Radiation Oncology Ransomware Attack Response Risk Analysis Using Failure Modes and Effects Analysis

Area of Science:

• Medical Physics
• Radiation Oncology
• Health Informatics

Background:

• Ransomware attacks pose a growing threat to healthcare, particularly radiation oncology.
• Previous research primarily consists of case reports, lacking quantitative risk assessment.
• Patient safety during cyberattacks remains a critical concern.

Purpose of the Study:

• To quantify patient safety risks during simulated ransomware attacks in radiation oncology.
• To identify critical failure modes associated with the loss of Record and Verify (R&V) systems.
• To inform strategies for enhancing ransomware resilience in radiation therapy.

Main Methods:

• Utilized Failure Modes and Effects Analysis (FMEA) with a multidisciplinary team.
• Developed process maps to simulate ransomware scenarios, focusing on R&V system unavailability.
• Quantified risks using Risk Priority Number (RPN) scores, comparing scenarios with and without R&V functionality.

Main Results:

• Risk Priority Number (RPN) scores increased by 71% (38%-96%) when R&V functionality was disabled.
• Key failure modes identified include patient misidentification and incorrect treatment tracking.
• Simulations revealed significant safety vulnerabilities during plan modifications and initial treatment fractions.

Conclusions:

• Ransomware attacks substantially elevate the risk of incidents in radiation oncology.
• Prioritizing identified failure modes is crucial for effective ransomware preparedness.
• This quantitative data supports the development of future ransomware resiliency research and protocols.