate data exchange is beneficial, risk arises from the IoMT's increased susceptibility to human influence. The success of quality care relies on protecting health information technology (HIT) against newly developing cyber vulnerabilities. Therefore, managers must be just as invested in their HCO's cybersecurity protocols as cybercriminals are in bypassing those protocols. This essay proposes a healthcare cyber resiliency model that leverages human and technical factors through a cycle of feedback and process improvement. It intends to equip healthcare administrators with the foundational philosophy necessary to secure their emerging technologies.

Role of digital health in pulmonary rehabilitation and beyond: shaping the future

Pulmonary rehabilitation (PR) is a cost-effective intervention with well-known benefits to exercise capacity, symptoms and quality of life in patients with chronic respiratory diseases. Despite the compelling evidence of its benefits, PR implementation is still suboptimal, and maintenance of PR benefits is challenging. To overcome these pitfalls, there has been a growing interest in developing novel models for PR delivery. Digital health is a promising solution, as it has the potential to address some of the most reported barriers to PR uptake and adherence (such as accessibility issues), help maintain the positive results following a PR programme and promote patients' adherence to a more active lifestyle through physical activity (tele)coaching. Despite the accelerated use of digital health to deliver PR during the coronavirus disease 2019 pandemic, there are still several factors that contribute to the resistance to the adoption of digital health, such as the lack of evidence on its effectiveness, low acceptability by patients and healthcare professionals, concerns about implementation and maintenance costs, inequalities in access to the internet and technological devices, and data protection issues. Nevertheless, the trend towards reducing technology costs and the higher availability of digital devices, as well as the greater ease and simplicity of use of devices, enhance the opportunities for future development of digitally enabled PR interventions. This narrative review aims to examine the current evidence on the role of digital health in the context of PR, including strengths and weaknesses, and to determine possible threats and opportunities, as well as areas for future work.

Healthcare Breaches During COVID-19: The Effect of the Healthcare Entity Type on the Number of Impacted Individuals

The COVID-19 pandemic led to an increase in cybersecurity attacks on organizations operating in the healthcare industry. Health information professionals and health executives are unable to limit the impact of data breaches on records their organizations handle. While current research focuses on prevention strategies and the understanding of the causes of data breaches, it failed to address how to mitigate the impact of successful cybersecurity attacks. This quantitative research paper examined the effect the healthcare entity type has on the number of impacted individuals for healthcare data breaches that occurred during the pandemic. Health information professionals will be able to mitigate the number of breached records based on their organizational type. Some of this paper's findings include the call for implementation of organizational frameworks aimed to protect patient information, and the call for further research to understand how other factors might affect the impact of healthcare data breaches.

A qualitative research study of primary care physicians' views of telehealth in delivering postnatal care to women

BACKGROUND

The postpartum period is a critical time for women to optimise their physical and mental health. Primary care physicians (PCP) often manage postpartum women in the community setting after uneventful births. However, women encounter difficulties accessing care before and after their conventional 6-week physical review. Telehealth-based interventional studies have demonstrated their successful applications in several areas of postpartum care but is not widely adopted. The study aimed to explore the PCPs' views on their acceptability and perceived barriers of telehealth in delivering postpartum care to women in primary care.

METHODS

Twenty-nine PCPs participated in eleven in-depth interviews and four focus group discussions for this qualitative study conducted in Singapore. The purposively sampled PCPs had varied demographic background and medical training. Two investigators independently coded the audited transcripts. Thematic content analysis was performed using the codes to identify issues in the pertaining to the perceived usefulness, ease of use and attitudes towards telehealth in postpartum care as described in the "Telehealth Acceptance Model" framework.

RESULTS

Most PCPs perceived usefulness and ease of use of video consultation in delivering postpartum care. They recognised telehealth service to complement and support the current face-to-face postpartum care amidst the pandemic. However, training, leadership support, organizational infrastructure, healthcare financial policy and personal demographic profile influence their acceptance of a new care model for postnatal mothers.

CONCLUSION

Addressing the barriers and strengthening the facilitators will enhance PCPs' acceptance and utilisation of the proposed hybrid (telehealth and in-person) postnatal care model for mothers.

