{"id":17359,"date":"2026-09-21T19:04:00","date_gmt":"2026-09-21T19:04:00","guid":{"rendered":"https:\/\/cjni.net\/journal\/?p=17359"},"modified":"2026-09-30T09:41:20","modified_gmt":"2026-09-30T09:41:20","slug":"cybersecurity-threats-to-hospital-information-systems-a-narrative-review-of-risks-patient-safety-impacts-and-defensive-strategies-with-implications-for-the-united-states","status":"publish","type":"post","link":"https:\/\/cjni.net\/journal\/?p=17359","title":{"rendered":"Cybersecurity Threats to Hospital Information Systems: A Narrative Review of Risks, Patient-Safety Impacts, and Defensive Strategies with Implications for the United States"},"content":{"rendered":"
\n

by Crissinee Sucharitrak<\/a>, MBA, MSIT, CNA<\/em><\/p>\n\n\n\n

Master of Science in Information Technology Management (Business Analytics)<\/em><\/p>\n\n\n\n

California Baptist University, Riverside, CA, United States; Independent Researcher<\/em><\/p>\n\n\n\n

ORCID: 0009-0007-2825-7755<\/em><\/p>\n\n\n\n

Citation:<\/strong> Sucharitrak, C. (2026). Cybersecurity threats to hospital information systems: A narrative review of risks, patient-safety impacts, and defensive strategies with implications for the United States. Canadian Journal of Nursing Informatics, 21<\/em>(3). https:\/\/cjni.net\/journal\/?p=17359<\/p>\n\n\n

\n
\"Cybersecurity<\/figure><\/div>\n\n\n

Abstract<\/strong><\/h2>\n\n\n\n

Background:<\/strong> United States (U.S.) hospitals are rapidly embracing technology in clinical processes. However, cybersecurity in hospitals is too often considered from an information-technology (IT) perspective instead of a patient safety perspective.<\/p>\n\n\n\n

Objectives:<\/strong> This narrative review provides a synthesis of current evidence on cyber threats to hospital information systems, the impacts of cyberattacks on patient safety, the vulnerabilities used by attackers in human and technical domains, and defenses against those threats.<\/p>\n\n\n\n

Methods:<\/strong> Peer-reviewed, open-access articles from PubMed and Europe PMC on hospital cyber threats, patient-safety impacts, vulnerabilities, and defenses were purposively selected and narratively synthesized.<\/p>\n\n\n\n

Results:<\/strong> Ransomware attacks, phishing attacks, and data breaches form the threat landscape; human error and insecurely connected medical devices are the main vectors of cyberattacks. The attackers harm hospitals in more ways than just financial losses and privacy violations, but through evident damage to the patients\u2019 treatment delays, ambulance diversion, higher death rates within the hospitals, and worse results of out-of-hospital cardiac arrests even at hospitals close by.<\/p>\n\n\n\n

Conclusions:<\/strong> The cybersecurity of hospital information systems is a patient-safety issue, not an IT issue. Layered defenses in socio-technical systems in the form of incident-response preparation, governance, security culture, ongoing workforce training, and emerging technical defense mechanisms should be adopted by U.S. hospitals.<\/p>\n\n\n\n

Keywords:<\/strong> <\/em>cybersecurity; ransomware; hospital information systems; patient safety; data breach; medical device security; HIPAA; United States; health informatics<\/p>\n\n\n\n

Background<\/h2>\n\n\n\n

Health care stands out as one of the most technologically advanced, and consequently, most attacked industries in the world economy. In particular, the introduction of electronic health records (EHRs), various medical devices, telemedicine technologies, and cloud-based analytics made the operation of those information systems integral parts of the clinical workflow, and thus any interruption of their work would be a question of patients’ safety. Ransomware attacks against hospitals happen several times per week all over the world (Jiang et al., 2025<\/a>; Martin et al., 2026<\/a>). The U.S. health care sector is well integrated in this interconnected environment. EHRs are widely adopted; interoperability and the information-blocking regulations of the 21st Century Cures Act promote the exchange of patient data between the institutions, and the emerging Trusted Exchange Framework and Common Agreement (TEFCA) promises national interoperability, thus enabling exchange of patient data between an increasing number of institutions. Interconnectedness means greater exposure.<\/p>\n\n\n\n

