BUSI 505 Week 2 Case Study Discussion Board Forum 1 Example

Case Study Discussion Board Forum 1: Ransomware and Health Information Security

BUSI 505 Healthcare Informatics, Case Study Discussion Board Forum 1

Thread by [Student Name]

The hospital, the attack and the classmates are composites; the textbooks, Scripture and the peer-reviewed sources cited are real.

Our case is a 220-bed community hospital whose systems were encrypted by ransomware early on a Saturday morning. Within hours, the electronic health record, laboratory and imaging systems, pharmacy dispensing cabinets and phone directory were unavailable. Staff switched to paper charting, the emergency department went on diversion for ambulances for most of the first week and elective surgeries were canceled. The hospital did not pay the ransom, and full restoration took about three weeks. Investigators later found that attackers entered through a phishing email weeks earlier, moved freely across a network with few internal barriers and also encrypted backups that were connected to the main network. Leaders later estimated the attack's cost, including lost revenue, recovery work and overtime, at several million dollars, before counting any harm to patients whose care was delayed.

The case reflects a national pattern. Neprash et al. (2022) built a database of 374 ransomware incidents that struck American care providers between 2016 and 2021, and those incidents put the protected health information of roughly 42 million people at risk. Attacks per year climbed from the forties to the nineties over the period, and in close to half of the incidents patients felt the effects, usually as computer downtime or appointments that had to be canceled. Using Medicare claims, Neprash et al. (2024) found that during the first week of an attack, inpatient admissions fell by 14.7% at rural hospitals and 16.9% at urban hospitals, with outpatient visits falling even more sharply, and volumes took two to three weeks to recover. The lost revenue alone can threaten a small hospital's finances, and the authors noted that rural patients have fewer nearby alternatives when their hospital cannot function. Our case hospital's experience, with diversion and canceled surgeries for most of a week, fits the national pattern closely.

Nelson and Staggers (2014) describe information security as protecting the confidentiality, integrity and availability of information, and this attack was above all a failure of availability. Braunstein (2014) emphasizes that health information systems are now interconnected infrastructure, so a weakness in one system can disable many. In our case, three weaknesses turned an intrusion into a crisis. First, staff training on phishing was an annual online module that few remembered. Second, the network was flat, so once inside, attackers could reach nearly every server. Third, backups were connected to the network and encrypted with everything else, and downtime procedures had not been practiced in two years, so units improvised. Nurses could not see medication histories, laboratory results arrived by runner and the emergency department lost its tracking board. Each of these failures was predictable, and each had a known remedy that had not been funded or practiced.

I would recommend changes in three areas. For people, frequent short phishing simulations with immediate feedback, and multifactor authentication for all remote access. For technology, network segmentation so clinical systems are separated, and offline or immutable backups tested by actually restoring them. For procedures, downtime drills twice a year on every unit, printed downtime packets and agreements with neighboring hospitals for diversion and laboratory support. Governance matters as well: the board should receive a cybersecurity risk report at least twice a year, just as it reviews financial and quality risk, and the chief information security officer should report to senior leadership rather than sit several layers down in information technology. A hospital's cybersecurity plan is really a patient safety plan for the day the screens go dark.

When Nehemiah's builders faced threats while rebuilding Jerusalem's wall, they prayed and set a guard day and night (English Standard Version Bible, 2001/2016, Nehemiah 4:9). Faith did not replace vigilance; it accompanied it. Health care leaders who steward patients' information and care are called to the same combination of trust and preparation.

Reply to Natalie

Natalie, you made an important point that a ransomware attack affects not only the targeted hospital but every hospital nearby, and research supports your concern. Most security planning still assumes that each organization's risk is its own, which leaves regional effects largely unplanned. Dameff et al. (2023) tracked what happened at two unaffected academic emergency departments while a neighboring health system, responsible for roughly a quarter of the county's hospital discharges, spent a month crippled by ransomware. On an average day during the attack, those two departments treated roughly 33 more patients than before, climbing from about 218 to about 251, along with more ambulance arrivals, longer waits and more stroke code activations, all without any breach of their own systems. Pham et al. (2024) examined the same event and found that the number of cardiac arrests treated at the adjacent hospitals rose from 21 in the month before the attack to 38 during it, exceeding forecasts, and the share of patients surviving with good neurologic outcomes fell. Taken together, these findings suggest that ransomware should be treated as a regional disaster rather than a private problem for one organization. The patients harmed may never have set foot in the targeted hospital; they simply needed an ambulance or a stroke team on the wrong day, in a region where one large system had gone dark and others were absorbing its patients without warning. Nelson and Staggers (2014) note that health information systems increasingly depend on exchange among organizations, which means security is a shared responsibility across a community rather than a boundary each hospital defends alone. Braunstein (2014) likewise describes informatics as infrastructure, and infrastructure failures spread. For managers, the practical implication is to include cyberattacks in regional emergency planning: mutual aid agreements, shared diversion protocols, surge staffing plans and communication channels that do not depend on the affected hospital's systems. Emergency medical services agencies should be part of that planning, since ambulance crews decide minute by minute where patients go when a hospital closes its doors. Paul urged believers to do good to everyone as they have opportunity (English Standard Version Bible, 2001/2016, Galatians 6:10), and neighboring hospitals that absorb displaced patients during an attack are living out that principle. Does your region's health care coalition include cyberattacks in its preparedness exercises, alongside storms and mass casualty events? If not, a tabletop drill built around a neighboring system's outage could reveal gaps before a real event exposes them. Such a drill could test whether emergency departments can share real-time capacity information by phone or radio, whether laboratories can accept specimens from a neighbor and whether stroke and cardiac teams can absorb a sudden increase in volume. The answers would give each hospital's leaders a concrete list of improvements to fund.

