Hospital cybersecurity risks and gaps: Review (for the non-cyber professional)

DIMScern: A Framework for Discerning DIMSE Services on Remote Medical Devices

In the medical domain, computer systems in digital healthcare have increased connectivity continuously and the DICOM Message Service Element (DIMSE) protocol has a critical role in exchanging biomedical imaging data among different digital healthcare systems. As the data communication technology is used to handle sensitive information such as patient information (e.g., patient's name, date of birth, and address) and medical images (e.g., ultrasound, X-ray, and MRI), it has emerged as a major target for security attacks. In this work, we study security concerns on the message exchange method used in the DIMSE protocol. It is important to know which DIMSE services are available on a given healthcare IT system to an adversary and we observe that the DIMSE protocol can be implemented in various ways across products, with each supporting different DIMSE services as well. We present DIMScern, a framework for discerning DIMSE services on remote medical devices. To show the effectiveness of DIMScern, we evaluate our framework on multiple DIMSE implementations, including commercial products and libraries, and identify the supported DIMSE services of them. We demonstrate that DIMScern successfully identifies medical services that are supported differently across 22 healthcare IT systems in a remote environment.

AI illuminates paths in oral cancer: transformative insights, diagnostic precision, and personalized strategies

Oral cancer retains one of the lowest survival rates worldwide, despite recent therapeutic advancements signifying a tenacious challenge in healthcare. Artificial intelligence exhibits noteworthy potential in escalating diagnostic and treatment procedures, offering promising advancements in healthcare. This review entails the traditional imaging techniques for the oral cancer treatment. The role of artificial intelligence in prognosis of oral cancer including predictive modeling, identification of prognostic factors and risk stratification also discussed significantly in this review. The review also encompasses the utilization of artificial intelligence such as automated image analysis, computer-aided detection and diagnosis integration of machine learning algorithms for oral cancer diagnosis and treatment. The customizing treatment approaches for oral cancer through artificial intelligence based personalized medicine is also part of this review. See also the graphical abstract(Fig. 1).

Doctors' perception on the ethical use of AI-enabled clinical decision support systems for antibiotic prescribing recommendations in Singapore

Objectives

The increased utilization of Artificial intelligence (AI) in healthcare changes practice and introduces ethical implications for AI adoption in medicine. We assess medical doctors' ethical stance in situations that arise in adopting an AI-enabled Clinical Decision Support System (AI-CDSS) for antibiotic prescribing decision support in a healthcare institution in Singapore.

Methods

We conducted in-depth interviews with 30 doctors of varying medical specialties and designations between October 2022 and January 2023. Our interview guide was anchored on the four pillars of medical ethics. We used clinical vignettes with the following hypothetical scenarios: (1) Using an antibiotic AI-enabled CDSS's recommendations for a tourist, (2) Uncertainty about the AI-CDSS's recommendation of a narrow-spectrum antibiotic vs. concerns about antimicrobial resistance, (3) Patient refusing the "best treatment" recommended by the AI-CDSS, (4) Data breach.

Results

More than half of the participants only realized that the AI-enabled CDSS could have misrepresented non-local populations after being probed to think about the AI-CDSS's data source. Regarding prescribing a broad- or narrow-spectrum antibiotic, most participants preferred to exercise their clinical judgment over the AI-enabled CDSS's recommendations in their patients' best interest. Two-thirds of participants prioritized beneficence over patient autonomy by convincing patients who refused the best practice treatment to accept it. Many were unaware of the implications of data breaches.

Conclusion

The current position on the legal liability concerning the use of AI-enabled CDSS is unclear in relation to doctors, hospitals and CDSS providers. Having a comprehensive ethical legal and regulatory framework, perceived organizational support, and adequate knowledge of AI and ethics are essential for successfully implementing AI in healthcare.

Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review

BACKGROUND

Health care organizations worldwide are faced with an increasing number of cyberattacks and threats to their critical infrastructure. These cyberattacks cause significant data breaches in digital health information systems, which threaten patient safety and privacy.

OBJECTIVE

From a sociotechnical perspective, this paper explores why digital health care systems are vulnerable to cyberattacks and provides sociotechnical solutions through a systematic literature review (SLR).