These risks are concrete, not abstract. Several attacks on health care institutions in the United States occurred since the country experienced various threats to its health care sector, ranging from massive theft of patient data to ransomware events causing long-term hospital outages. Thus, the February 2024 attack on Change Healthcare affected the claim processing, prescription fulfillment, and payment capabilities for about 192.7 million people, and it can be seen as the largest health care data breach in the country’s history. Moreover, ransomware attacks on health care entities such as Ascension and CommonSpirit led to ambulance diversions and significant outages of electronic health records (EHR). Consequently, digitization is double-edged: the interoperability that makes it possible to coordinate care across organizations also allows vulnerabilities to spread more easily than in a fragmented, paper-based system. Thus, this narrative review aims to provide a synthesis of evidence on (i) the cyber-threat landscape facing hospital information systems, (ii) the impact of attacks on patient safety, (iii) the human and technical vulnerabilities exploited by the attackers, and (iv) protective measures against those threats, considering all of those aspects within the framework of U.S. law and regulation and the U.S. health system structure in order to provide actionable guidance.<\/p>\n\n\n\n

Scope and approach <\/strong><\/h2>\n\n\n\n

The current work presents a narrative, not a systematic, review. Peer-reviewed articles freely available on PubMed\/Europe PMC, as well as other databases relevant to the topic under consideration during the last decade, were selectively used in this paper with special attention paid to systematic reviews, scoping reviews, empirical studies, and incidents’ analysis. Then, the results were grouped according to the categories: threats, impact, vulnerabilities, and mitigation measures, as well as were further analyzed based on the United States laws and regulations, i.e. HIPAA, HITECH Act, and the FDA’s cybersecurity jurisdiction over medical devices. The aim is to systematize knowledge that would be relevant for U.S. health informatics professionals, rather than conduct an overview of the whole literature on the topic. In total, the synthesis draws on 31 peer-reviewed sources published between 2015 and 2026.<\/p>\n\n\n\n

The Cyber-Threat Landscape in Hospital Information Systems<\/strong><\/h2>\n\n\n\n

Three kinds of threats prevail in the health care cybersecurity literature, namely ransomware, phishing, and data breaches, and they tend to overlap (Jiang et al., 2025<\/a>; Martin et al., 2026<\/a>). Ransomware locks down hospital information systems, and then demands ransom for access to the systems, sometimes in a \u201cdouble-extortion\u201d variant, in which data are exfiltrated before encryption (Martin et al., 2026<\/a>). Table 1 provides an overview of the most common types of attacks, their mechanisms, and the risks associated with them.<\/p>\n\n\n\n

Table 1<\/strong><\/p>\n\n\n\n

Principal Cyber-Threats to Hospital Information Systems: Mechanisms, Hospital-Specific Risk, and Relevance to the U.S. Setting<\/em><\/p>\n\n\n\n

\"Table<\/a><\/figure>\n\n\n\n

It is crucial to appreciate the stages of development in a typical hospital ransomware attack since at each stage there is room for a possible preventative measure (Figure 1). Most of the ransomware attacks on the health care organizations begin with the initial intrusion into the hospital network via phishing e-mails to gain credentials or install malware, or exposing remote access ports (Gordon et al., 2019a<\/a>; Jiang et al., 2025<\/a>). Other activities often include lateral movement inside the network, privilege escalation, and reconnaissance due to the flat architecture of most hospital networks (Clarke & Martin, 2023<\/a>). Afterward, large amounts of information are exfiltrated to increase the pressure created by double extortion (Martin et al., 2026<\/a>). Finally, the ransomware is deployed, usually at night or weekends when there is reduced manpower, with the intent of encrypting the electronic health record (EHR) system, the image repository, laboratory systems, and backups. Viewing the ransomware attack as a kill chain transforms cybersecurity into a process in which the attack can be stopped at multiple checkpoints: phishing prevention, multi-factor authentication of remote access, network isolation, data-exfiltration detection, and assured backup availability.<\/p>\n\n\n\n

