The state of research on cyberattacks against hospitals and available best practice recommendations: a scoping review

Abstract

BackgroundThe health sector has quickly become a target for cyberattacks. Hospitals are especially sensitive to these sorts of attacks as any disruption in operations or even disclosure of patient personal information can have far-reaching consequences. The objective of this study was to map the available literature on cyberattacks on hospitals and to identify the different domains of research, while extracting the recommendations and guidelines put forth in the literature.MethodsFour databases (PubMed, Web of Science, ProQuest, and Scopus) were searched using standardized and adapted search syntax in order to identify relevant manuscripts published between 1997 and 2017. These were screened by two reviewers and included or excluded based on inclusion and exclusion criteria. Data from articles were then extracted and analyzed.ResultsThe search identified 818 records of which 97 were included. Of the 97, 32% were published in 2017 while around 40% of the articles were published prior to the last three years. Six domains of research emerged through the analysis, which are included here: context and trends in cybersecurity (27.8%), connected medical devices and equipment (29.9%), hospital information systems (14.4%), raising awareness and lessons learned (6.2%), information security methodology (15.4%), and specific types of attacks (6.2%).ConclusionThere is a generally growing interest in the research field, but the available literature remains limited in number. There are important aspects of cybersecurity (e.g. cloud storage and access management) as well as specific medical fields that rely on various medical devices that have been neglected. Recommendations are available, but comprehensive guidelines and standardized best practice measures are still necessary.Electronic supplementary materialThe online version of this article (10.1186/s12911-018-0724-5) contains supplementary material, which is available to authorized users.

Smartphones in mental health: a critical review of background issues, current status and future concerns

“…The healthcare industry is a frequent target of all forms of cyberattacks due to extreme vulnerability to disruption in services, and the ability for criminals to monetize the financial and health information contained in medical records (Argaw et al 2019). These cyber attacks occur worldwide with major incidents reported in the US, UK and Norway (Charette 2018).…”

Cybersecurity of Hospitals: discussing the challenges and working towards mitigating the risks

“…In response to these global attacks, the M8 Alliance undertook a project that began with a scoping review on cyberattacks against hospitals [5]. The review was a basis for several teleconferences conducted by a multidisciplinary team of experts.…”

Protecting your organization from e‐mail phishing and ransomware attacks

“…Cyberattacks have been increasing worldwide and are a growing concern for health care organizations, which are ideal targets because they often have out‐of‐date cybersecurity systems and provide limited training for staff members on safety practices 1,2 . In a 2019 survey of 166 information security leaders at a variety of health care facilities, more than three‐fourths reported experiencing a significant security event in the last year 3 .…”

“…In a 2019 survey of 166 information security leaders at a variety of health care facilities, more than three‐fourths reported experiencing a significant security event in the last year 3 . The health care sector is especially susceptible to cyberattacks because interruptions in services can have wide‐ranging consequences; for example, disclosure of patient health information can lead to identity theft and medical fraud, and loss of personnel access to medical records can affect patient safety 1,2,4 …”