METHODS

An SLR using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) was conducted by searching 6 databases (PubMed, Web of Science, ScienceDirect, Scopus, Institute of Electrical and Electronics Engineers, and Springer) and a journal (Management Information Systems Quarterly) for articles published between 2012 and 2022 and indexed using the following keywords: "(cybersecurity OR cybercrime OR ransomware) AND (healthcare) OR (cybersecurity in healthcare)." Reports, review articles, and industry white papers that focused on cybersecurity and health care challenges and solutions were included. Only articles published in English were selected for the review.

RESULTS

In total, 5 themes were identified: human error, lack of investment, complex network-connected end-point devices, old legacy systems, and technology advancement (digitalization). We also found that knowledge applications for solving vulnerabilities in health care systems between 2012 to 2022 were inconsistent.

CONCLUSIONS

This SLR provides a clear understanding of why health care systems are vulnerable to cyberattacks and proposes interventions from a new sociotechnical perspective. These solutions can serve as a guide for health care organizations in their efforts to prevent breaches and address vulnerabilities. To bridge the gap, we recommend that health care organizations, in partnership with educational institutions, develop and implement a cybersecurity curriculum for health care and intelligence information sharing through collaborations; training; awareness campaigns; and knowledge application areas such as secure design processes, phase-out of legacy systems, and improved investment. Additional studies are needed to create a sociotechnical framework that will support cybersecurity in health care systems and connect technology, people, and processes in an integrated manner.

Design and Pilot Study of a High-Fidelity Medical Simulation of a Hospital-Wide Cybersecurity Attack

Background

Cybersecurity incidents affecting hospitals have grown in prevalence and consequence over the last two decades, increasing the importance of cybersecurity preparedness and response training to minimize clinical disruptions. This work describes the development, execution, and post-exercise assessment of a novel simulation scenario consisting of four interlocking intensive care unit (ICU) patient scenarios. This simulation was designed to demonstrate the management of acute pathologies without access to conventional treatment methods during a cybersecurity incident in order to raise clinician awareness of the increasing incidence and patient safety implications of such events.

Methods

The simulation was developed by a multidisciplinary team of physicians, simulation experts, and medical education experts at UCSD School of Medicine. The simulation involves the treatment of four patients, respectively experiencing postoperative hemorrhage, end stage renal disease, diabetic ketoacidosis, and hypoxic respiratory failure, all without access to networked medical resources. The simulation was first executed as part of the proceedings of CyberMed Summit, a healthcare cybersecurity conference in La Jolla, California, on November 19th, 2022. Following the simulation, a debrief session was held with the learner in front of conference attendees, with additional questioning and discussion prompted by attendee input.

Results

Though limited to a single subject by the pilot-study nature of this research, the physician learner successfully identified the acute etiologies and managed the patients' acute decompensations while lacking access to the hospital's electronic medical records (EMRs), laboratory results, imaging, and communication systems. Review of footage of the event and post-experience interviews yielded numerous insights on the specific physician-focused challenges and possible solutions to a hospital-infrastructure-crippling cyber attack.

Conclusion

Healthcare cybersecurity incidents are known to result in significant disruption of clinical activities and can be viewed through a patient-safety oriented perspective. Simulation training may be a particularly effective method for raising clinician awareness of and preparedness for these events, though further research is required.

Dealing with digital paralysis: Surviving a cyberattack in a National Cancer center

INTRODUCTION

Cyberattacks represent a growing threat for healthcare delivery globally. We assess the impact and implications of a cyberattack on a cancer center in Ireland.

METHODS

On May 14th 2021 (day 0) Cork University Hospital (CUH) Cancer Center was involved in the first national healthcare ransomware attack in Ireland. Contingency plans were only present in laboratory services who had previously experienced information technology (IT) failures. No hospital cyberattack emergency plan was in place. Departmental logs of activity for 120 days after the attack were reviewed and compared with historical activity records. Daily sample deficits (routine daily number of samples analyzed - number of samples analyzed during cyberattack) were calculated. Categorical variables are reported as median and range. Qualitative data were collected via reflective essays and interviews with key stakeholders from affected departments in CUH.