Hospital cybersecurity risks and gaps: Review (for the non-cyber professional)

Background

Healthcare is facing a growing threat of cyberattacks. Myriad data sources illustrate the same trends that healthcare is one of the industries with the highest risk of cyber infiltration and is seeing a surge in security incidents within just a few years. The circumstances thus begged the question: are US hospitals prepared for the risks that accompany clinical medicine in cyberspace?

Objective

The study aimed to identify the major topics and concerns present in today's hospital cybersecurity field, intended for non-cyber professionals working in hospital settings.

Methods

Via structured literature searches of the National Institutes of Health's PubMed and Tel Aviv University's DaTa databases, 35 journal articles were identified to form the core of the study. Databases were chosen for accessibility and academic rigor. Eighty-seven additional sources were examined to supplement the findings.

Results

The review revealed a basic landscape of hospital cybersecurity, including primary reasons hospitals are frequent targets, top attack methods, and consequences hospitals face following attacks. Cyber technologies common in healthcare and their risks were examined, including medical devices, telemedicine software, and electronic data. By infiltrating any of these components of clinical care, attackers can access mounds of information and manipulate, steal, ransom, or otherwise compromise the records, or can use the access to catapult themselves to deeper parts of a hospital's network. Issues that can increase healthcare cyber risks, like interoperability and constant accessibility, were also identified. Finally, strategies that hospitals tend to employ to combat these risks, including technical, financial, and regulatory, were explored and found to be weak. There exist serious vulnerabilities within hospitals' technologies that many hospitals presently fail to address. The COVID-19 pandemic was used to further illustrate this issue.

Conclusions

Comparison of the risks, strategies, and gaps revealed that many US hospitals are unprepared for cyberattacks. Efforts are largely misdirected, with external-often governmental-efforts negligible. Policy changes, e.g., training employees in cyber protocols, adding advanced technical protections, and collaborating with several experts, are necessary. Overall, hospitals must recognize that, in cyber incidents, the real victims are the patients. They are at risk physically and digitally when medical devices or treatments are compromised.

The Impact of a Cyberattack at a Radiation Oncology Department: Immediate Response and Future Preparedness

Cyberattacks are increasing year after year and many organizations, including hospitals, are becoming targets. Radiation oncology is especially vulnerable because of the reliance on computer and network capabilities to transfer relevant patient information for safe and effective patient treatment. In early 2019, our institution was hit by a ransomware attack that brought down our oncology information system (OIS). Although we were not fully prepared for such an attack, a total of 69 treatment fractions occurred without our OIS thanks to the quick development of a contingency plan and the ability to restore the patients’ records. The OIS was recovered by the manufacturer 4 days after the attack. We also have developed a contingency plan and outline important considerations for institutions trying to prepare for unexpected downtime such as a cyberattack.

Anatomy of a Cyberattack: Part 2: Managing a Clinical Pathology Laboratory During 25 Days of Downtime

OBJECTIVES

Our academic health care institution was the victim of a cyberattack that led to a complete shutdown of major patient care, operational, and communication systems, including our electronic health record (EHR), laboratory information system, pharmacy, scheduling, billing and coding, imaging software, internet, hospital shared computer drives, payroll, and digital communications. The EHR remained down for 25 days, significantly affecting our clinical pathology (CP) laboratory operations.

METHODS

During the downtime, our CP laboratory incorporated manual interventions for patient specimen testing, recruited additional staff for reporting results, and employed multiple communication modalities to support patient care. The crisis required a swift response, employing innovative approaches to mitigate patient harm; regular, multidisciplinary engagement; and consistent, broad-reaching communications. CP leadership worked with hospital administration, staff, and our referral clients to provide the timely laboratory results needed for acute patient care.

RESULTS

During this downtime, the laboratory lacked accurate information about the number of patient samples diverted to other laboratories, the number of specimens processed, and the number of test results reported.

CONCLUSIONS

This paper focuses on the approaches the CP division took to develop and maintain downtime operations. Laboratories should consider these strategies in preparation for a prolonged downtime.