Reply to Marcus

Marcus, you raised a hard question about whether small and rural hospitals can realistically afford the cybersecurity protections that large systems use. Many small hospitals have one or two information technology staff responsible for everything from printers to the electronic record, and security competes with every other request. The concern is well founded, since the consequences of an attack can be more severe for small hospitals even when the immediate disruption is similar. Neprash et al. (2024) found that rural and urban hospitals experienced comparable drops in volume during the first week of an attack, but the authors noted that the same percentage loss can do more damage in rural areas, where patients travel farther for alternatives and hospitals have thinner financial margins. Bidoki et al. (2026) examined more than 2,200 health care organizations using federal breach reports and hospital survey data and found that larger organizations were less likely to report breaches and ransomware attacks, while measures of information technology staffing and spending did not clearly reduce risk, which suggests that how resources are used matters more than how much is spent. That finding should encourage small hospitals, because careful choices can matter as much as large budgets, and some of the most effective protections cost relatively little. Braunstein (2014) describes cloud-based and shared services as one way smaller organizations can gain capabilities they could not build alone, and Nelson and Staggers (2014) emphasize that security depends heavily on people and policies, not only on technology. For a small hospital, the most cost-effective steps may be multifactor authentication, offline backups tested regularly, phishing training and a managed security service shared with other hospitals through a network or state association. These measures address the most common ways attackers enter and the main reason attacks become catastrophic, which is the loss of usable backups. Federal and state programs also offer free vulnerability scanning and guidance, which a small hospital should use before buying new products. Board members can help by asking for a simple annual assessment of these basics rather than leaving security entirely to an overstretched information technology director. The Preacher observes that if the iron is blunt, a person must use more strength, but wisdom helps one to succeed (English Standard Version Bible, 2001/2016, Ecclesiastes 10:10), and small hospitals can make up for limited resources by choosing protections wisely. Would your hospital consider joining with others in its region to share a security operations service, even if it meant giving up some independence in how security is managed? Pooling resources may be the only way small hospitals can afford around-the-clock monitoring, and it would also give each member a peer network to call when something looks wrong. Several state hospital associations have begun offering this kind of shared service, which suggests the model is practical.

References

Bidoki, M. Z., Heath, M. L., & Silvera, G. A. (2026). Band-aids and firewalls: A resource-based view of ransomware attack vulnerability in health care organizations. Health Care Management Review, 51(1), 54-65. https://doi.org/10.1097/HMR.0000000000000463

Braunstein, M. L. (2014). Contemporary health informatics. AHIMA Press.

Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A. (2023). Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open, 6(5), e2312270. https://doi.org/10.1001/jamanetworkopen.2023.12270

English Standard Version Bible. (2016). Crossway. (Original work published 2001)

Nelson, R., & Staggers, N. (2014). Health informatics: An interprofessional approach. Elsevier Mosby.

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

Neprash, H. T., McGlave, C. C., Rydberg, K., & Henning-Smith, C. (2024). What happens to rural hospitals during a ransomware attack? Evidence from Medicare data. The Journal of Rural Health, 40(4), 728-737. https://doi.org/10.1111/jrh.12834

Pham, T. T., Loo, T. M., Malhotra, A., Longhurst, C. A., Hylton, D., Dameff, C., Tully, J., Wardi, G., Sell, R. E., & Pearce, A. K. (2024). Ransomware cyberattack associated with cardiac arrest incidence and outcomes at untargeted, adjacent hospitals. Critical Care Explorations, 6(4), e1079. https://doi.org/10.1097/CCE.0000000000001079