Cybersecurity in health care

Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review

BACKGROUND

Health care organizations worldwide are faced with an increasing number of cyberattacks and threats to their critical infrastructure. These cyberattacks cause significant data breaches in digital health information systems, which threaten patient safety and privacy.

OBJECTIVE

From a sociotechnical perspective, this paper explores why digital health care systems are vulnerable to cyberattacks and provides sociotechnical solutions through a systematic literature review (SLR).

METHODS

An SLR using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) was conducted by searching 6 databases (PubMed, Web of Science, ScienceDirect, Scopus, Institute of Electrical and Electronics Engineers, and Springer) and a journal (Management Information Systems Quarterly) for articles published between 2012 and 2022 and indexed using the following keywords: "(cybersecurity OR cybercrime OR ransomware) AND (healthcare) OR (cybersecurity in healthcare)." Reports, review articles, and industry white papers that focused on cybersecurity and health care challenges and solutions were included. Only articles published in English were selected for the review.

RESULTS

In total, 5 themes were identified: human error, lack of investment, complex network-connected end-point devices, old legacy systems, and technology advancement (digitalization). We also found that knowledge applications for solving vulnerabilities in health care systems between 2012 to 2022 were inconsistent.

CONCLUSIONS

This SLR provides a clear understanding of why health care systems are vulnerable to cyberattacks and proposes interventions from a new sociotechnical perspective. These solutions can serve as a guide for health care organizations in their efforts to prevent breaches and address vulnerabilities. To bridge the gap, we recommend that health care organizations, in partnership with educational institutions, develop and implement a cybersecurity curriculum for health care and intelligence information sharing through collaborations; training; awareness campaigns; and knowledge application areas such as secure design processes, phase-out of legacy systems, and improved investment. Additional studies are needed to create a sociotechnical framework that will support cybersecurity in health care systems and connect technology, people, and processes in an integrated manner.

Framework for cyber risk loss distribution of hospital infrastructure: Bond percolation on mixed random graphs approach

Networks like those of healthcare infrastructure have been a primary target of cyberattacks for over a decade. From just a single cyberattack, a healthcare facility would expect to see millions of dollars in losses from legal fines, business interruption, and loss of revenue. As more medical devices become interconnected, more cyber vulnerabilities emerge, resulting in more potential exploitation that may disrupt patient care and give rise to catastrophic financial losses. In this paper, we propose a structural model of an aggregate loss distribution across multiple cyberattacks on a prototypical hospital network. Modeled as a mixed random graph, the hospital network consists of various patient-monitoring devices and medical imaging equipment as random nodes to account for the variable occupancy of patient rooms and availability of imaging equipment that are connected by bidirectional edges to fixed hospital and radiological information systems. Our framework accounts for the documented cyber vulnerabilities of a hospital's trusted internal network of its major medical assets. To our knowledge, there exist no other models of an aggregate loss distribution for cyber risk in this setting. We contextualize the problem in the probabilistic graph-theoretical framework using a percolation model and combinatorial techniques to compute the mean and variance of the loss distribution for a mixed random network with associated random costs that can be useful for healthcare administrators and cybersecurity professionals to improve cybersecurity management strategies. By characterizing this distribution, we allow for the further utility of pricing cyber risk.

Assessing the impact of health information exchange on hospital data breach risk

OBJECTIVE

Widespread electronic health information exchange (HIE) across hospitals remains an important policy goal for reducing costs and improving the quality of care. Meanwhile, cybersecurity incidents are a growing threat to hospitals. The relationship between the electronic sharing of health information and cybersecurity incidents is not well understood. The objective of this study was to empirically examine the impact of hospitals' HIE engagement on their data breach risk.

MATERIALS AND METHODS

A balanced panel dataset included 4,936 US community hospitals spanning the period 2010-2017, which was assembled by linking the American Hospital Association annual survey database and the Information Technology (IT) supplement, and the Department of Health and Human Services reports of health data breaches. The relationship between HIE engagement and hospital data breaches was modeled using a difference-in-differences specification controlling for time-varying hospital characteristics.

RESULTS

The percentage of hospitals electronically exchanging information has more than tripled (from 18% to 68%) from 2010 to 2017. Hospital data breaches increased concurrently, largely due to the rise in hacking and unauthorized access. HIE engagement was associated with a 0.672 percentage point increase in the probability of an IT breach three years after the engagement. Hospitals actively engaging in a health information organization and exchanging data with outside providers were associated with a higher risk of IT related breaches in the long run; however, hospitals actively engaging in HIE and exchanging data with inside providers were not associated with any significant risk of IT related breaches.

DISCUSSION

Over time, the increasing amount and complexity of patient information being exchanged can create challenges for cybersecurity if data protection is not up to date. Additionally, data security depends on the weakest link of HIE, and providers with fewer resources for data governance and infrastructure are more vulnerable to data breaches.

CONCLUSION

Moving toward widespread health information exchange has important cybersecurity implications that can significantly impact both patients and healthcare organizations.

Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US

Importance

Cyberattacks on health care delivery organizations are increasing in frequency and sophistication. Ransomware infections have been associated with significant operational disruption, but data describing regional associations of these cyberattacks with neighboring hospitals have not been previously reported, to our knowledge.

Objective

To examine an institution's emergency department (ED) patient volume and stroke care metrics during a month-long ransomware attack on a geographically proximal but separate health care delivery organization.

Design, Setting, and Participants

This before and after cohort study compares adult and pediatric patient volume and stroke care metrics of 2 US urban academic EDs in the 4 weeks prior to the ransomware attack on May 1, 2021 (April 3-30, 2021), as well as during the attack and recovery (May 1-28, 2021) and 4 weeks after the attack and recovery (May 29 to June 25, 2021). The 2 EDs had a combined mean annual census of more than 70 000 care encounters and 11% of San Diego County's total acute inpatient discharges. The health care delivery organization targeted by the ransomware constitutes approximately 25% of the regional inpatient discharges.

Exposure

A month-long ransomware cyberattack on 4 adjacent hospitals.

Main Outcomes and Measures

Emergency department encounter volumes (census), temporal throughput, regional diversion of emergency medical services (EMS), and stroke care metrics.

Results

This study evaluated 19 857 ED visits at the unaffected ED: 6114 (mean [SD] age, 49.6 [19.3] years; 2931 [47.9%] female patients; 1663 [27.2%] Hispanic, 677 [11.1%] non-Hispanic Black, and 2678 [43.8%] non-Hispanic White patients) in the preattack phase, 7039 (mean [SD] age, 49.8 [19.5] years; 3377 [48.0%] female patients; 1840 [26.1%] Hispanic, 778 [11.1%] non-Hispanic Black, and 3168 [45.0%] non-Hispanic White patients) in the attack and recovery phase, and 6704 (mean [SD] age, 48.8 [19.6] years; 3326 [49.5%] female patients; 1753 [26.1%] Hispanic, 725 [10.8%] non-Hispanic Black, and 3012 [44.9%] non-Hispanic White patients) in the postattack phase. Compared with the preattack phase, during the attack phase, there were significant associated increases in the daily mean (SD) ED census (218.4 [18.9] vs 251.4 [35.2]; P < .001), EMS arrivals (1741 [28.8] vs 2354 [33.7]; P < .001), admissions (1614 [26.4] vs 1722 [24.5]; P = .01), patients leaving without being seen (158 [2.6] vs 360 [5.1]; P < .001), and patients leaving against medical advice (107 [1.8] vs 161 [2.3]; P = .03). There were also significant associated increases during the attack phase compared with the preattack phase in median waiting room times (21 minutes [IQR, 7-62 minutes] vs 31 minutes [IQR, 9-89 minutes]; P < .001) and total ED length of stay for admitted patients (614 minutes [IQR, 424-1093 minutes] vs 822 minutes [IQR, 497-1524 minutes]; P < .001). There was also a significant increase in stroke code activations during the attack phase compared with the preattack phase (59 vs 102; P = .01) as well as confirmed strokes (22 vs 47; P = .02).

Conclusions and Relevance

This study found that hospitals adjacent to health care delivery organizations affected by ransomware attacks may see increases in patient census and may experience resource constraints affecting time-sensitive care for conditions such as acute stroke. These findings suggest that targeted hospital cyberattacks may be associated with disruptions of health care delivery at nontargeted hospitals within a community and should be considered a regional disaster.

A National Survey of Hospital Cyber Attack Emergency Operation Preparedness

OBJECTIVE

Cyberattacks on healthcare systems are increasing in frequency and severity. Hospitals need to integrate cybersecurity preparedness into their emergency operations planning and response to mitigate adverse outcomes during increasingly likely cyber events. No data currently exist regarding the level of preparedness of United States hospital systems for cybersecurity attacks. We surveyed hospital emergency managers to assess cybersecurity preparedness for these events.

METHODS

Fifty-seven emergency managers representing hospitals across the United States participated in an online Qualtrics survey regarding current preparedness and response procedures for cybersecurity hazards.

RESULTS

Survey responses between April 2019 and May 2021 demonstrated that a majority of hospital systems surveyed included cybersecurity disasters in their HVA (82.4%; 47/57), and most ranked it as 1 of their top 5 priorities (57.4%; 27/47). However, over half denied specifically mentioning cybersecurity in their Emergency Operations Plans (EOPs; 52.6%; 30/57). Fourteen of the 57 hospital systems (24.5%) endorsed previously activating an emergency response for a cybersecurity incident unrelated to information technology (IT) failure.

CONCLUSIONS

The survey results suggest that American hospitals are currently underprepared for cybersecurity disasters. We emphasize the importance of prioritizing cybersecurity in Hazard Vulnerability Analyses (HVAs) and implementing specific EOP annexes for cybersecurity emergencies.

