Cybersecurity preparedness and resilience in health care: a narrative review

A systematic literature review of the relationship between management and resilience in healthcare.

Sustaining safety in healthcare requires interaction among multiple actors. Teams are pivotal for work in healthcare organizations, making constant adaptations while facing the challenges of everyday work. Healthcare teams are central for the emergence of resilience. Despite this, team resilience in healthcare has not been clearly defined. Exploring the definition, conceptualization, and operationalization of team resilience in healthcare could support further theoretical and practical development toward conceptual coherence. Based on a phased ­principle-based concept analysis, team resilience in healthcare was ­understood relatively consistently, but an unambiguous definition was lacking. Two aspects, systemic and team, compose a dualistic component of team resilience in healthcare, affecting both concept and ­characteristics in the definition. The presence of resilience skills and interactions between individuals completed the concept of team resilience, which was previously broadly defined as an emergent system property. The current paper proposes a new model and a theoretical definition. Team resilience in healthcare is a two-faced concept. Further triangulation to adjacent concepts and studies of how teams contribute to resilience may help to further clarify the conceptual components and support robust operationalization.

Technology impacts almost every aspect of our lives and has become an important part of healthcare services. The most important reason for introducing technological advancements in healthcare is to enhance or maintain the high quality of care. Digital learning tools (e.g. digital guides, webinars, and dialogue forums) have the potential to increase flexibility and adaptability in healthcare which are important features of resilience in healthcare. In the current chapter, we discuss how digital learning tools can be used to promote resilience in healthcare by using examples from two research projects; one in which a digital guide to support managers in their quality improvement work is designed, tested, and evaluated (the SAFE-LEAD project), and one aiming to develop future digital learning tools for collaborative learning to facilitate resilience in healthcare (the Resilience in Healthcare project). We argue that for digital learning tools to have the potential to promote resilience in healthcare, they should stimulate individual and collective reflections and discussions. Furthermore, the tools must be found relevant by the target audience and have the capacity to create collaborative learning and reflections between relevant stakeholders within and outside healthcare organisations, about current quality and safety practice, challenges and needs for adaptations and improvement efforts. By stimulating collaborative learning, reflections, and adaptive capacity, digital learning tools have the potential to promote resilience in healthcare, and thereby increasing healthcare quality.KeywordsResilience in healthcareDigital toolsTechnologyHealthcare servicesCollaborative learningAdaptive capacityReflexive spaces

Relatively little research has been directed toward the assessment of resilience in the health care context. Given the stressors associated with the provision of health care, the present study describes the development and evaluation of a situational judgement test (SJT) designed to assess resilience in palliative care health care workers. An SJT was developed to measure behaviours associated with resilience in a palliative care context. Next, SJT reliability and validity analyses were assessed in a sample of acute ward, hospice and community palliative care workers (n=284). Findings showed the SJT to have a negative association with self-reported sickness absence and a positive association with well-being and employee attitudes (in terms of turnover intention, organisational commitment and job satisfaction). A series of two-wave longitudinal (hierarchical) regressions showed the SJT was predictive of well-being and employee attitudes at two time-points (4weeks apart) over and above self-report measures of resilience, education and experience, and the Big Five personality dimensions of Emotional Stability and Openness. Reliability analyses showed the SJT to have acceptable test-retest scores (ρ=0.71) and high internal consistency (α=0.91). The study findings suggest that the SJT is a valid assessment of resilience in at-risk workers and can be used in either summative or formative assessment under the right set of conditions. More research is needed to test the hypothesis that the SJT might be used as a formative tool to develop workplace resilience.

