Who Should Manage a Hospital Cyberattack?
(MedPage Today) -- The malware attack was over. It was the only thing anyone could talk about during my weekend shift at a midsize hospital. Our hospital had spent the last 3 weeks relying on paper charts and written orders, but Epic was finally...
The hospital's electronic medical record system was back online after a recent cyberattack, but the aftermath lingered. One of the chilling consequences was the stark increase in mortality rates among patients admitted to the facility during the incident. Emergency departments diverted resources, and surgical schedules were disrupted, placing strain on neighboring hospitals as well.
The FBI and HHS do not recommend paying ransoms, but under life-threatening circumstances, the decision becomes more complex. While regulations exist to safeguard patient data, they lack specific guidance on necessary technologies. Healthcare institutions are responsible for their own cybersecurity, but the costs associated with implementing robust security measures have been a significant barrier.
The Healthcare Cybersecurity Performance Goals, though voluntary, encourage measures like offline backups and multi-factor authentication, but their voluntary nature has not been enough to deter growing cyber threats. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 proposes mandatory reporting of cyber incidents, but it remains unimplemented.
As cyberattacks become more sophisticated and frequent, there is a growing need for centralized assistance in cyber defense, negotiation, and intelligence sharing. Hospitals may have to consider external expertise and resources to ensure clinical continuity during a cyberattack, a decision that may require substantial investment and resources.
Written by urgent.news from MedPage Today's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