A Survey on Threat-Modeling Techniques: Protected Objects and Classification of Threats

Information security is one of the most important attributes of distributed systems that often operate on unreliable networks. Enabling security features during the development of a distributed system requires the careful analysis of potential attacks or threats in different contexts, a process often referred to as «threat modeling». Information protection should be comprehensive, but it is also necessary to take into account the possibility of the emergence of threats specific to a certain information system. Many public and private organizations are still trying to implement system models and the threats directed at them on their own. The main reason for this is the lack of useful and high-quality methodologies that can help developers design system models. This review explores a variety of the literature on confidentiality- and integrity-aware system design methodologies, as well as threat classification methods, and identifies key issues that may be referenced by organizations to make design system processes easier. In particular, this article takes a look at the extent to which existing methodologies cover objects of protection and methods of classifying threats, as well as whether there are such models of systems in which the object itself and the threats directed at it are described. This includes whether the compiled models exhibit symmetry or asymmetry. This literature research shows that methodologies appear to be heterogeneous and versatile, since existing methodologies often only focus on one object of protection (a system). Based on the given analysis, it can be concluded that the existing methodologies only relate superficially to the description of system models and threats, and it is necessary to develop a more complete abstract model of the protected object and threats aimed at it in order to make this model suitable for any organization and protect it against most threats.

Cyberattacks against the health-care sectors during the COVID-19 pandemic

Purpose

This paper aims to analyze the changes in cyberattacks against the health-care sector during the COVID-19 pandemic.

Design/methodology/approach

The changes in cyberattacks of the health-care sector are analyzed by examination of the number and essence of published news concerning cybersecurity attacks on the health-care sector during 2019 and compared them to those published during 2020, based on two main websites, which review such incidents.

Findings

This study found that there was a significant growth in reports of cyberattacks on the health-care sector. Moreover, the number of cyberattacks fit interestingly to the pattern of waves of the disease, which expanded worldwide. During the first wave the number of reports was doubled or even tripled, compared to the same period in 2019, a tendency that was slightly waned afterwards.

Practical implications

This study helps to deepen the awareness of information security implications of a potential global devastating crisis, even in the cybersecurity domain, and on the health-care sector, among various other affected sectors and domains.

Social implications

COVID-19 pandemic created long-term wide-range changes that affect every individual and sector, mainly owing to the shift to remote working model, which impose long-term new cybersecurity changes, among them to the health-care industry.

Originality/value

This paper extends the existing information on implication of remote working model on information security and of the COVID-19 pandemic on the cybersecurity of health-care institutions around the world.

Information Security Awareness and Behaviors of Health Care Professionals at Public Health Care Facilities

OBJECTIVES

This study investigated information security behaviors of professionals working in the public health sector to guide policymakers toward focusing their investments in infrastructure and training on the most vulnerable segments. We sought to answer the following questions: (1) Are certain professional demographics more vulnerable to cybersecurity threats? (2) Do professionals in different institution types (i.e., hospitals vs. primary care clinics) exhibit different cybersecurity behaviors? (3) Can Internet usage behaviors by professionals be indicative of their cybersecurity awareness and the risk they introduce?

METHODS

A cross-sectional, anonymous, paper-based survey was distributed among professionals working in public health care organizations in Kuwait. Data were collected about each professional's role, experience, work environment, cybersecurity practices, and understanding to calculate a cybersecurity score which indicates their level of compliance to good cybersecurity practices. We also asked about respondents' internet usage and used K-means cluster analysis to segment respondents into three groups based on their internet activities at work. Ordinary least squares regression assessed the association between the collected independent variables in question on the overall cybersecurity behavior.

RESULTS

A total of 453/700 (64%) were responded to the survey. The results indicated that professionals with more work experience demonstrated higher compliance with good cybersecurity practices. Interestingly, nurses demonstrate higher cybersecurity aptitude relative to physicians. Professionals that were less inclined to use the internet for personal use during their work demonstrated higher cybersecurity aptitude.

CONCLUSION

Our findings provide some guidance regarding how to target health care professional training to mitigate cybersecurity risks. There is a need for ensuring that physicians receive adequate cybersecurity training, despite the opportunity costs and other issues competing for their attention. Additionally, classifying professionals based on their internet browsing patterns may identify individuals vulnerable to cybersecurity incidents better than more discrete indicators such as age or gender.