Figure 1<\/strong><\/p>\n\n\n\n

Hospital Ransomware Kill Chain and Defensive Checkpoints<\/em><\/p>\n\n\n\n

\"Figure<\/a><\/figure>\n\n\n\n

Note. <\/em>The typical hospital ransomware kill chain and the defensive checkpoint that can interrupt each stage. Because every stage must succeed for the attack to succeed, each layered control is an independent opportunity to stop the intrusion (Clarke & Martin, 2023<\/a>; Gordon et al., 2019a<\/a>; Jiang et al., 2025<\/a>; Martin et al., 2026<\/a>). EHR = electronic health record.<\/p>\n\n\n\n

Phishing is the main type of attack and usually serves as the entry point for the others: many cases in health care involve emails aimed at stealing credentials or deploying malware. Busy health care practitioners are an easy prey for phishing (Gordon et al., 2019a<\/a>; Jiang et al., 2025<\/a>). Data breach, regardless of whether it occurs due to external sources, insiders or compromise of third-party vendors, act as the vehicle through which health data becomes exposed (Jiang et al., 2025<\/a>). Organization-specific characteristics influence the target population: a population-based study has found out that larger hospitals, teaching hospitals and trauma centers were the most susceptible to ransomware attacks due to their high value (McGlave et al., 2023<\/a>). Why does health care suffer disproportionately from cyberattacks? There are at least three sector-specific factors which make it a highly attractive target for cybercriminals. First, clinical data fetch high prices on illicit markets due to the uniqueness of their nature: they combine financial, identity and medical information that cannot be reset. Second, the need for uninterrupted, life-critical operations pressures victims to pay quickly to restore function. Third, the sector has gone through rapid digitalization while investing far less in security (Cartwright, 2023<\/a>; Clarke & Martin, 2023<\/a>).<\/p>\n\n\n\n

All these factors are additionally amplified by structural features: legacy information technology (IT) infrastructure, unpatched software, flattened networks that allow lateral movement, lack of proper separation of traffic, and underfunding of security personnel predictably create the openings attackers exploit (Clarke & Martin, 2023<\/a>). Third-party and supply chain dependence expands the scope of possibilities of attackers even further: compromising a software vendor, a cloud provider or an outsourced service can result in subsequent compromise of all hospitals using it. This was the case in a number of large data breaches in the United States, including the 2024 Change Healthcare incident: compromise of a vendor compromised thousands of health-care organizations that depended on it.<\/p>\n\n\n\n

The COVID-19 Stress Test<\/strong><\/h2>\n\n\n\n

The COVID-19 pandemic served as a global stress test of health-care cybersecurity, and its lessons remain useful for resilience planning. A scoping review of cybersecurity in the \u201cclimate of COVID-19\u201d indicated that the rapid shift to telehealth and remote work enlarged the attack surface much faster than it could be secured, which cybercriminals actively exploited (He et al., 2021<\/a>). In the United States, where telehealth became popular thanks to the Medicare and Medicaid waiver programs and some flexibilities were later made permanent, this message is especially important: any expansion of telehealth should be accompanied by security investments right away.<\/p>\n\n\n\n

Patient Safety and Care Delivery Impacts<\/strong><\/h2>\n\n\n\n

There is one important shift in the contemporary evidence base in comparison to earlier times: today, a cyberattack is considered a patient-safety event, not just a data incident. Previously, cybersecurity in health care was defined by confidentiality and measured by breaches and fines; now it is clear that the availability and integrity of clinical systems are what determines whether it is possible to deliver safe care: inability to use the EHR, laboratories, imaging and drug management systems makes safe care far harder to deliver (Jiang et al., 2025<\/a>; Martin et al., 2026<\/a>). The impacts include canceled and delayed procedures and diagnostics, ambulance diversion, longer hospital stays, a shift to error-prone manual work, and, most importantly, higher in-hospital mortality (Aldosari, 2025<\/a>; Jiang et al., 2025<\/a>).<\/p>\n\n\n\n

