Patients Suffer When Hospitals Are Unprepared for Cyberattacks

Timely care is critical to patient survival in a medical emergency. When ransomware or other cyberattacks degrade a hospital’s ability to offer care, the healthcare providers often divert patients to other hospitals nearby. This can be particularly challenging for critical access hospitals because, by definition, these hospitals are at least 35 miles away from the next nearest emergency care facility. Critical access hospitals provide essential services to their communities, particularly in rural communities. Diverting patients from these facilities can dramatically lengthen patient wait times. Moreover, individuals may delay seeking critical medical treatment–opting to wait to see if symptoms get better on their own — if they know they have to drive a much farther distance than usual to receive care.

In Louisiana, 30 hospitals are at least a 20-minute drive away from the next closest care center, and eight hospitals are at least a 30-minute drive away. Patients living near these hospitals need to drive nearly 22 minutes and more than 17 miles on average to reach the next nearest care facility. In the case of a care delay or disruption to hospital functioning, those extra minutes could be the difference between life and death for a patient suffering from a medical emergency.

This interactive map illustrates the geographic challenges to patients receiving effective and timely care in the event of a disruption to their local hospital systems. Dots represent hospitals. Clicking on a hospital shows the three nearest alternatives in terms of minutes and miles driving. Critical access hospitals, designated as red dots, serve as lifelines for their communities.

Cybercriminals show no sign of gaining a conscience and refraining from attacking healthcare systems. Hospitals rely on ever-more digitally connected technology to operate efficiently, using online systems to access patient records and medication history, transport resources throughout buildings, communicate throughout the hospital, and provide employee security. Technology acts as a workforce multiplier in hospitals, but when cyberattacks disrupt it, healthcare providers are forced to revert to slower, less efficient manual systems, straining an already resource-constrained system.

Hospitals need sufficient resources to improve cybersecurity practices and prepare for the effects of a potential cyberattack. Rural hospitals in particular need programs that provide resources and expertise to improve their cyber defenses and mitigate the risk to patients.

For more information and recommendations see the June 2024 CSC 2.0 report Healthcare Cybersecurity Needs a Checkup.