Healthcare organizations have always faced challenges, yet the past decade has been particularly difficult due to workforce shortages, the COVID-19 pandemic, and economic demands, all of which can impact quality of care. While some healthcare organizations have demonstrated the ability to adapt to such stressors-which has been termed "organizational resilience"-others have not. Most of the research on resilience in healthcare has been on individual clinicians; less is known about how extra-individual groups such as teams, units, and systems develop resilience. Understanding what organizational resilience is, how to measure it, and how healthcare organizations can develop it is essential to responding effectively to future acute and chronic stressors in the healthcare industry. The purpose of this scoping review is to synthesize how organizational resilience is defined and measured in the current healthcare literature and to inform future interventions to improve organizational resilience. We searched PubMed and Scopus databases for articles mentioning organizational resilience in healthcare. Eligible sources were those published in English through December 2023 in any format, and that described or measured organizational resilience in healthcare. Titles and abstracts were screened, and information was extracted from eligible articles. We screened 243 articles and included 97 in our review. Across these studies, organizational resilience was described as a healthcare system's ability to continue functioning and meet its objectives when exposed to stressful stimuli. Reactive and proactive strategies, as well as reflection, were identified as key components of organizational resilience. Four measures of organizational resilience were developed for use in healthcare, but only two have been validated. Future studies should focus on validating and comparing existing measures of organizational resilience and using them to investigate how organizational resilience may impact quality of care and clinician well-being, allowing the field to move beyond the focus on individual clinician resilience.

Purpose – To summarize and comment on FINRA’s report on cybersecurity practices, published on February 4, 2015, which arose from its 2014 targeted examination of firms’ cybersecurity preparedness. Design/methodology/approach – Explains the implications of the FINRA report and general guidance FINRA provides and expects all firms to consider in connection with developing their respective cybersecurity programs in eight areas: governance and risk management for cybersecurity; cybersecurity risk assessment; technical controls; incident response planning; vendor management; staff training; cyber intelligence and information sharing; and cyber insurance. Findings – There is no doubt that cybersecurity is a key risk facing the financial services industry now. Accordingly, FINRA expects that firms will review the report and assess how the principles and effective practices provided therein could help build or improve cybersecurity readiness. The report reflects FINRA’s risk-management-based approach to cybersecurity issues, identifying principles and “effective practices” for member firms to consider, as opposed to decreeing specific requirements, policies or procedures. Originality/value – Expert guidance from experienced securities lawyers.

Purpose Cyber attacks on health care are ubiquitous, increasingly sophisticated and can cost lives. The health care sector has been lagging behind other industries in digital transformation, including investments in cybersecurity. Stakeholders’ awareness of their own responsibilities and those of others in mitigating cyber threats is often limited. Design/methodology/approach For this narrative literature review, on 30 April 2025, we searched without date, language or geographical restrictions PubMed, Web of Science, Scopus, IEEE Xplore and EBM Reviews for journal articles that reported practical approaches and actionable recommendations to improve cybersecurity in health care. Our initial search returned 720 articles; following supplementary searches and screening, a total of 45 relevant documents were included. Findings Described are the expected roles of key stakeholders in mitigating cyber threats, from governments and lawmakers to health care managers, information technology experts and clinical providers. Health care organisations must step up investments in cybersecurity. Each organisation must develop and implement a strong cybersecurity strategy. State-of-the-art approaches include training to resist phishing, as well as the use of the principle of least privilege for user and administrative access, traffic monitoring tools, endpoint detection and response technologies, along with timely security patching. Zero trust architecture is gaining in relevance and use. Best approaches to balancing cybersecurity with minimal disruption of workflows include user-centric solutions that utilise multi-factor authentication combined with one-time passwords, biometrics or smart cards. Originality/value A comprehensive overview of practical approaches and actionable recommendations for improving cybersecurity in health care, presented by key stakeholders’ roles, delineating state-of-the-art in this fast-moving field.

BackgroundTo provide high quality services in increasingly complex, constantly changing circumstances, healthcare organizations worldwide need a high level of resilience, to adapt and respond to challenges and changes at all system levels. For healthcare organizations to strengthen their resilience, a significant level of continuous learning is required. Given the interdependence required amongst healthcare professionals and stakeholders when providing healthcare, this learning needs to be collaborative, as a prerequisite to operationalizing resilience in healthcare. As particular elements of collaborative working, and learning are likely to promote resilience, there is a need to explore the underlying collaborative learning mechanisms and how and why collaborations occur during adaptations and responses. The aim of this study is to describe collaborative learning processes in relation to resilient healthcare based on an investigation of narratives developed from studies representing diverse healthcare contexts and levels.MethodsThe method used to develop understanding of collaborative learning across diverse healthcare contexts and levels was to first conduct a narrative inquiry of a comprehensive dataset of published health services research studies. This resulted in 14 narratives (70 pages), synthesised from a total of 40 published articles and 6 PhD synopses. The narratives where then analysed using a thematic meta-synthesis approach.ResultsThe results show that, across levels and contexts, healthcare professionals collaborate to respond and adapt to change, maintain processes and functions, and improve quality and safety. This collaboration comprises activities and interactions such as exchanging information, coordinating, negotiating, and aligning needs and developing buffers. The learning activities embedded in these collaborations are both activities of daily work, such as discussions, prioritizing and delegation of tasks, and intentional educational activities such as seminars or simulation activities.ConclusionsBased on these findings, we propose that the enactment of resilience in healthcare is dependent on these collaborations and learning processes, across different levels and contexts. A systems perspective of resilience demands collaboration and learning within and across all system levels. Creating space for reflection and awareness through activities of everyday work, could support individual, team and organizational learning.

