Cybersecurity in Hospitals: A Systematic, Organizational Perspective.

Area of Science:

• Healthcare Cybersecurity
• Information Security Management
• Systems Dynamics Modeling

Background:

• Healthcare sector faces escalating cybersecurity threats, lagging behind other industries in patient data protection.
• Hospitals are complex, technology-saturated organizations with unique challenges like endpoint complexity, internal politics, and regulatory pressures.

Purpose of the Study:

• To develop a systematic and organizational perspective on cybersecurity capability development in hospitals.
• To analyze the interaction of internal organizational dynamics within the U.S. hospital system for cybersecurity.

Main Methods:

• Conducted interviews with hospital IT leaders and cybersecurity experts.
• Developed a system dynamics model to understand cybersecurity capability building.
• Utilized simulation analysis to assess factors influencing cyberattack likelihood.

Main Results:

• Endpoint complexity and internal stakeholder alignment are the most critical factors influencing cyberattack risk.
• Sufficient resources are important, but a high cybersecurity target level can compensate for resource limitations.
• System-wide vulnerability is influenced by individual hospital weaknesses; collective action is crucial.

Conclusions:

• Prioritize reducing endpoint complexity and enhancing stakeholder alignment for effective cybersecurity.
• Hospitals should aim for cybersecurity levels beyond mere compliance, as current policies often focus on privacy over security.
• Policy makers should implement regulations that elevate cybersecurity capabilities and standardize resource availability across the healthcare system to reduce systemic vulnerability.