A practical cyberattack contingency plan for radiation oncology

Area of Science:

• Medical Physics
• Radiation Oncology
• Health Informatics

Background:

• Cyberattacks pose a significant threat to radiation oncology information systems (ROIS).
• Interruption of radiation therapy can negatively impact patient outcomes.
• Business continuity planning is crucial for healthcare systems.

Purpose of the Study:

• To present a deployable solution for uninterrupted radiation therapy during ROIS cyberattacks.
• To offer a low-overhead, easily implementable business continuity plan for radiation oncology practices.

Main Methods:

• Automated daily retrieval and secure storage of essential patient data from the clinical ROIS.
• Establishment of a secondary ROIS server using retrieved data to continue treatments during an attack.
• Rebuilding the primary ROIS from enterprise backups and updating it with data from the secondary server post-attack.

Main Results:

• The solution was successfully implemented in a clinical setting managing ~250 daily treatments, including a proton center.
• A simulated cyberattack drill demonstrated minimal radiation treatment downtime (a couple of hours).
• The plan was deemed feasible and affordable, minimizing treatment interruptions.

Conclusions:

• The proposed solution effectively ensures the continuation of radiation therapy without breaks during cyberattacks.
• It provides essential time for radiation oncology departments to recover and rebuild their primary ROIS.