BackgroundThe coronavirus pandemic has had a profound impact on organization and delivery of care. The challenges faced by healthcare organizations in dealing with the pandemic have intensified interest in the concept of resilience. While effort has gone into conceptualising resilience, there has been relatively little work on how to evaluate organizational resilience. This paper reports on an extensive review of approaches to resilience measurement and assessment in empirical healthcare studies, and examines their usefulness for researchers, policymakers and healthcare managers.MethodsVarious databases (MEDLINE, EMBASE, PsycINFO, CINAHL (EBSCO host), Cochrane CENTRAL (Wiley), CDSR, Science Citation Index, and Social Science Citation Index) were searched from January 2000 to September 2021. We included quantitative, qualitative and modelling studies that focused on measuring or qualitatively assessing organizational resilience in a healthcare context. All studies were screened based on titles, abstracts and full text. For each approach, information on the format of measurement or assessment, method of data collection and analysis, and other relevant information were extracted. We classified the approaches to organizational resilience into five thematic areas of contrast: (1) type of shock; (2) stage of resilience; (3) included characteristics or indicators; (4) nature of output; and (5) purpose. The approaches were summarised narratively within these thematic areas.ResultsThirty-five studies met the inclusion criteria. We identified a lack of consensus on how to evaluate organizational resilience in healthcare, what should be measured or assessed and when, and using what resilience characteristic and indicators. The measurement and assessment approaches varied in scope, format, content and purpose. Approaches varied in terms of whether they were prospective (resilience pre-shock) or retrospective (during or post-shock), and the extent to which they addressed a pre-defined and shock-specific set of characteristics and indicators.ConclusionA range of approaches with differing characteristics and indicators has been developed to evaluate organizational resilience in healthcare, and may be of value to researchers, policymakers and healthcare managers. The choice of an approach to use in practice should be determined by the type of shock, the purpose of the evaluation, the intended use of results, and the availability of data and resources.

This study seeks to identify the concept of resilience and reflect on factor that made women's heath vulnerable and protected (at personal level and in health services) during the COVID-19 pandemic. This is an integrative review of the literature, carried out in the SciELO, BVS, PubMed and LILACS databases, using the descriptors resilience, women's health, gynecology, obstetrics, COVID-19 and pandemic, covering the years 2020 to 2022, in Portuguese and English. 43 articles were included and analyzed in 4 thematic areas: concept of resilience, impacts of the pandemic on health services, stressors and personal resilience factors, and impacts of the pandemic on women' lives. Highlights difficulties in adapting the health network to the crisis stand out, as well as losses in access to services and information, leading to physical and mental harm, especially for the most vulnerable population. Factors that promote resilience were physical activity, interpersonal support, routine, education, income and maintenance of some services. Resilience in healthcare is a new, complex and promising field, which should be encouraged, as it contributes to strategies for improving and adapting healthcare systems and people's lives, preventively, during and after crises.

