Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review

Abstract

Background COVID-19 has challenged the resilience of the health care information system, which has affected our ability to achieve the global goal of health and well-being. The pandemic has resulted in a number of recent cyberattacks on hospitals, pharmaceutical companies, the US Department of Health and Human Services, the World Health Organization and its partners, and others. Objective The aim of this review was to identify key cybersecurity challenges, solutions adapted by the health sector, and areas of improvement needed to counteract the recent increases in cyberattacks (eg, phishing campaigns and ransomware attacks), which have been used by attackers to exploit vulnerabilities in technology and people introduced through changes to working practices in response to the COVID-19 pandemic. Methods A scoping review was conducted by searching two major scientific databases (PubMed and Scopus) using the search formula “(covid OR healthcare) AND cybersecurity.” Reports, news articles, and industry white papers were also included if they were related directly to previously published works, or if they were the only available sources at the time of writing. Only articles in English published in the last decade were included (ie, 2011-2020) in order to focus on current issues, challenges, and solutions. Results We identified 9 main challenges in cybersecurity, 11 key solutions that health care organizations adapted to address these challenges, and 4 key areas that need to be strengthened in terms of cybersecurity capacity in the health sector. We also found that the most prominent and significant methods of cyberattacks that occurred during the pandemic were related to phishing, ransomware, distributed denial-of-service attacks, and malware. Conclusions This scoping review identified the most impactful methods of cyberattacks that targeted the health sector during the COVID-19 pandemic, as well as the challenges in cybersecurity, solutions, and areas in need of improvement. We provided useful insights to the health sector on cybersecurity issues during the COVID-19 pandemic as well as other epidemics or pandemics that may materialize in the future.

Challenges of Managing Information Security during the Pandemic

“…The abrupt changes to teleworking made it challenging to immediately respond to such considerations' various technicalities for technical security controls. Various research has pinpointed the technical controls as a requirement of teleworking [7,13]. However, our research showed that in practice, technical security does not always stem from the organizational premises, but the chain of stakeholders' IT devices and infrastructure should be focused on too.…”

“…The COVID-19 pandemic significantly impacted employees' working habits, and those changes are likely to last long. The increased popularity of teleworking correlates with the alarming surge of cyberattacks, making it challenging for organizations to ensure information assets are well protected [9,10,13,14]. However, research in this area lacks empirical studies on how such challenges surfaced during the practice of managing information security during the teleworking shift of the COVID-19 pandemic.…”

Addressing the Challenges of Electronic Health Records Using Blockchain and IPFS

“…This worsened when COVID-19 suddenly hit the world. Issues that require immediate attention have been exposed and have led to serious problems such as disrupted services, expensive payments to ransomware attackers, compromised health records being sold on the black market, and availability of essential health care services [ 26 , 27 ]. The big data that the healthcare sector holds has become a lucrative source for ransom and attackers are taking advantage of this pandemic.…”

A Comprehensive Analysis of Privacy Protection Techniques Developed for COVID-19 Pandemic

“…In addition, other researchers have presented reviews about the country-specific privacy-protection methods used in the COVID-19 era [28]- [30]. Furthermore, some surveys have been published on the quantification of privacy risks [31], as to the nature of digital solutions (e.g., centralized or decentralized) [32], on the (non)acceptability of digital apps [33], on emerging technologies' privacy issues in COVID-19 context [34], about privacy controversies towards aggressive use of information technology amid the pandemic [35], and on healthcare privacy challenges in COVID-19 period [36].…”