The information security triad of confidentiality, integrity, and availability can help localize clinical harm. Availability problems are the most obvious: when the EHR becomes inaccessible, clinicians switch to paper documentation and lose key sources of information such as medication histories and allergy lists (Abbou et al., 2024<\/a>). Integrity problems are less obvious but potentially more harmful: manipulated data, incorrect laboratory results or wrong patient identity can lead to incorrect decisions even after recovery.<\/p>\n\n\n\n

Importantly, the harm is not confined to the attacked institution. After a ransomware attack in one health system, the incidence and outcomes of out-of-hospital cardiac arrest worsened at untargeted neighboring hospitals because of patient diversion (Pham et al., 2024<\/a>). This kind of \u201cspillover\u201d is particularly important for the United States where there are several regional referral centers and Level I trauma hospitals forming networks with other community hospitals; halting a hub leads to overflow of adjacent hospitals that are already overloaded.<\/p>\n\n\n\n

All these results show that cybersecurity is an important element of clinical governance: the cyberattack disrupts the processes which are the subject of quality-and-safety programs (Aldosari, 2025<\/a>). In the United States, where safety-net and rural hospitals operate with narrow margins, this vulnerability directly impacts access for the patients: people who cannot afford a delayed visit or a diverted ambulance are the very people these hospitals serve.<\/p>\n\n\n\n

Human and Technical Vulnerabilities<\/strong><\/h1>\n\n\n\n

The Human Factor<\/strong><\/h2>\n\n\n\n

Human behavior is the most reliably exploited vulnerability, and by design: most successful intrusions rely on a person opening an attachment, reusing a password, or falling for social engineering. Thus, the workforce represents the largest attack surface and the key defense line, which is why technical means alone cannot prevent cyberattacks. A large multicenter simulation study of the susceptibility to phishing attacks in U.S. hospitals showed meaningful click rates, and even more importantly, that repeated exposure decreases the susceptibility (Gordon et al., 2019a<\/a>). However, such change does not happen automatically: a mandatory training program targeting the most vulnerable employees failed to produce statistically significant change, which means that broader approaches are needed (Gordon et al., 2019b<\/a>). Another single-center study showed that realistic and tailored phishing lures work better and that a full-fledged awareness program, not just compliance training, is required (Rizzoni et al., 2022<\/a>).<\/p>\n\n\n\n

There are two particularities of the clinical setting which make this process more complicated. First, clinicians are subjected to time pressure and have high cognitive load, and this is what makes the attacks effective: a carefully crafted phishing lure posing as a colleague or a patient exploits exactly this situation. Second, the clinical settings are known to have poor credential practices (shared workstations, written-down passwords for quick access, and reused login credentials) that make technical controls ineffective, which is why multi-factor authentication and single sign-on are always recommended. If clinicians see security as an IT problem, their compliance becomes reluctant and workarounds appear, and cyber hygiene methodology is proposed to address this issue (Argyridou et al., 2023<\/a>). Contemporary research highlights the dual dynamics of the problem: on the one hand, advancement of artificial intelligence (AI) makes phishing more sophisticated, providing localization of the attacks on a large scale; on the other hand, it also provides additional tools to fill data gaps and improve the human security posture; at the same time, AI in clinical settings creates attack vectors for hackers (Jalali & Largman, 2025<\/a>), and intelligent medical devices pose unique cybersecurity challenges (Di Palma et al., 2025<\/a>).<\/p>\n\n\n\n

Vulnerable Medical Devices and the Internet of Medical Things<\/strong><\/h2>\n\n\n\n

Networked medical devices represent a large part of the attack surface. Devices such as infusion pumps and imaging systems often come with default or hardcoded credentials and outdated software versions, which makes them much more vulnerable than regular IT products (Bracciale et al., 2023<\/a>; Williams & Woodward, 2015<\/a>). Originally created for standalone use, these devices become exposed to the threats they were never designed to defend against after becoming connected to the hospital network (Williams & Woodward, 2015<\/a>). Remediation prioritization approaches are developing: the Common Vulnerability Scoring System adjusted to the biomedical technology environment (CVSS BTE) allows for quantification of the cyber risk of medical devices in clinically meaningful units (Bracciale et al., 2025<\/a>).<\/p>\n\n\n\n

