Cybersecurity Challenges and the Academic Health Center: An Interactive Tabletop Simulation for Executives

Area of Science:

• Health Care Management
• Information Security
• Cybersecurity Preparedness

Background:

• Academic health centers (AHCs) face significant cybersecurity vulnerabilities impacting finances, reputation, and patient care delivery.
• A gap exists in executive understanding of cyberattack impacts on core institutional missions like clinical care, research, and education.
• Enhanced cybersecurity awareness and education are critical opportunities for AHCs.

Purpose of the Study:

• To raise awareness of cybersecurity issues and threats among AHC leaders.
• To provide a forum for C-suite executives to discuss cybersecurity concerns specific to their roles.
• To assess AHC leaders' preparedness and response strategies to a simulated cyberattack.

Main Methods:

• A 3.5-hour interactive, 3-phase tabletop cybersecurity simulation was developed and facilitated at an international conference.
• The simulation involved approximately 70 AHC leaders from diverse geographical and institutional backgrounds.
• Participants, in teams, responded to a hypothetical ransomware attack scenario mirroring their executive roles.

Main Results:

• The simulation exercise was positively received by participants.
• Participants noted that cybersecurity preparedness often receives less institutional attention than other threats like epidemics or natural disasters.
• Significant variance in team responses indicated a lack of consensus on foundational decision-making during cyber incidents.

Conclusions:

• AHCs have opportunities to lead in developing best practices for health care cybersecurity preparedness and response.
• Developing clear guidelines and protocols is essential to remedy the identified lack of consensus in cyberattack response.
• Collaboration among AHCs, clinicians, security professionals, and regulators can improve health care cybersecurity and patient protection.