Beyond Security Patches—Fundamental Incentive Problems in Health Care Cybersecurity

With ransomware attacks now targeting critical US infrastructure, hospitals and health systems are under serious threat. In May 2021, at least 1 US health system and multiple hospitals overseas were victims of ransomware attacks. 1 These attacks, which lock up health records and render patient health information inaccessible, force health systems to suspend operations and risk the release of protected health information (PHI) if they do not pay the ransoms. In addition to blocking access to health records, cyberattackers can also disable critical medical devices such as infusion pumps, ventilators, and scanners.