Results of the scoping review and systematic review of Internet of Medical Things (IoMT) cybersecurity have shown that the approaches of risk assessment are maturing but are inconsistently applied, and machine learning is used increasingly for detection of abnormal device behavior (Hameed et al., 2021<\/a>; Svandova & Smutny, 2024<\/a>); meanwhile, implementation of medical device security programs with inventory, procurement policies, patching and lifecycle governance is recommended but is not common practice yet (Youssef, 2022<\/a>). The result is many medical devices that are difficult to patch, replace, and disconnect, especially in resource-poor institutions which rely on aging equipment. Many imaging, laboratory, and monitoring systems in U.S. hospitals run operating systems that no longer receive vendor updates yet remain in service, so the practical near-term defense is network isolation. Procurement is another tool which is underutilized: embedding security requirements into the purchase contract (such as password management, update requirements, and end-of-support notification) defines the risk of a device throughout its lifespan, and the FDA now mandates pre-market cybersecurity for networked medical devices.<\/p>\n\n\n\n

The U.S. Regulatory and Health-System Context<\/strong><\/h2>\n\n\n\n

Regulation of health care cybersecurity in the United States is based on HIPAA and its implementing regulations. The HIPAA Security Rule mandates that covered entities and their business associates implement administrative, physical and technical safeguards for electronic protected health information (ePHI), such as risk analysis, access controls, audit logging and contingency planning. The Breach Notification Rule, introduced by the HITECH Act of 2009, requires that the covered entities notify the affected individuals of a breach within 60 days of discovery, and to report the breach to the Secretary of Health and Human Services, as well as to media if more than 500 individuals were affected, with the Office for Civil Rights (OCR) publishing the notifications publicly. OCR investigates breaches and can impose civil monetary penalties, while the Healthcare and Public Health Sector is designated as critical infrastructure and can draw on Cybersecurity and Infrastructure Security Agency (CISA) and U.S. Department of Health and Human Services (HHS) resources, including 405(d) Health Industry Cybersecurity Practices and premarket cybersecurity requirements for medical devices mandated by the FDA. In the United States, therefore, a hospital data breach is a failure in regulatory compliance, a potential critical-infrastructure incident, and a crime committed by the attackers: a triple threat that raises the stakes for hospital executives. Table 2 shows the major legislative and policy instruments and their practical implications for hospitals.<\/p>\n\n\n\n

Table 2<\/strong><\/p>\n\n\n\n

Principal U.S. Legal and Policy Instruments Governing Hospital Cybersecurity and Their Practical Implications<\/em><\/p>\n\n\n\n

\"Table<\/a><\/figure>\n\n\n\n

HIPAA breach notification requirements change the purpose of incident response. A 60-day period coupled with media notifications and posting on the OCR website for substantial breaches means that hospitals cannot begin building detection, escalation, and reporting processes only after a cyberattack occurs; hence, hospitals should be equipped with monitoring capabilities that will allow detecting breaches, analyzing their scale, and establishing communication channels. In other words, the need to comply with \u201creasonable and appropriate\u201d safeguard standards transforms encryption, access controls, and audit logging into regulatory standards. Moreover, using cloud services and forming business associate relationships adds one more element to compliance because, along with uploading ePHI to cloud services and sharing it in order to develop AI, there are compliance problems related to business associate agreements, data governance, and data localization (Kaushik et al., 2025<\/a>).<\/p>\n\n\n\n