BackgroundThe vulnerability of health care systems to cyberattacks and breaches of health information is on the rise worldwide. Considering the increasing rate of reported cyber incidents and the risks they pose to patient safety, privacy, and financial losses, there is a need to examine the way cybersecurity is conceptualized in health care organizations, taking into account technology, processes, and humans.ObjectiveThis study examined the dynamics of the factors of vulnerabilities and cyberattacks in the context of sociotechnical systems theory underlying the relationships among humans, technology, and processes. It developed a conceptual sociotechnical cybersecurity framework for preventing vulnerabilities and responding to cyberattacks and threats in health care systems.MethodsA scoping review was conducted to search the extant literature in 3 databases—Web of Science, PubMed (MEDLINE), and Scopus. A total of 1375 papers from the period of 2012-2024 were retrieved, 76 of which, in the domain of health care and cybersecurity, were reviewed and analyzed. Original research and review papers were included. Only published English-language papers were included to focus on contemporary issues, challenges, and solutions. Relevant information from the included sources was charted and summarized. The study characteristics were extracted from the included papers, and the evidence was synthesized using thematic analysis.ResultsOf the 1375 papers identified, 76 (5.5%) met the inclusion criteria. The results showed that the factors of vulnerabilities to cyberattacks comprise 12 subfactors in health care systems. Concerning technology-related factors of vulnerabilities, most studies described the complex system design and usability (16/76, 21%) and integration of new technology (15/76, 20%) as challenges in health care systems. Concerning human-related factors, most studies described a shortage of skilled professionals and limited budgets as contributing to poor cybersecurity management. The study found that processes involved both technology and humans relative to the unit factors of vulnerabilities to cyberattacks. There was a sociotechnical interplay across the factors of vulnerabilities. The concept of sociotechnical cybersecurity offers a comprehensive and explicit perspective on the sociotechnical underpinning and joint optimization required to advance cybersecurity toward achieving sustainable health care systems.ConclusionsThe conceptual framework of sociotechnical cybersecurity provides a contemporary foundation and deep insight for identifying and preventing vulnerabilities and responding to cyberattacks in health care systems. The framework is important due to its suitability, applicability, and customizability for dynamic and complex health care systems. The study also provides compliance standards for applying the proposed conceptual framework to guide health care organizations in cybersecurity practices. The study of cybersecurity through the sociotechnical lens in the health care domain is limited. Further studies are needed on cybersecurity incident management. Health care organizations should leverage the strength of cybersecurity through the implementation of risk assessment and incident response plans.

Accountability to Population Health in the COVID-19 Pandemic: Designing Health Care Delivery Within a Social Responsibility Framework.

BackgroundInternationally, the impact of continued exposure to workplace environmental and psychological stressors on health care professionals’ mental health is associated with increased depression, substance misuse, sleep disorders, and posttraumatic stress. This can lead to staff burnout, poor quality health care, and reduced patient safety outcomes. Strategies to improve the psychological health and well-being of health care staff have been highlighted as a critical priority worldwide. The concept of resilience for health care professionals as a tool for negotiating workplace adversity has gained increasing prominence.ObjectiveThis systematic review aims to examine the effectiveness of web-based interventions to enhance resilience in health care professionals.MethodsWe searched the PubMed, CINAHL, PsycINFO, and Ovid SP databases for relevant records published after 1990 until July 2021. We included studies that focused on internet-delivered interventions aiming at enhancing resilience. Study quality was assessed with the Risk of Bias 2 tool for randomized controlled trial designs and Joanna Briggs Institute critical appraisal tool for other study designs. The protocol was registered on PROSPERO (International Prospective Register of Systematic Reviews; CRD42021253190). PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines were followed.ResultsA total of 8 studies, conducted between 2014 and 2020 and involving 1573 health care workers, were included in the review. In total, 4 randomized controlled trial designs and 4 pre- and postdesign studies were conducted across a range of international settings and health care disciplines. All of these studies aimed to evaluate the impact of web-based interventions on resilience or related symptoms in health care professionals involved in patient-facing care. Interventions included various web-based formats and therapeutic approaches over variable time frames. One randomized controlled trial directly measured resilience, whereas the remaining 3 used proxy measures to measure psychological concepts linked to resilience. Three pretest and posttest studies directly measured resilience, whereas the fourth study used a proxy resilience measure. Owing to the heterogeneity of outcome measures and intervention designs, meta-analysis was not possible, and qualitative data synthesis was undertaken. All studies found that resilience or proxy resilience levels were enhanced in health care workers following the implementation of web-based interventions. The overall risk of bias of all 8 studies was low.ConclusionsThe findings indicate that web-based interventions designed to enhance resilience may be effective in clinical practice settings and have the potential to provide support to frontline staff experiencing prolonged workplace stress across a range of health care professional groups. However, the heterogeneity of included studies means that findings should be interpreted with caution; more web-based interventions need rigorous testing to further develop the evidence base.Trial RegistrationPROSPERO CRD42021253190; https://www.crd.york.ac.uk/prospero/display_record.php?RecordID=253190