Webcam use in German neonatological intensive care units: an interview study on parental expectations and experiences

BACKGROUND

To bridge the physical distance between parents and children during a neonatal intensive care unit (NICU) stay, webcams are used in few German NICUs. They allow parents to view their infant even when they cannot be present on the ward. The aim of the study was to explore the factors for and against webcam use that parents with or without webcam use encountered.

METHODS

Guideline-based, semi-structured qualitative interviews were conducted in the period from September 2019 to August 2020. Interview transcripts were analysed using a category-based content analysis. The categories were generated in a combined deductive-inductive procedure.

RESULTS

We interviewed 33 mothers and seven fathers. Parents with webcam experience emphasised positive aspects concerning their webcam use. Factors that increased webcam acceptance included feeling certain about the child's well-being and an increased sense of proximity. Only a few critical voices emerged from parents who had webcam experience, e.g. regarding privacy concerns. Parents who had no experience with webcam use showed ambivalence. On the one hand, they expressed a positive attitude towards the webcam system and acknowledged that webcam use could result in feelings of control. On the other hand, reservations emerged concerning an increase of mental stress or a negative influence on parental visitation behaviour.

CONCLUSION

In addition to the parents' positive experiences with webcam use, results show a need within parents who lacked webcam experience. Despite some criticism, it was evident that webcam use was primarily seen as an opportunity to counteract the negative consequences of separation in the postnatal phase.

TRIAL REGISTRATION

The Neo-CamCare study is registered at the German Clinical Trials Register.

DRKS-ID

DRKS00017755 . Date of Registration in DRKS: 25-09-2019.

Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review

Background: Cybersecurity is increasingly becoming a prominent concern among healthcare providers in adopting digital technologies for improving the quality of care delivered to patients. The recent reports on cyber attacks, such as ransomware and WannaCry, have brought to life the destructive nature of such attacks upon healthcare. In complement to cyberattacks, which have been targeted against the vulnerabilities of information technology (IT) infrastructures, a new form of cyber attack aims to exploit human vulnerabilities; such attacks are categorised as social engineering attacks. Following an increase in the frequency and ingenuity of attacks launched against hospitals and clinical environments with the intention of causing service disruption, there is a strong need to study the level of awareness programmes and training activities offered to the staff by healthcare organisations. Objective: The objective of this systematic review is to identify commonly encountered factors that cybersecurity postures of a healthcare organisation, resulting from the ignorance of cyber threat to healthcare. The systematic review aims to consolidate the current literature being reported upon human behaviour resulting in security gaps that mitigate the cyber defence strategy adopted by healthcare organisations. Additionally, the paper also reviews the organisational risk assessment methodology implemented and the policies being adopted to strengthen cybersecurity. Methods: The topic of cybersecurity within healthcare and the clinical environment has attracted the interest of several researchers, resulting in a broad range of literature. The inclusion criteria for the articles in the review stem from the scope of the five research questions identified. To this end, we conducted seven search queries across three repositories, namely (i) PubMed^®/MED-LINE; (ii) Cumulative Index to Nursing and Allied Health Literature (CINAHL); and (iii) Web of Science (WoS), using key words related to cybersecurity awareness, training, organisation risk assessment methodologies, policies and recommendations adopted as counter measures within health care. These were restricted to around the last 12 years. Results: A total of 70 articles were selected to be included in the review, which addresses the complexity of cybersecurity measures adopted within the healthcare and clinical environments. The articles included in the review highlight the evolving nature of cybersecurity threats stemming from exploiting IT infrastructures to more advanced attacks launched with the intent of exploiting human vulnerability. A steady increase in the literature on the threat of phishing attacks evidences the growing threat of social engineering attacks. As a countermeasure, through the review, we identified articles that provide methodologies resulting from case studies to promote cybersecurity awareness among stakeholders. The articles included highlight the need to adopt cyber hygiene practices among healthcare professionals while accessing social media platforms, which forms an ideal test bed for the attackers to gain insight into the life of healthcare professionals. Additionally, the review also includes articles that present strategies adopted by healthcare organisations in countering the impact of social engineering attacks. The evaluation of the cybersecurity risk assessment of an organisation is another key area of study reported in the literature that recommends the organisation of European and international standards in countering social engineering attacks. Lastly, the review includes articles reporting on national case studies with an overview of the economic and societal impact of service disruptions encountered due to cyberattacks. Discussion: One of the limitations of the review is the subjective ranking of the authors associated to the relevance of literature to each of the research questions identified. We also acknowledge the limited amount of literature that focuses on human factors of cybersecurity in health care in general; therefore, the search queries were formulated using well-established cybersecurity related topics categorised according to the threats, risk assessment and organisational strategies reported in the literature.

Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review

BACKGROUND

COVID-19 has challenged the resilience of the health care information system, which has affected our ability to achieve the global goal of health and well-being. The pandemic has resulted in a number of recent cyberattacks on hospitals, pharmaceutical companies, the US Department of Health and Human Services, the World Health Organization and its partners, and others.

OBJECTIVE

The aim of this review was to identify key cybersecurity challenges, solutions adapted by the health sector, and areas of improvement needed to counteract the recent increases in cyberattacks (eg, phishing campaigns and ransomware attacks), which have been used by attackers to exploit vulnerabilities in technology and people introduced through changes to working practices in response to the COVID-19 pandemic.

METHODS

A scoping review was conducted by searching two major scientific databases (PubMed and Scopus) using the search formula "(covid OR healthcare) AND cybersecurity." Reports, news articles, and industry white papers were also included if they were related directly to previously published works, or if they were the only available sources at the time of writing. Only articles in English published in the last decade were included (ie, 2011-2020) in order to focus on current issues, challenges, and solutions.

RESULTS

We identified 9 main challenges in cybersecurity, 11 key solutions that health care organizations adapted to address these challenges, and 4 key areas that need to be strengthened in terms of cybersecurity capacity in the health sector. We also found that the most prominent and significant methods of cyberattacks that occurred during the pandemic were related to phishing, ransomware, distributed denial-of-service attacks, and malware.

CONCLUSIONS

This scoping review identified the most impactful methods of cyberattacks that targeted the health sector during the COVID-19 pandemic, as well as the challenges in cybersecurity, solutions, and areas in need of improvement. We provided useful insights to the health sector on cybersecurity issues during the COVID-19 pandemic as well as other epidemics or pandemics that may materialize in the future.

Healthcare cyber-attacks and the COVID-19 pandemic: an urgent threat to global health

The Coronavirus Disease 2019 (COVID-19) pandemic has resulted in widespread disruption to the healthcare industry. Alongside complex issues relating to ensuring sufficient healthcare capacity and resourcing, healthcare organisations and universities are now also facing heightened cyber-security threats in the midst of the pandemic. Since the outbreak began various healthcare providers and academic institutions across the world have been targeted in a variety of complex and coordinatized cyber-attacks. International and national regulatory bodies have stressed the urgent need for healthcare providers and universities to protect themselves against cyber-attacks during COVID-19, recognising that a growing number of cyber-criminals are seeking to capitalise on the vulnerabilities of the healthcare sector during this period. This includes a desire to steal intellectual property such as data relating to COVID-19 vaccine development, modelling and experimental therapeutics. It is therefore essential that healthcare providers and universities ensure they are informed, protected and prepared to respond to any cyber-threat. This article outlines key COVID-19 cyber-security principles for both healthcare organisations and academic institutions.

Public Health Innovation through Cloud Adoption: A Comparative Analysis of Drivers and Barriers in Japan, South Korea, and Singapore

Governments are increasingly using cloud computing to reduce cost, increase access, improve quality, and create innovations in healthcare. Existing literature is primarily based on successful examples from developed western countries, and there is a lack of similar evidence from Asia. With a population close to 4.5 billion people, Asia faces healthcare challenges that pose an immense burden on economic growth and policymaking. Cloud computing in healthcare can potentially help increase the quality of healthcare delivery and reduce the economic burden, enabling governments to address healthcare challenges effectively and within a short timeframe. Advanced Asian countries such as Japan, South Korea, and Singapore provide successful examples of how cloud computing can be used to develop nationwide databases of electronic health records; real-time health monitoring for the elderly population; genetic database to support advanced research and cancer treatment; telemedicine; and health cities that drive the economy through medical industry, tourism, and research. This article examines these countries and identifies the drivers and barriers of cloud adoption in healthcare and makes policy recommendations to enable successful public health innovations through cloud adoption.