RESULTS

On day 0, all IT systems were shut down. Radiotherapy (RT) treatment and cancer surgeries stopped, outpatient activity fell by 50%. hematology, biochemistry and radiology capacity fell by 90% (daily sample deficit (DSD) 2700 samples), 75% (DSD 2250 samples), and 90% (100% mammography/PET scan) respectively. Histopathology reporting times doubled (7 to 15 days). Radiotherapy (RT) was interrupted for 113 patients in CUH. The median treatment gap duration was six days for category 1 patients and 10 for the remaining patients. Partner organizations paused all IT links with CUH. Outsourcing of radiology and radiotherapy commenced, alternative communication networks and national conference calls in RT and Clinical Trials were established. By day 28 Email communication was restored. By day 210 reporting and data storage backlogs were cleared and over 2000 computers were checked/replaced.

CONCLUSION

Cyberattacks have rapid, profound and protracted impacts. While laboratory and diagnostic deficits were readily quantified, the impact of disrupted/delayed care on patient outcomes is less readily quantifiable. Cyberawareness and cyberattack plans need to be embedded in healthcare.

POLICY SUMMARY

Cyberattacks pose significant challenges for healthcare systems, impacting patient care, clinical outcomes, and staff wellbeing. This study provides a comprehensive review of the impact of the Conti ransomware attack on cancer services in Cork University Hospital (CUH), the first cyberattack on a national health service. Our study highlights the widespread disruption caused by a cyberattack including shutdown of information technology (IT) services, marked reduction in outpatient activity, temporary cessation of essential services such as radiation therapy. We provide a framework for other institutions for mitigating the impact of a cyberattack, underscoring the need for a cyberpreparedness plan similar to those made for natural disasters and the profound legacy of a cyberattack on patient care.

Enhancing Internet of Medical Things security with artificial intelligence: A comprehensive review

Over the past five years, interest in the literature regarding the security of the Internet of Medical Things (IoMT) has increased. Due to the enhanced interconnectedness of IoMT devices, their susceptibility to cyber-attacks has proportionally escalated. Motivated by the promising potential of AI-related technologies to improve certain cybersecurity measures, we present a comprehensive review of this emerging field. In this review, we attempt to bridge the corresponding literature gap regarding modern cybersecurity technologies that deploy AI techniques to improve their performance and compensate for security and privacy vulnerabilities. In this direction, we have systematically gathered and classified the extensive research on this topic. Our findings highlight the fact that the integration of machine learning (ML) and deep learning (DL) techniques improves both the performance of cybersecurity measures and their speed, reliability, and effectiveness. This may be proven to be useful for improving the security and privacy of IoMT devices. Furthermore, by considering the numerous advantages of AI technologies as opposed to their core cybersecurity counterparts, including blockchain, anomaly detection, homomorphic encryption, differential privacy, federated learning, and so on, we provide a structured overview of the current scientific trends. We conclude with considerations for future research, emphasizing the promising potential of AI-driven cybersecurity in the IoMT landscape, especially in patient data protection and in data-driven healthcare.

Navigating the Future: The Transformative Impact of Artificial Intelligence on Hospital Management- A Comprehensive Review

This comprehensive review explores the transformative impact of artificial intelligence (AI) on hospital management, delving into its applications, challenges, and future trends. Integrating AI in administrative functions, clinical operations, and patient engagement holds significant promise for enhancing efficiency, optimizing resource allocation, and revolutionizing patient care. However, this evolution is accompanied by ethical, legal, and operational considerations that necessitate careful navigation. The review underscores key findings, emphasizing the implications for the future of hospital management. It calls for a proactive approach, urging stakeholders to invest in education, prioritize ethical guidelines, foster collaboration, advocate for thoughtful regulation, and embrace a culture of innovation. The healthcare industry can successfully navigate this transformative era through collective action, ensuring that AI contributes to more effective, accessible, and patient-centered healthcare delivery.

Leveraging telemedicine in gastroenterology and hepatology: a narrative review

Background and Objective

Over the years, telemedicine has played a prominent role in delivering healthcare to patients. Due to its flexibility and many benefits, telemedicine confers physicians the ability to guide and promote medical care remotely. The advent of the coronavirus disease 2019 (COVID-19) pandemic has changed the landscape of medicine and has accelerated the usage of digital and remote healthcare systems for clinical care. Herein, we provide an overview of telemedicine, its applications in managing inflammatory bowel disease (IBD), celiac disease (CD), and liver diseases, its advantages and limitations, and its use in educating the next generation of gastroenterologists.