Breast Imaging During a Cyberattack and Global Pandemic: What We Did to Pick Up the Pieces

Cybersecurity in healthcare is a very real threat with the potential to severely disrupt patient care, place extra burden on an already strained system, and result in significant financial losses for a hospital or healthcare network. In October 2020, on the backdrop of the ongoing COVID-19 pandemic, our institution experienced one of the most significant cyberattacks on a healthcare system to date, lasting for nearly 40 days. By sharing our experience in radiology, and specifically in breast imaging, including the downtime procedures we relied upon and the lessons that we learned emerging from this cyberattack, we hope to help future victims of a healthcare cyberattack successfully weather such an experience.

Information design to support growth, quality, and equity of the US transplant system

The Organ Procurement and Transplantation Network, an arm of the Health Resources and Services Administration, has a contract with the United Network for Organ Sharing since 1986 to provide central oversight of organ donation and transplants in the United States. The United Network for Organ Sharing has recently come under scrutiny, prompting a review by the National Academies of Sciences, Engineering, and Medicine as summarized in its recent report and also by the US Senate Finance Committee. The national news services have opined about organ donation ethics, access to transplantation particularly for medically underserved populations, and management of organ transplantation data. These critiques raise important concerns that deserve our best response as a transplant community. Broadly, we suggest that the data management approach of the Organ Procurement and Transplantation Network be replaced with a patient-centric omnichannel network in which all donor and recipient data exist in a single longitudinal record that can be used by all applications. A more comprehensive and standardized approach to donor data collection would drive quality improvement across organ procurement organizations and help address inequities in transplantation. Finally, a substantial increase in organ donation would be prompted by considering organ donors as a public health resource, meriting transparent publicly available data collection with respect to organ donor referral, screening, and management.

It takes a pirate to know one: ethical hackers for healthcare cybersecurity

Healthcare cybersecurity is increasingly targeted by malicious hackers. This sector has many vulnerabilities and health data is very sensitive and valuable. Consequently, any damage caused by malicious intrusions is particularly alarming. The consequences of these attacks can be enormous and endanger patient care. Amongst the already-implemented cybersecurity measures and the ones that need to be further improved, this paper aims to demonstrate how penetration tests can greatly benefit healthcare cybersecurity. It is already proven that this approach has enforced cybersecurity in other sectors. However, it is not popular in healthcare since many prejudices still surround the hacking practice and there is a lack of education on hackers' categories and their ethics. The present analysis aims to comprehend what hacker ethics is and who ethical hackers are. Currently, hacker ethics has the status of personal ethics; however, to employ penetration testers in healthcare, it is recommended to draft an official code of ethics, comprising principles, standards, expectations, and best practices. Additionally, it is important to distinguish between malicious hackers and ethical hackers. Amongst the latter, penetration testers are only a sub-category. Acknowledging the subtle differences between ethical hackers and penetration testers allows to better understand why and how the latter can offer their services to healthcare facilities.

Ethical Development of Digital Phenotyping Tools for Mental Health Applications: Delphi Study

BACKGROUND

Digital phenotyping (also known as personal sensing, intelligent sensing, or body computing) involves the collection of biometric and personal data in situ from digital devices, such as smartphones, wearables, or social media, to measure behavior or other health indicators. The collected data are analyzed to generate moment-by-moment quantification of a person's mental state and potentially predict future mental states. Digital phenotyping projects incorporate data from multiple sources, such as electronic health records, biometric scans, or genetic testing. As digital phenotyping tools can be used to study and predict behavior, they are of increasing interest for a range of consumer, government, and health care applications. In clinical care, digital phenotyping is expected to improve mental health diagnoses and treatment. At the same time, mental health applications of digital phenotyping present significant areas of ethical concern, particularly in terms of privacy and data protection, consent, bias, and accountability.

OBJECTIVE

This study aims to develop consensus statements regarding key areas of ethical guidance for mental health applications of digital phenotyping in the United States.

METHODS

We used a modified Delphi technique to identify the emerging ethical challenges posed by digital phenotyping for mental health applications and to formulate guidance for addressing these challenges. Experts in digital phenotyping, data science, mental health, law, and ethics participated as panelists in the study. The panel arrived at consensus recommendations through an iterative process involving interviews and surveys. The panelists focused primarily on clinical applications for digital phenotyping for mental health but also included recommendations regarding transparency and data protection to address potential areas of misuse of digital phenotyping data outside of the health care domain.

RESULTS

The findings of this study showed strong agreement related to these ethical issues in the development of mental health applications of digital phenotyping: privacy, transparency, consent, accountability, and fairness. Consensus regarding the recommendation statements was strongest when the guidance was stated broadly enough to accommodate a range of potential applications. The privacy and data protection issues that the Delphi participants found particularly critical to address related to the perceived inadequacies of current regulations and frameworks for protecting sensitive personal information and the potential for sale and analysis of personal data outside of health systems.

