Executive Summary

While this report is ostensibly about cybersecurity in healthcare, we hope it is remembered as yet another contribution to the broader body of patient safety literature in medicine, albeit an unorthodox one. Specifically, we aim to highlight the need to mitigate the risks to patient safety created by the growing integration of information technology and operational technology into healthcare, and to propose ways to mitigate that risk. The report takes as a core premise that there is great benefit to be had from technology adoption, but also that in order to achieve that benefit, action will be required to prevent those same systems—either maliciously or by accident—leading to patient harm. Recognizing that this is a complex systemic challenge, the report offers 17 actionable recommendations which we believe could make a real impact. These recommendations are organized across three pillars: culture, technology and workforce.

The report begins with a personal introduction by co-author Robert Lord which makes the case that information security should be at the heart of modern healthcare by pointing to Hippocratic Oath of “Do No Harm,” which has long underpinned the work of healthcare professionals. Since the potential harms posed to patients today are not what they once were, he argues that “Do No Harm 2.0,” requires significantly more attention and resources to be applied to cybersecurity by the healthcare sector.

Next, Chapter One—“Why Should We Care?”—gives a high-level overview describing the cybersecurity challenges and constraints facing the healthcare sector. Some of these challenges are unique to healthcare while others will be familiar to cybersecurity experts in other fields. The chapter will be most useful for those who want to better understand the cybersecurity threats the healthcare sector will face over the next five years. This chapter is designed to give action-oriented colleagues a set of arguments to support their efforts for change.

Chapter Two of this report—“How Did We Get Here?”—looks back at the major policies, technological innovations, and cybersecurity incidents that have shaped the current healthcare cybersecurity landscape. This chapter is for those who want to better understand the structural context underpinning technology and cybersecurity developments in the healthcare sector. By providing historical context, we hope to help ensure that future efforts will build on, rather than repeat, past attempts at improvement.

Chapters Three, Four, and Five constitute the major policy recommendations of this report. Each one tackles a set of recommendations centered on one of the three pillars mentioned above, culture, technology, and workforce. The policies in these chapters are relevant for policymakers in federal, state, and local governments, as well as healthcare leaders who can shape the internal policies of their health systems and organizations.

The report concludes with a “call to arms” couched with optimism that this is a solvable problem if proper action is taken and appropriate resources are committed.