Methods

We conducted a review of scientific articles published in PubMed and Google Scholar. Articles were selected based on the search terms included in the search strategy summary. The language of the articles was restricted to English only.

Key Content and Findings

We report that telemedicine has the potential to streamline and improve patient care in gastroenterology (GI) and hepatology while also limiting health care expenses. Additionally, we noted the importance of tele-education for training the next generation of physicians who intend on practicing in rural settings. Furthermore, we identified barriers to telemedicine care that exacerbate health inequities and potential solutions to achieving digital health equity. Lastly, we briefly discuss the role of artificial intelligence (AI) in remote patient monitoring.

Conclusions

Although telemedicine has existed for many decades, over the past decade there have been many advancements in telemedicine applications in GI and hepatology. Despite its broad benefits, further research needs to be done to alleviate barriers to telemedicine care.

Clinicians' Perspectives on Healthcare Cybersecurity and Cyber Threats

INTRODUCTION

In today's world, healthcare systems face various risks, including data breaches, theft, and damage. This is where cybersecurity comes in, as it helps protect sensitive personal and financial data, such as electronic health records. This study delved into the perspectives of clinicians on cybersecurity in healthcare, exploring how it impacts patient safety and the functioning of organizations. The study also identified challenges associated with implementing cybersecurity measures and the risks of not doing so.

METHOD

This is a qualitative study in which clinical informaticians from different health science backgrounds were asked to share their opinions using the Delphi technique, with 48 participants engaging in all three rounds.

RESULTS

The study highlighted that 96% of participants deemed cybersecurity in healthcare critical for protecting data. Compliance with regulations (91.7%), reduced disruptions (69%), improved patient care (65%), trust (58.3%), and reputation (54%) were additional advantages. However, the study also identified top challenges to cybersecurity implementation, such as time/resource constraints (65%) and disruption to workflows/services (60.4%). Staff resistance, insider threats, and legacy system issues were also anticipated obstacles. Neglecting to implement cybersecurity measures in healthcare could lead to a higher risk of data breaches (96%), financial/legal penalties for hospitals (79%), and concerns about patient safety (65%).

CONCLUSION

It is imperative to prioritize cybersecurity in the healthcare industry to mitigate these risks and ensure patient confidence, health system stability, and, ultimately, save lives. A unified approach is required to enforce policies, modify behaviors, and adopt innovative practices to combat cyberattacks effectively.

Use of Facebook in a quality improvement campaign to increase adherence to guidelines in intensive care: A qualitative study of nurses' and physicians' experiences

OBJECTIVES

This study aimed to explore intensive care unit nurses' and physicians' experiences with professional content provided through closed Facebook groups, as part of a quality improvement campaign to improve guideline adherence.

RESEARCH METHODOLOGY

This study used an exploratory qualitative design. In June 2018, data were collected through focus groups of intensive care nurses and physicians who also were members of closed Facebook groups. Data were analysed using reflexive thematic analysis, and the study was reported according to the consolidated criteria for reporting qualitative research.

SETTING

The study's setting was four intensive care units at Oslo University Hospital, Norway. Professional content on Facebook comprised audit and feedback on quality indicators on intensive care topics with related pictures, videos, and weblinks.

FINDINGS

Two focus groups of 12 participants were included in this study. Two main themes were identified: 'One size does not fit all ' described that quality improvement and implementation are influenced by several factors related to current recommendations and personal preferences. Various strategies are required to serve different purposes and meet individual needs. 'Matter out of place' described conflicting experiences of being offered or exposed to professional content on Facebook.

CONCLUSION

Although the audit and feedback on quality indicators presented on Facebook motivated improvements, professional content on Facebook was perceived as inappropriate. Hospital platforms with applicable features of social media, such as reach, availability, convenience, ease, and possibility for commenting, were suggested to secure professional communication about recommended practices in intensive care units.

