Exploring System Thinking Leadership Approaches to the Healthcare Cybersecurity Environment

Abstract

A Florida-based obstetrics and gynecology facility reported in February 2019 that they lost data because of a ransomware attack. In November 2017, 107,000 healthcare records were exposed from data breaches, and 340,000 records were exposed in December 2017. In 2019, 23,000 patient records at Critical Care, Pulmonary & Sleep Associates were compromised when a hacker gained access to an employee's email account and sent out phishing emails to the other employees, eventually exposing the patient data. On January 11, 2018, Adams Memorial Hospital and Hancock Regional Hospital, both in Indiana, experienced independent ransomware attacks, with Hancock Regional Hospital paying $50,000 in ransom. These incidents point to significant and complex cybersecurity risks for all healthcare organizations. Effectively managing these risks requires healthcare managers to develop system thinking and adaptive leadership skills. This paper explores the nuances and complexities around systems thinking in the healthcare cybersecurity environment.

Ransomware Attacks on the Healthcare Industry

“…Healthcare practices are key targets for medical documentation theft because they lag at the tail end of other industries in terms of safeguarding crucial data. According to Burrell et al (2021), "Despite its improvements to clinical outcomes and patient care delivery, interconnection presents unique cybersecurity vulnerabilities" (p. 21). The healthcare industry faces a substantial risk related to these attacks because it maintains so much confidential medical information.…”

“…The healthcare industry faces a substantial risk related to these attacks because it maintains so much confidential medical information. Ransomware attacks are usually carried out across multiple healthcare systems in large email phishing operations (Burrell et al, 2021). Clinics are a major focus point for these operations because they often do not upgrade their digital record-keeping systems or conduct frequent assessments to avoid modern risks and vulnerabilities (Burrell et al, 2021).…”

“…Ransomware attacks are usually carried out across multiple healthcare systems in large email phishing operations (Burrell et al, 2021). Clinics are a major focus point for these operations because they often do not upgrade their digital record-keeping systems or conduct frequent assessments to avoid modern risks and vulnerabilities (Burrell et al, 2021). This lack of precaution can majorly affect a patient's health; for example, the use of equipment that operates on outdated computer software may not provide timely updates about patient vitals, which can lead to harmful or potentially fatal incidents (Burrell et al, 2021).…”

“…Clinics are a major focus point for these operations because they often do not upgrade their digital record-keeping systems or conduct frequent assessments to avoid modern risks and vulnerabilities (Burrell et al, 2021). This lack of precaution can majorly affect a patient's health; for example, the use of equipment that operates on outdated computer software may not provide timely updates about patient vitals, which can lead to harmful or potentially fatal incidents (Burrell et al, 2021). Clinics also may not employ infrastructure updates to their installed equipment, leaving room for further risk.…”

“…Clinics also may not employ infrastructure updates to their installed equipment, leaving room for further risk. Additionally, yearly security risk evaluations that all healthcare entities are subject to are often insufficient, as there is not specific assessment methodology prescribed for these evaluations (Burrell et al, 2021). Each organization is left to design their own annual risk assessment, meaning that organizations may overlook important risk assessment activities.…”