CONCLUSIONS

The Delphi study found agreement on a number of ethical issues to prioritize in the development of digital phenotyping for mental health applications. The Delphi consensus statements identified general recommendations and principles regarding the ethical application of digital phenotyping to mental health. As digital phenotyping for mental health is implemented in clinical care, there remains a need for empirical research and consultation with relevant stakeholders to further understand and address relevant ethical issues.

Comparison of Autof ms1000 and Bruker Biotyper MALDI-TOF MS Platforms for Routine Identification of Clinical Microorganisms

Matrix-assisted laser desorption ionization-time of flight mass spectrometry (MALDI-TOF MS) is widely used in clinical microbiology laboratories because it is cost-effective, reliable, and fast. This study is aimed at comparing the identification performance of the recently developed Autof ms1000 (Autobio, China) with that of the Bruker Biotyper (Bruker Daltonics, Germany). From January to June 2020, 205 preserved strains and 302 clinical isolates were used for comparison. Bacteria were tested with duplicates of the direct transfer method, and formic acid extraction was performed if the results were not at the species level. Fungi were tested with formic acid extraction followed by ethanol extraction methods. 16S rRNA or ITS region sequence analysis was performed on isolates that could not be identified by any of the instruments and on isolates that showed inconsistent results. The time to result of each instrument was also compared. Among preserved strains, species-level identification results were obtained in 202 (98.5%) strains by the Autof ms1000 and 200 (97.6%) strains by the Bruker Biotyper. Correct identification at the species/complex level was obtained for 200 (97.6%) strains by the Autof ms1000 and for 199 (97.1%) strains by the Bruker Biotyper. Among clinical isolates, species-level identification results were obtained in 301 (99.7%) strains and 300 (99.3%) strains by the Autof ms1000 and Bruker Biotyper, respectively. Correct identification at the species/complex level was achieved for 299 (99.0%) strains by the Autof ms1000 and for 300 (99.3%) strains by the Bruker Biotyper. The time to analyze 96 spots was approximately 14 min for the Autof ms1000 and approximately 27 min for the Bruker Biotyper. The two instruments showed comparable performance for the routine identification of clinical microorganisms. In addition, the Autof ms1000 has a short test time, making it convenient for use in clinical microbiology laboratories.

2021 ISHNE/HRS/EHRA/APHRS Expert Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals: From the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia-Pacific Heart Rhythm Society

Supplemental Digital Content is available in the text.

This collaborative statement from the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia-Pacific Heart Rhythm Society describes the current status of mobile health technologies in arrhythmia management. The range of digital medical tools and heart rhythm disorders that they may be applied to and clinical decisions that may be enabled are discussed. The facilitation of comorbidity and lifestyle management (increasingly recognized to play a role in heart rhythm disorders) and patient self-management are novel aspects of mobile health. The promises of predictive analytics but also operational challenges in embedding mobile health into routine clinical care are explored.

Information management practices in public tertiary health-care facilities: an empirical investigation from the state of Kuwait

Purpose

This paper aims to gain insights about information management practices in public health-care organizations in Kuwait and offer recommendations to improve these practices.

Design/methodology/approach

This study involves secondary analysis of quantitative and qualitative accreditation-related data pertaining to the compliance with the Information Management standard at seven public tertiary health-care facilities over two accreditation cycles.

Findings

Overall, organizations improved their compliance with the Information Management standard. However, issues exist with effectively and efficiently transmitting data, aggregating clinical and administrative data and using the information for both strategic planning and quality improvement initiatives.

Research limitations/implications

The analysed data set does not provide information about the improvements done between the accreditation cycles. Caution should be applied before assuming generalizability of the results, considering the context and social constructs around the health-care system is essential.

Practical implications

Compliance with predetermined criteria through accreditation can improve information management practices. Without proper management of information at health-care facilities, achieving safe and effective patient care is futile. The role of health information technology (IT) should not be sidelined; robust health IT solutions can help support good information management practices thereby improving care quality and aiding health-care reform.

Originality/value

Concerning information management, health-care organizations providing focused services have clear advantages over organizations providing general care services. Considering the type of care organization (general vs specialized) can provide insights into how information management practices can affect the operations of the organization.

2021 ISHNE/HRS/EHRA/APHRS Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals

This collaborative statement from the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia Pacific Heart Rhythm Society describes the current status of mobile health ("mHealth") technologies in arrhythmia management. The range of digital medical tools and heart rhythm disorders that they may be applied to and clinical decisions that may be enabled are discussed. The facilitation of comorbidity and lifestyle management (increasingly recognized to play a role in heart rhythm disorders) and patient self-management are novel aspects of mHealth. The promises of predictive analytics but also operational challenges in embedding mHealth into routine clinical care are explored.