IMPLICATIONS FOR CLINICAL PRACTICE

Social media platforms may be useful for professional communication among ICU personnel, but appropriate hospital applications with available and applicable social media features are recommended and needed. The use of several platforms may still be needed to reach all.

Designing an Effective Organizational Culture to Guard Against the Cyber Risks of Emerging Technologies

The Internet of Medical Things (IoMT) and interoperable technologies have transformed how patient data affect medical care; such technological innovations revolutionize how healthcare organizations (HCOs) improve cost, quality, and access. New cyber risks, however, accompany developing cyber ecosystems. Although immediate data exchange is beneficial, risk arises from the IoMT's increased susceptibility to human influence. The success of quality care relies on protecting health information technology (HIT) against newly developing cyber vulnerabilities. Therefore, managers must be just as invested in their HCO's cybersecurity protocols as cybercriminals are in bypassing those protocols. This essay proposes a healthcare cyber resiliency model that leverages human and technical factors through a cycle of feedback and process improvement. It intends to equip healthcare administrators with the foundational philosophy necessary to secure their emerging technologies.

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

BACKGROUND

Over the last decade, the frequency and size of cyberattacks in the health care industry have increased, ranging from breaches of processes or networks to encryption of files that restrict access to data. These attacks may have multiple consequences for patient safety, as they can, for example, target electronic health records, access to critical information, and support for critical systems, thereby causing delays in hospital activities. The effects of cybersecurity breaches are not only a threat to patients' lives but also have financial consequences due to causing inactivity in health care systems. However, publicly available information on these incidents quantifying their impact is scarce.

OBJECTIVE

We aim, while using public domain data from Portugal, to (1) identify data breaches in the public national health system since 2017 and (2) measure the economic impact using a hypothesized scenario as a case study.

METHODS

We retrieved data from multiple national and local media sources on cybersecurity from 2017 until 2022 and built a timeline of attacks. In the absence of public information on cyberattacks, reported drops in activity were estimated using a hypothesized scenario for affected resources and percentages and duration of inactivity. Only direct costs were considered for estimates. Data for estimates were produced based on planned activity through the hospital contract program. We use sensitivity analysis to illustrate how a midlevel ransomware attack might impact health institutions' daily costs (inferring a potential range of values based on assumptions). Given the heterogeneity of our included parameters, we also provide a tool for users to distinguish such impacts of different attacks on institutions according to different contract programs, served population size, and proportion of inactivity.

RESULTS

From 2017 to 2022, we were able to identify 6 incidents in Portuguese public hospitals using public domain data (there was 1 incident each year and 2 in 2018). Financial impacts were obtained from a cost point of view, where estimated values have a minimum-to-maximum range of €115,882.96 to €2,317,659.11 (a currency exchange rate of €1=US $1.0233 is applicable). Costs of this range and magnitude were inferred assuming different percentages of affected resources and with different numbers of working days while considering the costs of external consultation, hospitalization, and use of in- and outpatient clinics and emergency rooms, for a maximum of 5 working days.

CONCLUSIONS

To enhance cybersecurity capabilities at hospitals, it is important to provide robust information to support decision-making. Our study provides valuable information and preliminary insights that can help health care organizations better understand the costs and risks associated with cyber threats and improve their cybersecurity strategies. Additionally, it demonstrates the importance of adopting effective preventive and reactive strategies, such as contingency plans, as well as enhanced investment in improving cybersecurity capabilities in this critical area while aiming to achieve cyber-resilience.

Biosafety and biosecurity challenges during the COVID-19 pandemic and beyond

As the world continues to battle the SARS-CoV-2 pandemic, it is a stark reminder of the devastation biological threats can cause. In an unprecedented way the global community saw a massive surge in the demand for diagnostic capacities, which had a substantial impact on biosafety and biosecurity. Laboratories had to cope with a surge in laboratory testing capacity, while resources and training possibilities were limited. In addition, the pandemic highlighted the impact biological threats can have, thereby giving rise to new dialogue about biosecurity and new biological threats. This paper aims to highlight some of the most pressing issues regarding biosafety and biosecurity observed during the COVID-19 pandemic with special focus on low and lower middle-income countries. The authors provide lessons learned, tools and recommendations to improve future biosafety and biosecurity and increase preparedness for the next global health crisis.