{"id":2385,"date":"2023-05-24T13:03:36","date_gmt":"2023-05-24T13:03:36","guid":{"rendered":"https:\/\/horizon.peachpuff-wolverine-566518.hostingersite.com\/?p=2385"},"modified":"2023-05-24T13:03:36","modified_gmt":"2023-05-24T13:03:36","slug":"the-race-to-make-hospitals-cybersecure","status":"publish","type":"post","link":"https:\/\/scienceblog.com\/horizon\/2385\/the-race-to-make-hospitals-cybersecure\/","title":{"rendered":"The race to make hospitals cybersecure"},"content":{"rendered":"

As medical centres increasingly come under attack from hackers, Europe is bolstering protection.<\/p>\n

By<\/em><\/strong>\u00a0TOM CASSAUWERS<\/p>\n

Amid the Covid-19 pandemic in early 2021, the Irish healthcare system\u2019s computers were breached by hackers who gained access to patient files and posted hundreds of them online. As a result, the network had to be shut down.<\/p>\n

The reverberations were widespread as appointments got cancelled, people\u2019s most sensitive data was stolen and even procedures like CT scans came to a halt. The attack was one of the largest hacks of a healthcare provider in the world.<\/p>\n

Mind the gap<\/strong><\/p>\n

\u2018At the moment, there is a major gap in the cybersecurity capacities of healthcare,\u2019 said Christos Xenakis, a digital systems professor at the University of Piraeus in Greece. \u2018Hospitals need to work properly and protect our data.\u2019<\/p>\n

From May 2021 to June 2022, the EU\u2019s cybersecurity agency\u00a0\u2013 ENISA\u00a0\u2013 detected a total of 623 ransomware incidents in Member States similar to the one in Ireland. Healthcare was the fifth most targeted sector of those attacks.<\/p>\n

That in turn has spawned more investment and technological development to secure the industry. Scientists, medical professionals and governments are increasingly taking action to prevent scenarios like the Irish one.<\/p>\n

The answer lies not only in better software. Cybersecurity is more often than not about people and changing their behaviour.<\/p>\n

That\u2019s one of the conclusions reached by Sabina Magalini, a professor of surgery at the Catholic University of the Sacred Heart in Rome, Italy.<\/p>\n

She coordinated an EU-funded project called\u00a0PANACEA<\/a>\u00a0to improve hospital cybersecurity. The initiative ran for 38 months through February 2022.<\/p>\n

Human errors<\/strong><\/p>\n

\u2018Human error is one of the main cybersecurity risks for hospitals,\u2019 said Magalini. \u2018The risk lies with people, which is logical. A hospital isn\u2019t a nuclear power plant and can\u2019t be closed off in the same way.\u2019<\/p>\n

Hospitals tend to be busy places. Staff need to perform medical duties and, at the same time, work on a variety of computer systems.<\/p>\n

Research during PANACEA showed that, during a single day, nurses often had to log in to computer systems more than 80 times.<\/p>\n

This is time-consuming and leads to shortcuts, including the same password being used by a group of people or passwords being written down on a piece of paper next to the computer.<\/p>\n

In general, the study demonstrated that hospital staff followed cybersecurity precautions poorly and, in the process, left an opening that attackers could exploit.<\/p>\n

\u2018We need to make interactions between healthcare professionals and computers better,\u2019 said Magalini. \u2018As a doctor or nurse, you\u2019re treating the patient and using a computer at the same time. It\u2019s hectic.\u2019<\/p>\n

Safety precautions<\/strong><\/p>\n

PANACEA came up with ways to make it easier for hospital staff to follow cybersecurity precautions. One example is software ensuring a more secure login system.<\/p>\n

\u2018The software allows for facial recognition of healthcare workers,\u2019 said Magalini. \u2018This would bypass the need for the problems we\u2019re seeing today with passwords.\u2019<\/p>\n

The project also experimented with low-tech alternatives. Researchers put up stickers and posters in participating hospitals to nudge healthcare workers into following basic cybersecurity procedures.<\/p>\n

Education also needs to play a role, including for doctors, according to Magalini.<\/p>\n

\u2018Cybersecurity training should be included in their residency programmes,\u2019\u00a0she said.<\/p>\n

Easier sharing\u00a0<\/strong><\/p>\n

Another EU-funded project,\u00a0CUREX<\/a>, facilitated the sharing of health information among hospitals. Xenakis of the University of Piraeus coordinated the project, which ran for 40 months through March 2022.<\/p>\n

\u2018Health data is the most sensitive data there is,\u2019 he said. \u2018Hackers pay more for health data than for credit card information.\u2019<\/p>\n

When sending patient information to another health facility, a hospital might not be aware of the extent of the recipient\u2019s cybersecurity arrangements.<\/p>\n

CUREX addressed that uncertainty.<\/p>\n

The project developed a software that can help detect any vulnerabilities in the security of an outside organisation. The system makes it easier for medical facilities to share information in line with EU data-protection rules.<\/p>\n

\u2018It\u2019s all about risk assessment,\u2019 said Xenakis. \u2018And to do that, you need to know how secure the other organisation is.\u2019<\/p>\n

Follow-up work<\/strong><\/p>\n

European researchers and cybersecurity organisations are investing in these types of answers.<\/p>\n

As a follow-up to PANACEA and CUREX, the EU is co-funding cybersecurity procurement for hospitals, meeting 50% of the cost of new measures.<\/p>\n

So, even while attacks on European hospitals continue on a regular basis, experts see reason for optimism about the future.<\/p>\n

\u2018European cybersecurity providers are rapidly becoming more mature,\u2019 said Xenakis. \u2018In turn, hospitals are recognising the necessity to buy new tools and upgrade their security.\u2019<\/p>\n

Research in this article was funded by the EU. This article was originally published\u202fin <\/em>Horizon<\/em><\/a>, the EU Research and Innovation Magazine.\u00a0<\/em><\/p>\n

More info<\/p>\n