2021 ISHNE/ HRS/ EHRA/ APHRS collaborative statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals: From the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia Pacific Heart Rhythm Society

This collaborative statement from the International Society for Holter and Noninvasive Electrocardiology/ Heart Rhythm Society/ European Heart Rhythm Association/ Asia Pacific Heart Rhythm Society describes the current status of mobile health ("mHealth") technologies in arrhythmia management. The range of digital medical tools and heart rhythm disorders that they may be applied to and clinical decisions that may be enabled are discussed. The facilitation of comorbidity and lifestyle management (increasingly recognized to play a role in heart rhythm disorders) and patient self‐management are novel aspects of mHealth. The promises of predictive analytics but also operational challenges in embedding mHealth into routine clinical care are explored.

2021 ISHNE/HRS/EHRA/APHRS collaborative statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals: From the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia Pacific Heart Rhythm Society

This collaborative statement from the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia Pacific Heart Rhythm Society describes the current status of mobile health (“mHealth”) technologies in arrhythmia management. The range of digital medical tools and heart rhythm disorders that they may be applied to and clinical decisions that may be enabled are discussed. The facilitation of comorbidity and lifestyle management (increasingly recognized to play a role in heart rhythm disorders) and patient self‐management are novel aspects of mHealth. The promises of predictive analytics but also operational challenges in embedding mHealth into routine clinical care are explored.

2021 ISHNE / HRS / EHRA / APHRS Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals: From the International Society for Holter and Noninvasive Electrocardiology / Heart Rhythm Society / European Heart Rhythm Association / Asia Pacific Heart Rhythm Society

This collaborative statement from the International Society for Holter and Noninvasive Electrocardiology / Heart Rhythm Society / European Heart Rhythm Association / Asia Pacific Heart Rhythm Society describes the current status of mobile health ("mHealth") technologies in arrhythmia management. The range of digital medical tools and heart rhythm disorders that they may be applied to and clinical decisions that may be enabled are discussed. The facilitation of comorbidity and lifestyle management (increasingly recognized to play a role in heart rhythm disorders) and patient self-management are novel aspects of mHealth. The promises of predictive analytics but also operational challenges in embedding mHealth into routine clinical care are explored.

New glycine derived peptides bearing benzenesulphonamide as an antiplasmodial agent

In the tropics, malaria is among the most serious infectious diseases in developing countries. The discovery of the artemesinin antimalarial drug not too long ago was a major breakthrough in the effort to combat the malaria disease.

Health Outcomes and Healthcare Efficiencies Associated with the Use of Electronic Health Records in Hospital Emergency Departments: a Systematic Review

Healthcare organisations and governments have invested heavily in electronic health records in anticipation that they will deliver improved health outcomes for consumers and efficiencies across emergency departments. Despite such investment, electronic health records designed to support emergency care have been poorly evaluated. Given the accelerated development and adoption of information technology across healthcare, it is timely that a systematic review of this evidence base is updated in order to drive improvements to design, interoperability and overall clinical utility of electronic health record systems implemented in emergency departments. To assess the impact of electronic health records on healthcare outcomes and efficiencies in the emergency department we carried out a systematic review of published studies on this topic. This is the first review to summarise the cost efficiencies associated with electronic health record use outside of just the United States of America. A systematic search was performed in three scientific databases (MEDLINE, EMcare and EMBASE), of literature published between January 2000 and September 2019. Studies were included in this review if they evaluated electronic health records or health information exchanges (and synonyms for these terms), reported patient outcome and/or healthcare efficiency benefits, were peer-reviewed and published in English. Out of 6635 articles, 23 studies met our inclusion criteria. Wide variation regarding electronic health record access in the emergency department was reported (1.46-56.6%), yet was most frequently reported as less than 20%. Seven different types of health outcomes and three different types of efficiency improvements associated with electronic health record use in the emergency department were identified. The most frequently reported findings were efficiencies, including reductions in diagnostic tests, imaging and costs. This review is the first to report moderate to significant increases in admission rates are associated with electronic health record use in the emergency department, contrasting the findings of previous reviews. Diversity in the methodology employed across the included studies emphasises the need for further research to examine the impact of electronic health record implementation and system design on the findings reported, in order to ensure return on investment for stakeholders and optimised consumer care.

Trends and best practices in health care cybersecurity insurance policy

Health care organizations are a major target for cyberattacks. This is primarily due to their peculiar vulnerabilities and attractiveness to nefarious cyber actors. Data breaches from these attacks present a significant threat to the viability of health care organizations, ranging from financial losses to compromised patient safety. Cybersecurity insurance has become an essential tool for mitigating financial liabilities that may arise from breaches for many organizations. This paper reviews the current state of cybersecurity insurance adoption in the health care sector. It highlights best practices in cybersecurity insurance policy for health care organizations and recommends future directions to strengthen cybersecurity and improve cybersecurity insurance.

