A thematic analysis of ransomware incidents among United States hospitals, 2016–2022

Abstract Purpose To characterize the patterns, vulnerabilities, and responses associated with ransomware incidents in U.S. hospitals. Methods The study employs qualitative thematic analysis of ransomware incidents in U.S. hospitals from 2016 to 2022. Data were collected from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) public portal, and 65 cases were analyzed using NVivo 14 software. Findings Seven major themes emerged: (1) scale of ransomware, with incidents impacting a large number of individuals through diverse methods such as phishing and exploiting server vulnerabilities; (2) extent of protected health information vulnerability, with incidents often compromising sensitive health data, treatment records, and personal identifiers; (3) response and notification protocols, where hospitals demonstrate systematic responses including mandatory notifications to HHS, the media, and affected individuals; (4) implementation of safeguards, where hospitals have implemented immediate and long-term security measures post-attack; (5) investigation and regulatory compliance, where each attack is internally investigated, or with third-parties, while OCR conducts compliance reviews to guide corrective actions; (6) third-party involvement, highlighting the significant role of business associates (BAs) in incidents; (7) victim support and services, where hospitals frequently provide credit monitoring and identity protection services. Conclusions The study reveals the increasing prevalence of ransomware attacks targeting hospitals, highlighting significant vulnerabilities and the critical need for enhanced security measures. The findings suggest areas for future research, including the effectiveness of security practices and the long-term impacts on affected individuals.