Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review

There is no author summary for this article yet. Authors can add summaries to their articles on ScienceOpen to make them more accessible to a non-specialist audience.

Abstract

Background

Health care organizations worldwide are faced with an increasing number of cyberattacks and threats to their critical infrastructure. These cyberattacks cause significant data breaches in digital health information systems, which threaten patient safety and privacy.

Objective

From a sociotechnical perspective, this paper explores why digital health care systems are vulnerable to cyberattacks and provides sociotechnical solutions through a systematic literature review (SLR).

Methods

An SLR using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) was conducted by searching 6 databases (PubMed, Web of Science, ScienceDirect, Scopus, Institute of Electrical and Electronics Engineers, and Springer) and a journal ( Management Information Systems Quarterly) for articles published between 2012 and 2022 and indexed using the following keywords: “(cybersecurity OR cybercrime OR ransomware) AND (healthcare) OR (cybersecurity in healthcare).” Reports, review articles, and industry white papers that focused on cybersecurity and health care challenges and solutions were included. Only articles published in English were selected for the review.

Results

In total, 5 themes were identified: human error, lack of investment, complex network-connected end-point devices, old legacy systems, and technology advancement (digitalization). We also found that knowledge applications for solving vulnerabilities in health care systems between 2012 to 2022 were inconsistent.

Conclusions

This SLR provides a clear understanding of why health care systems are vulnerable to cyberattacks and proposes interventions from a new sociotechnical perspective. These solutions can serve as a guide for health care organizations in their efforts to prevent breaches and address vulnerabilities. To bridge the gap, we recommend that health care organizations, in partnership with educational institutions, develop and implement a cybersecurity curriculum for health care and intelligence information sharing through collaborations; training; awareness campaigns; and knowledge application areas such as secure design processes, phase-out of legacy systems, and improved investment. Additional studies are needed to create a sociotechnical framework that will support cybersecurity in health care systems and connect technology, people, and processes in an integrated manner.

Related collections

Most cited references 105

Record: found
Abstract: found
Article: found

Is Open Access

The PRISMA 2020 statement: an updated guideline for reporting systematic reviews

Matthew J L Page, Joanne E McKenzie, Patrick Bossuyt … (2027)

The Preferred Reporting Items for Systematic reviews and Meta-Analyses (PRISMA) statement, published in 2009, was designed to help systematic reviewers transparently report why the review was done, what the authors did, and what they found. Over the past decade, advances in systematic review methodology and terminology have necessitated an update to the guideline. The PRISMA 2020 statement replaces the 2009 statement and includes new reporting guidance that reflects advances in methods to identify, select, appraise, and synthesise studies. The structure and presentation of the items have been modified to facilitate implementation. In this article, we present the PRISMA 2020 27-item checklist, an expanded checklist that details reporting recommendations for each item, the PRISMA 2020 abstract checklist, and the revised flow diagrams for original and updated reviews.

0 comments Cited 19443 times – based on 0 reviews      Review now

Bookmark

Record: found
Abstract: found
Article: not found

Health information systems: failure, success and improvisation.

Richard Heeks (2006)

The generalised assumption of health information systems (HIS) success is questioned by a few commentators in the medical informatics field. They point to widespread HIS failure. The purpose of this paper was therefore to develop a better conceptual foundation for, and practical guidance on, health information systems failure (and success). Literature and case analysis plus pilot testing of developed model. Defining HIS failure and success is complex, and the current evidence base on HIS success and failure rates was found to be weak. Nonetheless, the best current estimate is that HIS failure is an important problem. The paper therefore derives and explains the "design-reality gap" conceptual model. This is shown to be robust in explaining multiple cases of HIS success and failure, yet provides a contingency that encompasses the differences which exist in different HIS contexts. The design-reality gap model is piloted to demonstrate its value as a tool for risk assessment and mitigation on HIS projects. It also throws into question traditional, structured development methodologies, highlighting the importance of emergent change and improvisation in HIS. The design-reality gap model can be used to address the problem of HIS failure, both as a post hoc evaluative tool and as a pre hoc risk assessment and mitigation tool. It also validates a set of methods, techniques, roles and competencies needed to support the dynamic improvisations that are found to underpin cases of HIS success.

0 comments Cited 104 times – based on 0 reviews      Review now

Bookmark

Record: found
Abstract: found
Article: not found

Cybersecurity in healthcare: A narrative review of trends, threats and ways forward

Lynne Coventry, Dawn Branley (2018)

Electronic healthcare technology is prevalent around the world and creates huge potential to improve clinical outcomes and transform care delivery. However, there are increasing concerns relating to the security of healthcare data and devices. Increased connectivity to existing computer networks has exposed medical devices to new cybersecurity vulnerabilities. Healthcare is an attractive target for cybercrime for two fundamental reasons: it is a rich source of valuable data and its defences are weak. Cybersecurity breaches include stealing health information and ransomware attacks on hospitals, and could include attacks on implanted medical devices. Breaches can reduce patient trust, cripple health systems and threaten human life. Ultimately, cybersecurity is critical to patient safety, yet has historically been lax. New legislation and regulations are in place to facilitate change. This requires cybersecurity to become an integral part of patient safety. Changes are required to human behaviour, technology and processes as part of a holistic solution.

0 comments Cited 93 times – based on 0 reviews      Review now

Bookmark

All references

Author and article information

Contributors

Pius Ewoh:

ORCID: https://orcid.org/0000-0002-4006-619X

School of Technology and InnovationsInformation Systems ScienceUniversity of VaasaWolffintie 32Vaasa, 65200Finland358 414888477pius.ewoh@uwasa.fi

Journal

Journal ID (nlm-ta): J Med Internet Res

Journal ID (iso-abbrev): J Med Internet Res

Journal ID (publisher-id): JMIR

Title: Journal of Medical Internet Research

Publisher: JMIR Publications (Toronto, Canada )

ISSN (Print): 1439-4456

ISSN (Electronic): 1438-8871

Publication date Collection: 2024

Publication date (Electronic): 31 May 2024

Volume: 26

Electronic Location Identifier: e46904

Affiliations

[1 ] School of Technology and Innovations Information Systems Science University of Vaasa Vaasa Finland

Author notes

Corresponding Author: Pius Ewoh pius.ewoh@ 123456uwasa.fi

Author information

Pius Ewoh https://orcid.org/0000-0002-4006-619X

Tero Vartiainen https://orcid.org/0000-0003-3843-8561

Article

Publisher ID: v26i1e46904

DOI: 10.2196/46904

PMC ID: 11179043

PubMed ID: 38820579

SO-VID: 29789445-3b96-478c-a648-8c5d4573eef9

License:

This is an open-access article distributed under the terms of the Creative Commons Attribution License ( https://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work, first published in the Journal of Medical Internet Research, is properly cited. The complete bibliographic information, a link to the original publication on https://www.jmir.org/, as well as this copyright and license information must be included.

History

Date received : 3 March 2023

Date revision requested : 27 July 2023

Date revision received : 17 October 2023

Date accepted : 8 March 2024

Comments

Comment on this article

scite_

Cited by 3

See all cited by

Most referenced authors 962

See all reference authors

Submit your digital health research with an established publisher
- celebrating 25 years of open access