‘A regional disaster’: Cyberattacks on health care facilities have ripple effects, study says

Cyberattacks that target one hospital could also have ripple effects and indirectly impact nearby health care facilities, according to a recent study published in the Journal of the American Medical Association.

The study found that hospitals near a health care facility that was impacted by a ransomware attack may experience an influx of patients and lack resources that could affect time-sensitive matters. 

Other disruptions may include an increase in ambulance arrivals, waiting room times, patients left without being seen and patient length of stay.

The authors of the study concluded that the hospital disruptions tied to a cyberattack “should be considered a regional disaster.”

“This study suggests that health care cyberattacks such as ransomware are associated with greater disruptions to regional hospitals and should be treated as disasters, necessitating coordinated planning and response efforts,” the authors said. 

The rise of health care cyberattacks

Ransomware attacks targeting the health care sector have increased in frequency and sophistication over the past decade, the study found, including during the COVID-19 pandemic when “serious ransomware infections loaded additional stress on [Health Delivery Organizations].”

Congress has also been sounding the alarm over the increase in cyberthreats targeting the health care sector.

Over the past year, lawmakers have introduced policies, legislation and recommendations aimed at targeting and mitigating the impact of cyberattacks in the healthcare industry. 

“The American public has witnessed increasingly brazen and disruptive attacks on its health care sector that jeopardize sensitive personal information, delay treatment, and ultimately lead to increased suffering and death,” Sen. Mark Warner (D-Va.), chairman of the Senate Intelligence Committee, noted in a report published last fall.

In the report, Warner recommended that the federal government improve the country’s cybersecurity risk prevention in the health care sector, help the private sector mitigate cyberthreats and assist health care providers in responding to and recovering from cyberattacks.  

Sens. Jacky Rosen (D-Nev.) and Bill Cassidy (R-La.) introduced a bill last year that would require the Cybersecurity and Infrastructure Security Agency to collaborate with the Department of Health and Human Services and improve cybersecurity standards in the health care and public health sectors.

The health care sector has been particularly vulnerable to ransomware attacks because it stores sensitive data and handles patients’ safety and health, experts previously told The Hill.