The annual number of ransomware attacks on healthcare provider organizations doubled from 2016 to 2021, exposing the personal health information of nearly 42 million individuals. A new report from the University of Minnesota School of Public Health (SPH), published in the Journal of the American Medical Association (JAMA) Health Forum, shows that ransomware attacks on healthcare providers are not only increasing in frequency, they are also getting bigger. intensive — exposing greater quantities of personal health information and disrupting large organizations with multiple healthcare facilities.
To conduct the study, the researchers created a database called the Tracking Healthcare Ransomware Events and Traits (THREAT), a unique tool that for the first time allows researchers to track ransomware attacks on healthcare provider organizations.
Ransomware is a type of malicious software that prevents users from accessing their electronic systems and demands a ransom to restore access. Although several high-profile ransomware attacks on healthcare delivery organizations have received media attention, there is currently no systematic documentation of the extent and effect of ransomware attacks on our healthcare system.
In the first-ever comprehensive analysis of ransomware attacks on US healthcare providers, researchers documented that between 2016 and 2021:
- 374 cases of ransomware attacks on healthcare delivery organizations exposed the personal health information of nearly 42 million people.
- Ransomware attacks more than double on an annual basis, from 43 to 91 per year.
- The number of people whose personal health information was exposed increased from about 1.3 million in 2016 to more than 16.5 million in 2021.
- Patient care was disrupted as a result of ransomware incidents in 166 – or 44% – of the attacks.
- Among healthcare delivery facilities, clinics were the most frequent targets of ransomware attacks, followed by hospitals, ambulatory surgery centers, mental/behavioral health facilities, dental practices and post-acute care organizations.
“As healthcare delivery organizations have increased their reliance on information technology to serve their patients, they have unfortunately increased their potential exposure to cybersecurity risks, such as ransomware attacks,” said Hannah Neprash, lead author and professor assisted by SPH. “Despite this increased risk, information about the frequency and scope of these attacks is limited to anecdotal news coverage. This study and the development of the THREAT database address this gap, providing the first peer-reviewed analysis of the threat ransomware poses to healthcare providers and the millions of patients they serve.”
More research is needed to more accurately understand the operational and clinical care consequences of ransomware attacks on healthcare providers. The researchers also suggest that as policy makers, legislation aimed at combating the threat of ransomware across multiple industries should take into account the specific needs of healthcare delivery organizations and the potential consequences. detrimental to patient care.
Under the School of Public Health
The University of Minnesota School of Public Health improves the health and well-being of populations and communities around the world by bringing innovative research, learning and action to today’s greatest health challenges. We prepare some of the most influential leaders in the field, and partner with health departments, communities, and policy makers to promote health equity for all. More information at sph.umn.edu.
