How Does Ransomware Threaten Hospital Care?

TL;DR

Hospital ransomware can endanger patients by disabling clinical systems and delaying time-sensitive care, even when the attack does not directly cause a death. Healthcare cybersecurity must therefore prioritize system availability and integrity alongside data confidentiality, while hospitals investigate patient harm, contain attacks quickly, and preserve access to electronic records, laboratories, imaging, and other essential services.

Transcript

Hello, RSA Conference community. I'm Cecilia Marignier, program manager for innovation and scholars at RSA Conference. I have the good fortune to work with Beau Woods, who is also a member of DEF CON Biohacking Village. With the recent attack that happened, uh, the recent attack that happened on the UHS hospital system, I thought it'd be a great ti... Read More

Key Insights

• The UHS incident was a ransomware attack that left numerous hospital systems unavailable, with some directly affected and others reportedly disconnected by the healthcare group to prevent the malicious software from spreading further.
• Taking systems offline is a standard containment measure because ransomware can move rapidly across connected infrastructure. This defensive action may limit damage, but it can also reduce the hospital's immediate access to digital services needed for patient care.
• Hospital ransomware can disrupt electronic health records, laboratory equipment, and radiology imaging. These systems provide information that doctors need to make rapid decisions during critical, time-bound situations where even a relatively brief interruption can matter.
• Patient diversion is a regular healthcare practice when a facility is full or cannot provide the best available care. During a cyber incident, however, system outages can create another reason for diversion and potentially extend the time before treatment begins.
• Ransomware did not directly kill the German patient described in the interview. Her underlying stroke caused her death, but the attacked hospital could not receive her, and she died while being transported to another healthcare provider.
• A 4.4-minute average delay was associated with statistically significantly higher mortality and morbidity in studies involving care disruptions around marathons. Diversion to another healthcare provider can take considerably longer, showing why cyber-related delays deserve attention.
• Healthcare cybersecurity is primarily about protecting human life and public safety, not only preventing intellectual property theft, financial fraud, or other data crimes. This shifts defensive priorities toward the availability and integrity of clinical systems.
• Telehealth expanded during the COVID pandemic after Medicare, Medicaid, and insurance companies began reimbursing it. Remote visits can encourage more people to seek care earlier, improve outcomes, and reduce travel, waiting, and demands on doctors' time.

Questions & Answers

Q: What happened during the ransomware attack on UHS?

Universal Health Services, described as one of the largest hospital systems in the United States, was hit by ransomware over a weekend. Many systems became unavailable. Some were directly affected by the attack, while anecdotal reports suggested that the healthcare group proactively disconnected other systems to prevent the ransomware from spreading across additional parts of its infrastructure.

Q: Why do hospitals take systems offline during ransomware attacks?

Hospitals may proactively disconnect systems because ransomware can spread rapidly across connected infrastructure. Taking potentially exposed systems offline is described as a fairly standard approach for staying ahead of that propagation. Although disconnection can interrupt access to clinical tools, it may prevent the attack from reaching more systems and creating a broader, more difficult disruption.

Q: How can ransomware disrupt patient care in hospitals?

Ransomware can make electronic health records, laboratory equipment, radiology imaging, and other critical systems unavailable. Clinicians rely on these systems for information needed to make rapid decisions in urgent, time-bound situations. When those resources are inaccessible, a hospital may have difficulty delivering appropriate care, and incoming patients may need to be diverted elsewhere.

Q: Did ransomware directly cause the German patient's death?

The interview cautions against saying that ransomware directly killed the patient. Her underlying stroke was the cause of death. However, the attacked hospital was effectively unavailable, so she was diverted to another healthcare provider and died during the journey. The incident illustrates how a cyberattack can create delays that may contribute to harmful clinical circumstances.

Q: Why are short delays dangerous in emergency healthcare?

Time can determine outcomes when patients have critical conditions requiring immediate treatment. The interview cites studies conducted around marathons in which an average delay of 4.4 minutes produced statistically significantly higher mortality and morbidity. A hospital diversion can take much longer than four minutes, so outages that delay treatment can create serious risks for patients.

Q: How should healthcare cybersecurity differ from traditional cybersecurity?

Traditional cybersecurity efforts have often concentrated on intellectual property theft, financial fraud, data-related crimes, and the confidentiality of information. Healthcare security must also protect human life and public safety. Because clinicians depend on functioning technology to deliver care, the availability and integrity of systems become especially important priorities alongside the confidentiality of patient data.

Q: What investigations are needed after healthcare ransomware incidents?

The interview calls for investigations into how frequently patients are harmed by ransomware, direct impacts on medical devices, and related disruptions. The German case may have been the first directly reported death associated with diversion after ransomware, but it may not have been the first such event. Better investigation could clarify the scale and patterns of patient harm.

Q: How did expanded telehealth benefit healthcare delivery?

Telehealth allows patients to visit doctors from home instead of traveling to an office. During the COVID pandemic, its use increased after Medicare, Medicaid, and insurance companies began reimbursing remote care. The interview says telehealth can increase the number of people seeking care, encourage earlier treatment, improve outcomes, reduce travel, and cut waiting time for patients and doctors.

Summary & Key Takeaways

• Universal Health Services, one of the largest hospital systems in the United States, experienced a ransomware attack that left many systems unavailable. Some systems were directly affected, while the healthcare group reportedly disconnected others to limit further spread. Taking systems offline is a standard containment response when ransomware can propagate quickly.

• Hospital disruptions can disable electronic health records, laboratory equipment, radiology imaging, and other tools that clinicians use for urgent decisions. A German ransomware incident forced a stroke patient to be diverted, and she died while traveling elsewhere. The stroke caused her death, but delayed care may have influenced the outcome.

• Healthcare cybersecurity differs from traditional programs centered on intellectual property, fraud, and data confidentiality because human life and public safety are at stake. Availability and integrity become critical priorities. At the same time, expanded reimbursement has accelerated telehealth, enabling earlier care, reducing travel and waiting, and potentially improving patient outcomes.