COVID‐19 pandemic cybersecurity issues

This paper studies the cybersecurity issues that have occurred during the coronavirus (COVID‐19) pandemic. During the pandemic, cyber criminals and Advanced Persistent Threat (APT) groups have taken advantage of targeting vulnerable people and systems. This paper emphasizes that there is a correlation between the pandemic and the increase in cyber‐attacks targeting sectors that are vulnerable. In addition, the growth in anxiety and fear due to the pandemic is increasing the success rate of cyber‐attacks. We also highlight that healthcare organizations are one of the main victims of cyber‐attacks during the pandemic. The pandemic has also raised the issue of cybersecurity in relation to the new normal of expecting staff to work from home (WFH), the possibility of state‐sponsored attacks, and increases in phishing and ransomware. We have also provided various practical approaches to reduce the risks of cyber‐attacks while WFH including mitigation of security risks related to healthcare. It is crucial that healthcare organizations improve protecting their important data and assets by implementing a comprehensive approach to cybersecurity.

Telehealth in the time of Corona: 'doctor in the house'

The COVID-19 pandemic has led to many physicians working from home whenever possible. Although the concept of 'remote' patient care has been around for decades, present circumstances have provided a grand impetus in that direction with a view to protecting both patient and caregiver. In this article, we discuss some of the various challenges to moving forward with telemedicine, drawing in part on our own experiences in dealing with the COVID-19 pandemic. Clinical, technical, financial and cultural barriers to telemedicine are identified, along with a discussion concerning anticipated benefits. We conclude that the COVID-19 pandemic will likely forever change how healthcare is conducted as telemedicine figures increasingly prominently in the clinical landscape.

FIViz: Forensics Investigation through Visualization for Malware in Internet of Things

Adoption of the Internet of Things for the realization of smart cities in various domains has been pushed by the advancements in Information Communication and Technology. Transportation, power delivery, environmental monitoring, and medical applications are among the front runners when it comes to leveraging the benefits of IoT for improving services through modern decision support systems. Though with the enormous usage of the Internet of Medical Things, security and privacy become intrinsic issues, thus adversaries can exploit these devices or information on these devices for malicious intents. These devices generate and log large and complex raw data which are used by decision support systems to provide better care to patients. Investigation of these enormous and complicated data from a victim’s device is a daunting and time-consuming task for an investigator. Different feature-based frameworks have been proposed to resolve this problem to detect early and effectively the access logs to better assess the event. But the problem with the existing approaches is that it forces the investigator to manually comb through collected data which can contain a huge amount of irrelevant data. These data are provided normally in textual form to the investigators which are too time-consuming for the investigations even if they can utilize machine learning or natural language processing techniques. In this paper, we proposed a visualization-based approach to tackle the problem of investigating large and complex raw data sets from the Internet of Medical Things. Our contribution in this work is twofold. Firstly, we create a data set through a dynamic behavioral analysis of 400 malware samples. Secondly, the resultant and reduced data set were then visualized most feasibly. This is to investigate an incident easily. The experimental results show that an investigator can investigate large amounts of data in an easy and time-efficient manner through the effective use of visualization techniques.

Trends and best practices in health care cybersecurity insurance policy

Health care organizations are a major target for cyberattacks. This is primarily due to their peculiar vulnerabilities and attractiveness to nefarious cyber actors. Data breaches from these attacks present a significant threat to the viability of health care organizations, ranging from financial losses to compromised patient safety. Cybersecurity insurance has become an essential tool for mitigating financial liabilities that may arise from breaches for many organizations. This paper reviews the current state of cybersecurity insurance adoption in the health care sector. It highlights best practices in cybersecurity insurance policy for health care organizations and recommends future directions to strengthen cybersecurity and improve cybersecurity insurance.