The part most often overlooked is that the consequences do not stop at the hospital that was attacked.

A study published in JAMA Network Open in 2023 examined the emergency departments of two hospitals that were not themselves attacked, but which sat near a health care organisation hit by ransomware on 1 May 2021, comparing the period before the attack with the period during it.

The significant increases were as follows. Mean daily emergency department census rose from 218.4 to 251.4 patients. Arrivals by ambulance rose from 1,741 to 2,354. Admissions rose from 1,614 to 1,722.

More troubling were the figures for patients leaving without being seen, which rose from 158 to 360, and patients leaving against medical advice, which rose from 107 to 161.

Waiting also lengthened. Median waiting room time rose from 21 minutes to 31 minutes, and total emergency department length of stay for admitted patients rose from 614 minutes to 822 minutes.

Across greater San Diego County, median total daily ambulance diversion time rose by 74.1 per cent, from 27 cumulative hours to 47 cumulative hours.

Source: https://pmc.ncbi.nlm.nih.gov/articles/PMC10167570/

 

What the Evidence Cannot Yet Show

At this point many readers will have concluded that ransomware kills patients. Neither of these two studies says so.

The 2022 study states its own limitation plainly: the researchers could not say whether or how ransomware disruptions affect patients seeking care, and further study is needed to quantify an empirical association between ransomware attacks and patient outcomes.

The 2023 study, which measured congestion in neighbouring emergency departments, contains an important negative finding that should always be reported alongside the rest. Although the number of stroke code activations rose, the researchers state that the increased stroke alerts were not correlated with longer times to stroke imaging, to administration of clot-dissolving medication, or to the start of the endovascular procedure.

Put simply, the emergency departments did become more crowded, but stroke patients were still treated within times no different from before.

The researchers list several further limitations: the study was observational and descriptive with no defined sample size, precluding true hypothesis testing; the incidence of stroke was relatively low; and confounding effects including variations in infectious disease burden, trauma burden or seasonality may be responsible for changes in emergency department metrics independent of the cybersecurity incident.

Source: https://pmc.ncbi.nlm.nih.gov/articles/PMC10167570/

 

What Governments Recommend

The United States Cybersecurity and Infrastructure Security Agency, together with the Federal Bureau of Investigation and the Department of Health and Human Services, issued a joint advisory specifically for the healthcare sector.

The central recommendation concerns backups. It states that it is critical to maintain offline, encrypted backups of data and to test those backups regularly, because many ransomware variants attempt to find and delete any accessible backups. It offers the 3-2-1 rule as a guideline: three copies of all critical data, on at least two different types of media, with at least one stored offline.

The next recommendations speak directly to hospital work. Plan for the possibility of critical information systems being inaccessible for an extended period of time. Print and properly store hard copies of digital information that would be required for critical patient healthcare. Periodically train staff to handle the re-routing of incoming and existing patients expediently if information systems abruptly become unavailable.

Equally important is the recommendation to coordinate the potential for surge support with other healthcare facilities in the greater local area, which matches precisely what the research found actually happened in San Diego.

On paying the ransom, the advisory is explicit that the three agencies do not recommend paying, because payment does not guarantee files will be recovered and may embolden adversaries to target additional organisations.

Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a

 

Lessons for Thailand

First, this is not a problem for the IT department alone, because what fails is the ability to treat patients, not merely a set of files. The response plan therefore has to belong to the whole hospital, and be rehearsed by clinical staff rather than by technical staff only.

Second, the figures argue for planning over a long horizon, since 8.6 per cent of attacks were associated with disruption lasting more than two weeks. A plan built to cover one or two days is too short.

Third, preparedness has to be thought about at the level of an area rather than a single hospital, because when one hospital goes down the load moves immediately to its neighbours, and those neighbours were never attacked at all. Joint provincial-level exercises have evidence behind them.

Fourth, communication matters. When an incident occurs, the public needs to be told which services remain open, which are postponed, and where to go instead, because clear information reduces the number of people arriving in the wrong place, which is the source of the congestion the research measured.

Finally, the risk should be described honestly. The available evidence shows clearly that care is disrupted, that queues lengthen, and that a number of patients walk out without being seen. It has not shown that these attacks kill people. Overstating the evidence may buy a stronger headline in the short term, at the cost of credibility once somebody opens the study and reads it.