IT Failures in Hospitals - Structures and Processes in Hospitals for Coping Cyber Attacks

Abstract

Clinics are, by definition, part of a country's critical infrastructure. In recent years, hospitals have increasingly become the target of cyber attacks, resulting in disruptions to their functionality lasting weeks to even months. According to the "National Strategy for the Protection of Critical Infrastructures (CRITIS Strategy)", clinics are legally obligated to take preventive measures against such incidents. This involves evaluating, defining, and developing failure concepts for IT-dependent processes within a clinic to be prepared for a cyber attack. Specifically tailored emergency plans for computer system failures should be created and maintained in all IT-dependent areas of a clinic.Additionally, paper-based alternative solutions, such as request forms for diagnostic or consultation services, department-specific emergency documents, and patient documentation charts, should be kept in a readily accessible location known to staff in the respective areas. The complete restoration of a clinic's network after a cyber attack often requires extensive recovery of numerous IT systems, which may take weeks to months in some cases.If the hospital has robust plans for cyber emergency preparedness, including regular scans and real-time backups, stabilization and a quicker resumption of operations may be possible.