Transforming Healthcare Cybersecurity from Reactive to Proactive: Current Status and Future Recommendations

The recent rise in cybersecurity breaches in healthcare organizations has put patients' privacy at a higher risk of being exposed. Despite this threat and the additional danger posed by such incidents to patients' safety, as well as operational and financial threats to healthcare organizations, very few studies have systematically examined the cybersecurity threats in healthcare. To lay a firm foundation for healthcare organizations and policymakers in better understanding the complexity of the issue of cybersecurity, this study explores the major type of cybersecurity threats for healthcare organizations and explains the roles of the four major players (cyber attackers, cyber defenders, developers, and end-users) in cybersecurity. Finally, the paper discusses a set of recommendations for the policymakers and healthcare organizations to strengthen cybersecurity in their organization.

Connected Medical Technology and Cybersecurity Informed Consent: A New Paradigm

Background

Connected medical technology is increasingly prevalent and offers both a host of new therapeutic potentials and cybersecurity-related considerations. Current practice largely does not include discussions of cybersecurity issues when clinicians obtain informed consent.

Objective

This paper aims to raise awareness about cybersecurity considerations for connected medical technology as they relate to informed consent discussions between patients and clinicians.

Methods

Clinicians, health care cybersecurity researchers, and informed consent experts propose the concept of a cybersecurity informed consent for connected medical technology.

Results

This viewpoint discusses concepts designed to facilitate further discussion on the need, development, and execution of cybersecurity informed consent.

Conclusions

Cybersecurity informed consent may be a necessary component of informed consent practices, as connected medical technology proliferates in the health care environment.

Federation in genomics pipelines: techniques and challenges

Federation is a popular concept in building distributed cyberinfrastructures, whereby computational resources are provided by multiple organizations through a unified portal, decreasing the complexity of moving data back and forth among multiple organizations. Federation has been used in bioinformatics only to a limited extent, namely, federation of datastores, e.g. SBGrid Consortium for structural biology and Gene Expression Omnibus (GEO) for functional genomics. Here, we posit that it is important to federate both computational resources (CPU, GPU, FPGA, etc.) and datastores to support popular bioinformatics portals, with fast-increasing data volumes and increasing processing requirements. A prime example, and one that we discuss here, is in genomics and metagenomics. It is critical that the processing of the data be done without having to transport the data across large network distances. We exemplify our design and development through our experience with metagenomics-RAST (MG-RAST), the most popular metagenomics analysis pipeline. Currently, it is hosted completely at Argonne National Laboratory. However, through a recently started collaborative National Institutes of Health project, we are taking steps toward federating this infrastructure. Being a widely used resource, we have to move toward federation without disrupting 50 K annual users. In this article, we describe the computational tools that will be useful for federating a bioinformatics infrastructure and the open research challenges that we see in federating such infrastructures. It is hoped that our manuscript can serve to spur greater federation of bioinformatics infrastructures by showing the steps involved, and thus, allow them to scale to support larger user bases.

Understanding health information management practices in public hospitals in Kuwait

BACKGROUND

Health information technology (IT) solutions can aid healthcare reform efforts, but without proper information management, these efforts are futile. In this study, we used Kuwait as an example of a high per-capita gross domestic product country that faces information management challenges to draw insights that can be generalised to other developed countries.

OBJECTIVE

(i) to uncover the status quo of information management practices in public hospitals and (ii) to offer recommendations to improve them.

METHOD

This study analysed qualitative and quantitative accreditation-related data pertaining to the compliance with the information management standard at all secondary care public hospitals over two accreditation cycles.

RESULTS

Overall, public hospitals had made positive progress in their compliance with the information management standard. However, issues still existed with (i) developing and implementing an information management plan, (ii) involving the appropriate stakeholders in selecting health IT solutions and (iii) access to the Internet by staff and patients.

CONCLUSION

Evidence underscored the importance of proper information management driven by clear centralised strategic plans.

IMPLICATIONS

With the rapid adoption of digital health systems, the role of health information management leaders should not be undervalued. Embracing health IT solutions with strong information management practices can aid healthcare reform efforts.

Health Care and Cybersecurity: Bibliometric Analysis of the Literature

Background

Over the past decade, clinical care has become globally dependent on information technology. The cybersecurity of health care information systems is now an essential component of safe, reliable, and effective health care delivery.

Objective

The objective of this study was to provide an overview of the literature at the intersection of cybersecurity and health care delivery.

Methods

A comprehensive search was conducted using PubMed and Web of Science for English-language peer-reviewed articles. We carried out chronological analysis, domain clustering analysis, and text analysis of the included articles to generate a high-level concept map composed of specific words and the connections between them.

Results

Our final sample included 472 English-language journal articles. Our review results revealed that majority of the articles were focused on technology: Technology–focused articles made up more than half of all the clusters, whereas managerial articles accounted for only 32% of all clusters. This finding suggests that nontechnological variables (human–based and organizational aspects, strategy, and management) may be understudied. In addition, Software Development Security, Business Continuity, and Disaster Recovery Planning each accounted for 3% of the studied articles. Our results also showed that publications on Physical Security account for only 1% of the literature, and research in this area is lacking. Cyber vulnerabilities are not all digital; many physical threats contribute to breaches and potentially affect the physical safety of patients.