Introduction: Small and medium-sized enterprises (SMEs) and healthcare organizations in the United States face significant cybersecurity challenges, with studies indicating that over 60% of SMEs have experienced a data breach in recent years. This study explores the critical strategies and best practices for preventing data breaches and enhancing cybersecurity resilience within these organizations. The digital transformation of business operations has exposed SMEs and healthcare organizations to a growing landscape of cybersecurity risks. These entities often lack the resources, expertise, and awareness necessary to implement comprehensive security measures, rendering them particularly vulnerable to data breaches and other malicious cyber activities. For instance, a study by the National Cybersecurity Centre found that 43% of SMEs in the U.S. reported a cybersecurity breach in the past 12 months. Understanding the unique challenges faced by SMEs and the healthcare sector is crucial in developing effective breach prevention strategies. Materials and Methods: This study employs a systematic literature review of 35 scholarly articles, industry reports, and government publications to assess the current state of cybersecurity practices and the available strategies for SMEs and healthcare organizations. The review analyses the factors influencing cybersecurity readiness, the common vulnerabilities exploited by cyber attackers, and the emerging best practices for enhancing organizational resilience. Results: The findings indicate that SMEs and healthcare organizations face significant barriers in implementing robust cybersecurity measures, including limited budgets (with over 50% of SMEs spending less than $500 annually on cybersecurity) and lack of in-house technical expertise (only 28% of SMEs have a dedicated IT security professional). However, the literature also highlights several effective strategies, such as employee security awareness training (implemented by 72% of healthcare organizations), implementing multi-factor authentication (adopted by 65% of SMEs), regularly updating software and systems, and developing comprehensive incident response plans. Discussion: The study emphasizes the crucial role of proactive and collaborative approaches in addressing the cybersecurity challenges faced by SMEs and healthcare organizations. Fostering public-private partnerships, leveraging government resources and incentives (utilized by 41% of SMEs), and promoting industry-specific cybersecurity frameworks can help these entities strengthen their security posture and better protect their sensitive data and critical infrastructure. Conclusion: Effective breach prevention in SMEs and healthcare organizations requires a multifaceted approach that combines technological, organizational, and human-centric strategies Through the identification of these challenges specific to these entities and subsequent adoption of these best practice measures the entities are better placed to improve their organizational cybersecurity and protect themselves against these threats. The fact-finding of this study serves as a reference guide to both SMEs and healthcare organizations on how best to improve on their security measures and design ways of fighting data loss.

Current literature emphasises the importance of resilience in health care. Studies have shown that lack of resilience not only leads to adverse clinical outcomes but is also associated with burnout and long-term stress in clinicians. Resource-limited rural settings in the United States often impose unique stressors, and thus, it is critical to examine resilience of health care providers practicing rural medicine. An anonymous REDCap survey was completed by medical students, residents and attending physicians between 7 April 2021 and 18 May 2022. The primary outcome of resilience was measured by the Connor-Davidson Resilience Scale 10 (CD-RISC-10©). Survey takers scored moderately on the resilience scale (30.64 on a 40-point scale). The first quartile of respondents scored between 0 and 28; the second quartile scored between 29 and 30; the third quartile scored between 31 and 35; the fourth quartile scored between 36 and 40. Age and years of service were not correlated with resilience. However, survey takers who had been exposed to trauma informed care scored significantly higher on the resilience scale (32.37 vs. 28.85, p = 0.021). The level of resilience when compared by profession was found to be comparable among medical students, residents and attending physicians. Individuals scoring in the first two quartiles of the CD-RISC-10© perhaps indicate need for support as they are having difficulty coping with stress. Health care organisations should provide resilience training to support the wellness and mental health of their staff. Moreover, dedicated efforts should be made toward creating trauma-informed health care organisations as exposure to the topic of trauma informed care had a significant positive impact on resilience.