Cybersecurity Is a Patient-Safety Issue

In the summer of 2023, while my team was commissioning a new hospital, a large share of my attention went to a threat that had nothing to do with any disease. Hospitals hold vast amounts of personal and clinical data, and they depend on connected systems for almost everything they do. That makes them attractive targets. Health records are worth more to criminals than credit card details, and hospitals cannot afford to be offline.

Why this matters

Across the world, ransomware attacks have postponed cancer treatment, diverted ambulances and, in at least one case, contributed to a hospital closing because it could no longer process insurance claims. Large breaches have exposed the records of millions of patients, as when Australia's Medibank lost data on almost ten million customers in 2022.

The Gulf is not exempt. A 2023 study by Proofpoint reported that only a minority of leading hospitals in the UAE and Saudi Arabia had implemented recommended email-authentication protections. Many attacks in the region are never made public. I personally know of several healthcare organisations that have paid ransoms. The real scale is almost certainly larger than what is reported.

Hospitals are now expected to invest in cybersecurity on a scale closer to banks than to their own history, often on much thinner margins. That is a strategic decision for boards, not a technical one for the IT department.

Seven steps for hospital leaders

1. Govern it as a strategic risk. Put cyber risk on the board's risk register and review it as regularly as clinical and financial risk.

2. Appoint an accountable leader. A full-time security leader with the authority and independence to act, who briefs senior management regularly.

3. Plan for the worst day. Prepare incident response for ransomware and system outages, including how clinical care continues on paper if needed. Test it regularly.

4. Build a security culture. Every employee should see themselves as a defender of patient data, just as they are of patient safety. Training should be regular, practical and mandatory.

5. Secure systems and devices. Keep software current, use strong authentication and encryption, and include connected medical devices, which are often the weakest point.

6. Hold suppliers to the same standard. Many breaches come through third parties. Contract for security and monitor compliance.

7. Inform patients. Criminals impersonate hospitals to defraud patients. Tell patients how you will and will not contact them.

A role for accreditation

In 2023 I argued that Joint Commission International should make cybersecurity readiness a core part of hospital accreditation. JCI's 8th edition standards have since placed greater emphasis on digital health. Making cyber readiness an explicit accreditation requirement would raise the baseline for every hospital that seeks it.

Questions for boards and leadership teams

1. When did our board last review cyber risk, and with what evidence?
2. If our systems went down tonight, how would we continue to treat patients tomorrow?
3. Which of our suppliers can access our systems or patient data, and how do we know they are secure?

In a connected hospital, protecting data is protecting patients.