Conclusions

Our results revealed an overall increase in research on cybersecurity and identified major gaps and opportunities for future work.

EARS to cyber incidents in health care

Background

Connected medical devices and electronic health records have added important functionality to patient care, but have also introduced a range of cybersecurity concerns. When a healthcare organization suffers from a cybersecurity incident, its incident response strategies are critical to the success of its recovery.

Objective

In this article, we identify gaps in research concerning cybersecurity response plans in healthcare. Through a systematic literature review, we develop aggregated strategies that professionals can use to construct better response strategies in their organizations.

Methods

We reviewed journal articles on cyber incident response plans in healthcare published in PubMed and Web of Science. We sought to collect articles on the intersection of cybersecurity and healthcare that focused on incident response strategies.

Results

We identified and reviewed 13 articles for cybersecurity response recommendations. We then extracted information such as research methods, findings, and implications. Finally, we synthesized the recommendations into a framework of eight aggregated response strategies (EARS) that fall under managerial and technological categories.

Conclusions

We conducted a systematic review of the literature on cybersecurity response plans in healthcare and developed a novel framework for response strategies that could be deployed by healthcare organizations. More work is needed to evaluate incident response strategies in healthcare.

Wearable Devices in Clinical Trials: Hype and Hypothesis

The development of innovative wearable technologies has raised great interest in new means of data collection in healthcare and biopharmaceutical research and development. Multiple applications for wearables have been identified in a number of therapeutic areas; however, researchers face many challenges in the clinic, including scientific methodology as well as regulatory, legal, and operational hurdles. To facilitate further evaluation and adoption of these technologies, we highlight methodological and logistical considerations for implementation in clinical trials, including key elements of analytical and clinical validation in the specific context of use (COU). Additionally, we provide an assessment of the maturity of the field and successful examples of recent clinical experiments.

Cybersecurity in Hospitals: A Systematic, Organizational Perspective

BACKGROUND

Cybersecurity incidents are a growing threat to the health care industry in general and hospitals in particular. The health care industry has lagged behind other industries in protecting its main stakeholder (ie, patients), and now hospitals must invest considerable capital and effort in protecting their systems. However, this is easier said than done because hospitals are extraordinarily technology-saturated, complex organizations with high end point complexity, internal politics, and regulatory pressures.

OBJECTIVE

The purpose of this study was to develop a systematic and organizational perspective for studying (1) the dynamics of cybersecurity capability development at hospitals and (2) how these internal organizational dynamics interact to form a system of hospital cybersecurity in the United States.

METHODS

We conducted interviews with hospital chief information officers, chief information security officers, and health care cybersecurity experts; analyzed the interview data; and developed a system dynamics model that unravels the mechanisms by which hospitals build cybersecurity capabilities. We then use simulation analysis to examine how changes to variables within the model affect the likelihood of cyberattacks across both individual hospitals and a system of hospitals.

RESULTS

We discuss several key mechanisms that hospitals use to reduce the likelihood of cybercriminal activity. The variable that most influences the risk of cyberattack in a hospital is end point complexity, followed by internal stakeholder alignment. Although resource availability is important in fueling efforts to close cybersecurity capability gaps, low levels of resources could be compensated for by setting a high target level of cybersecurity.

CONCLUSIONS

To enhance cybersecurity capabilities at hospitals, the main focus of chief information officers and chief information security officers should be on reducing end point complexity and improving internal stakeholder alignment. These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. On a macro level, the cyber vulnerability of a country's hospital infrastructure is affected by the vulnerabilities of all individual hospitals. In this large system, reducing variation in resource availability makes the whole system less vulnerable-a few hospitals with low resources for cybersecurity threaten the entire infrastructure of health care. In other words, hospitals need to move forward together to make the industry less attractive to cybercriminals. Moreover, although compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies. As of today, policies mostly address data privacy, not data security. Thus, policy makers need to introduce policies that not only raise the target level of cybersecurity capabilities but also reduce the variability in resource availability across the entire health care system.

Using digital health to enable ethical health research in conflict and other humanitarian settings

Conducting research in a humanitarian setting requires quantifiable quality measures to ensure ethical study conduct. Digital health technologies are proven to improve research study quality and efficacy via automated data collection, improvement of data reliability, fidelity and resilience and by improved data provenance and traceability. Additionally, digital health methodologies can improve patient identity, patient privacy, study transparency, data sharing, competent informed consent, and the confidentiality and security of humanitarian operations. It can seem counterintuitive to press forward aggressively with digital technologies at a time of heightened population vulnerability and cyber security concerns, but new approaches are essential to meet the rapidly increasing demands of humanitarian research. In this paper we present the case for the digital modernization of humanitarian research in conflict and other humanitarian settings as a vehicle for improved research quality and ethics.

