OR Manager November/December 2021 - 26

Technology
Patient safety and the " Internet of Medical Things (IoMT) "
ith all of the advantages that
come from electronic health
records and connected devices,
some distinct security risks also
exist. Healthcare is seeing these risks
grow in the form of ransomware, phishing
attacks, and cybersecurity breaches.
Healthcare has become one of the
industries most vulnerable to cyberattacks,
and one with the most to lose.
As one of the highest-technology hospital
departments, perioperative services
has a significant stake in maintaining
cybersecurity, and with it, patient safety.
A new study by cybersecurity company
Censinet reveals a link between
cyberattacks and increased patient
death rates. Surveys were collected
from 600 healthcare organizations
across the US, and over 40% reported
cyberattacks in the past 2 years. Of
that pool, 70% reported longer hospital
stays and delayed tests and procedures;
36% saw more complications
from medical procedures; and 22% reported
increased death rates.
W
wireless tracker system used to locate
medical staff was out of order, and fetal
tracing information was unavailable.
The investigation is finding that fewer
healthcare providers were available to
monitor the patient's labor and delivery,
and important layers of safety were
compromised.
The infant at Springhill was born with
the cord tightly wrapped around her
neck and with severe brain damage.
She passed away nine months later.
A key finding in the case so far is that
Springhill failed to notify the mother
about the cyberattack and outages. She
now states that if she had known, she
would have gone to a different facility to
deliver.
These cases place new emphasis on
the responsibilities of hospitals to maintain
cybersecurity, risk management,
and response plans to protect patient
safety.
Financial burden
Patient harm incidents
In 2020, an important cybersecurity
milestone passed: the first recognized
cyberattack related death in healthcare.
On September 10, 2020, Dusseldorf
University Hospital was dealing with the
fallout from a ransomware attack that
disabled more than 30 internal servers.
Because of this handicap, a female
patient in need of emergency care was
re-routed to a hospital almost 20 miles
away. Due to associated delays in care,
the patient died, with the German press
attributing her death directly to the ransomware
attack.
More cases are surfacing, as an
ongoing investigation in Alabama attributes
an infant death to a ransomware
attack in 2019. Springhill Medical Center
in Alabama experienced a cyberattack
that resulted in computer systems
being disabled for eight days, and during
which time medical records- including
prenatal data-were inaccessible. A
26
OR Manager | Nov/Dec 2021
Comparitech, a technology research organization,
released its 2020 report,
revealing that attacks on US healthcare
organizations cost $20.8 billion. This
figure included 18 million patient records
and encompassed 92 individual
ransomware attacks that affected over
600 clinics, hospitals, and organizations.
Ransomware payment amounts
varied from $300,000 to $1.14 million.
Ransom payments are not the only
costs hospitals incur from cyberattacks.
Downtime from a cyberattack may
last from hours to even weeks and is
costly in different ways-including cancelled
procedures, delayed care, and
increased staffing needs. Basic daily
tasks can take much longer without
the technology tools on which clinicians
rely. A 2017 study by AC Group estimated
that the average cost per minute
of organizational downtime is $8,662.
New technology, vulnerabilities
Over the past several years, the Internet
of Things (IoT), or connected devices,
has exploded and become quite common.
Items like watches, locks, cameras,
and even refrigerators are now
online. This trend is in healthcare as
well, with systems such as pharmacy refrigerators,
medication dispensing systems,
patient monitoring devices, and
implanted insulin pumps and cardiac
pacemakers. The more high-tech healthcare
becomes, the higher is the cyberrisk
associated with that tech.
Cyberthreats in the medical community
have previously been associated
with hacks directly on main systems,
which these days are fairly well-protected.
According to IoT Techtrends, it
is easier for cybercriminals to bring a
hospital down by attacking other items
in the patient care ecosystem, including
security cameras, lighting, vacuum
tube systems, and cardiac monitors.
Even disabling the elevator systems in
a large hospital can wreak havoc that
affects patient care.
IoMT devices present a vulnerable
gateway into larger connected systems.
With the number of connected devices
increasing each year, the risk grows.
COVID-19 has contributed to the increase
in the connected devices market
due to the higher usage of telehealth
and remote patient monitoring devices
(see OR Manager's October 2021
Indices of US hospitals
with data breaches
Hospital Size
Small
Medium
Large
Hospital Region
West
Midwest
South
Northeast
Area
Rural
Urban
53%
36%
10%
19%
29%
40%
13%
21%
79%
www.ormanager.com
http://www.ormanager.com
OR Manager November/December 2021

Table of Contents for the Digital Edition of OR Manager November/December 2021
