Cybersecurity in the Health Sector: Mounting Problems, Uncertain Politics

Recent ransomware attacks on hospitals elevated awareness of cyber threats health care providers face. The attacks forced hospitals to engage in technological regression by relying on hard-copy records and revealed aspects of the health sector that make cybersecurity difficult. These episodes also highlighted ways in which the health sector reflects problems experienced across the U.S. cybersecurity ecosystem. Improving health-sector cybersecurity requires addressing unique sector features and integrating the sector into efforts to strengthen U.S. cybersecurity generally. However, concerns about health-sector cybersecurity have intensified just as the politics of U.S. cybersecurity face uncertainty.

Providing health services puts individual well-being in the hands of governmental bodies and private-sector enterprises. Increasingly, such services depend on digital technologies, devices, and data. The benefits of the digital revolution are so significant that the responsibility, recognized in modern versions of the Hippocratic oath, to apply scientific advances for patient health encourages exploitation of information technologies. A ransomware attack on a hospital is not just another cybersecurity incident; it encroaches on matters of life and death.

Integrating digital technologies in health services creates repositories of sensitive and valuable patient, financial, physician, pharmaceutical, and insurance information and vulnerabilities in networks used by physicians, hospitals, and insurance companies. Expanding use of digital information, communications, services, and medical devices means the health sector’s attractiveness as a target for malevolent cyber activities and its “attack surface” will grow. This trajectory is global and forms a disturbing part of what the World Health Organization calls the “health internet.”

Read more: Cybersecurity in the Health Sector: Mounting Problems, Uncertain Politics