Portable devices and mobile instruments for infectious diseases point-of-care testing

INTRODUCTION

Rapidity, simplicity, and portability are highly desirable characteristics of tests and devices designed for performing diagnostics at the point of care (POC), either near patients managed in healthcare facilities or to offer bioanalytical alternatives in external settings. By reducing the turnaround time of the diagnostic cycle, POC diagnostics can reduce the dissemination, morbidity, and mortality of infectious diseases and provide tools to control the global threat of antimicrobial resistance. Areas covered: A literature search of PubMed and Google Scholar, and extensive mining of specialized publications, Internet resources, and manufacturers' websites have been used to organize and write this overview of the challenges and requirements associated with the development of portable sample-to-answer diagnostics, and showcase relevant examples of handheld devices, portable instruments, and less mobile systems which may or could be operated at POC. Expert commentary: Rapid (<1 h) diagnostics can contribute to control infectious diseases and antimicrobial resistant pathogens. Portable devices or instruments enabling sample-to-answer bioanalysis can provide rapid, robust, and reproducible testing at the POC or close from it. Beyond testing, to realize some promises of personalized/precision medicine, it will be critical to connect instruments to healthcare data management systems, to efficiently link decentralized testing results to the electronic medical record of patients.

A cybersecurity primer for translational research

Virtually all health care organizations have had at least one data breach since 2012. Most of the largest data breaches and Health Care Information Privacy and Accountability Act fines could have been prevented by the simplest of strategies. Each researcher must clearly understand his or her responsibilities and liability.

Understanding factors affecting patient and public engagement and recruitment to digital health interventions: a systematic review of qualitative studies

BACKGROUND

Numerous types of digital health interventions (DHIs) are available to patients and the public but many factors affect their ability to engage and enrol in them. This systematic review aims to identify and synthesise the qualitative literature on barriers and facilitators to engagement and recruitment to DHIs to inform future implementation efforts.

METHODS

PubMed, MEDLINE, CINAHL, Embase, Scopus and the ACM Digital Library were searched for English language qualitative studies from 2000 - 2015 that discussed factors affecting engagement and enrolment in a range of DHIs (e.g. 'telemedicine', 'mobile applications', 'personal health record', 'social networking'). Text mining and additional search strategies were used to identify 1,448 records. Two reviewers independently carried out paper screening, quality assessment, data extraction and analysis. Data was analysed using framework synthesis, informed by Normalization Process Theory, and Burden of Treatment Theory helped conceptualise the interpretation of results.

RESULTS

Nineteen publications were included in the review. Four overarching themes that affect patient and public engagement and enrolment in DHIs emerged; 1) personal agency and motivation; 2) personal life and values; 3) the engagement and recruitment approach; and 4) the quality of the DHI. The review also summarises engagement and recruitment strategies used. A preliminary DIgital Health EnGagement MOdel (DIEGO) was developed to highlight the key processes involved. Existing knowledge gaps are identified and a number of recommendations made for future research. Study limitations include English language publications and exclusion of grey literature.

CONCLUSION

This review summarises and highlights the complexity of digital health engagement and recruitment processes and outlines issues that need to be addressed before patients and the public commit to digital health and it can be implemented effectively. More work is needed to create successful engagement strategies and better quality digital solutions that are personalised where possible and to gain clinical accreditation and endorsement when appropriate. More investment is also needed to improve computer literacy and ensure technologies are accessible and affordable for those who wish to sign up to them.

SYSTEMATIC REVIEW REGISTRATION

International Prospective Register of Systematic Reviews CRD42015029846.

Discussion of "Combining Health Data Uses to Ignite Health System Learning"

This article is part of a For-Discussion-Section of Methods of Information in Medicine about the paper "Combining Health Data Uses to Ignite Health System Learning" written by John D. Ainsworth and Iain E. Buchan [1]. It is introduced by an editorial. This article contains the combined commentaries invited to independently comment on the paper of Ainsworth and Buchan. In subsequent issues the discussion can continue through letters to the editor. With these comments on the paper "Combining Health Data Uses to Ignite Health System Learning", written by John D. Ainsworth and Iain E. Buchan [1], the journal seeks to stimulate a broad discussion on new ways for combining data sources for the reuse of health data in order to identify new opportunities for health system learning. An international group of experts has been invited by the editor of Methods to comment on this paper. Each of the invited commentaries forms one section of this paper.

Cybersecurity for Connected Diabetes Devices

Diabetes devices are increasingly connected wirelessly to each other and to data-displaying reader devices. Threats to the accurate flow of information and commands may compromise the function of these devices and put their users at risk of health complications. Sound cybersecurity of connected diabetes devices is necessary to maintain confidentiality, integrity, and availability of the data and commands. Diabetes devices can be hacked by unauthorized agents and also by patients themselves to extract data that are not automatically provided by product software. Unauthorized access to connected diabetes devices has been simulated and could happen in reality. A cybersecurity standard designed specifically for connected diabetes devices will improve the safety of these products and increase confidence of users that the products will be secure.