The first thing is that enforcing these responsibilities has proven to be very evident: the Office for Civil Rights (OCR) has imposed settlements and civil monetary penalties in six and seven figures in relation to non-compliance with the Security Rule, including the failure in risk analysis, encryption, and access controls after ransomware attacks and phishing. HIPAA\u2019s Security and Breach Notification Rules are being enforced, and hospitals need to regard them as mandatory and not optional or simply administrative. The review of the policies on digital health, cyber security regulations and their relation to artificial intelligence shows that having a clear framework of regulation is required for incorporating such technologies; however, without the ability to enforce this regulation, regulation itself is meaningless (Virk et al., 2025<\/a>). Yet organizational readiness does not always match regulatory ambitions, and there is inequality in this regard. While being characterized by the most advanced health cybersecurity environment, the United States shows evident inequalities in terms of cybersecurity capabilities among organizations. Budgets for cybersecurity, experience, and technological tools for implementing it are usually found in larger and integrated delivery networks and academic medical centers. Critical access and small hospitals and safety net hospitals that hold sensitive information and participate in regional and national data exchange do not have specialists who can deal with cybersecurity. Being part of the interconnected system, they make the whole system vulnerable.<\/p>\n\n\n\n

Experiences in the U.S. shows the trade-off between connectivity and vulnerability. This issue gets even clearer with the national interoperability: health information exchange programs, information blocking from the Cures Act, and TEFCA move towards seamless data exchange, meaning that a breach at one node will cause data exposure and interruption at another one. Despite the existence of strong governance structures, organizations have different levels of workforce competency, cybersecurity culture, preparedness for incident management and legacy system mitigation; all these areas have been proved to be the riskiest according to research (Clarke & Martin, 2023<\/a>).<\/p>\n\n\n\n

Defensive Strategies<\/strong><\/h2>\n\n\n\n

The literature shows a consensus on defense in depth, a layered socio-technical defense strategy rather than reliance on a single control solution (Clarke & Martin, 2023<\/a>; Wasserman & Wasserman, 2022<\/a>). Because no safeguard is perfect, controls are layered so that the failure of one control (for instance, clicking on the phishing email link) will be detected and addressed by another one (network segmentation preventing lateral movement; offline backups allowing restoration of the compromised system). The term \u201csocio-technical\u201d implies that the people and processes matter just as much as the technology: an organization that has advanced tools but no security culture, no incident response plan, and no skilled workforce remains vulnerable. Table 3 presents the layers of defense in the U.S. setting and a realistic implementation horizon.<\/p>\n\n\n\n

Table 3<\/strong><\/p>\n\n\n\n

Layered Socio-Technical Defenses, Their Relevance to the U.S. Context, and a Realistic Implementation Horizon<\/em><\/p>\n\n\n\n

\"Table<\/a><\/figure>\n\n\n\n

Incident-response preparedness<\/strong> <\/h2>\n\n\n\n

Plans based on an established lifecycle of preparation, detection and analysis, containment and eradication, recovery, and post-incident review help hospitals run safely in an attack. Health-care incident responses require clear continuity plans that prioritize restoring safe, essential systems first. Downtime procedures are supposed to be rehearsed, not improvised on the spot (Clarke & Martin, 2023<\/a>; Martin et al., 2026<\/a>; Willing et al., 2021<\/a>). In the United States, conformity of these plans with the HIPAA breach notification timeline makes it both a compliance and a safety issue.<\/p>\n\n\n\n

Governance, self-assessment, and accountability<\/strong><\/h2>\n\n\n\n

Effective programs assign shared ownership across information technology, administration, and clinical leadership, define roles and responsibilities explicitly, allocate adequate resources, and secure board-level accountability, so that cybersecurity is managed as an enterprise-wide risk rather than a departmental concern (Clarke & Martin, 2023<\/a>; Youssef, 2022<\/a>). Structured self-assessment instruments let hospitals, particularly smaller ones, gauge and raise their security posture without commissioning an external audit (Burke et al., 2024<\/a>). Such tools fit resource-limited U.S. settings well: rural and Critical Access hospitals can pinpoint their weakest controls and invest in affordable, targeted fixes instead of a costly wholesale overhaul. Networked medical devices, in turn, require dedicated programs built around procurement standards, asset inventories, and disciplined patch management (Bracciale et al., 2025<\/a>; Youssef, 2022<\/a>).<\/p>\n\n\n\n

Security culture and workforce training<\/strong><\/h2>\n\n\n\n

Considering the human factor, consistent, realistic, role-based training and regular phishing simulations are required, and there is evidence that they need to be conducted not once but regularly to cause behavioral changes (Gordon et al., 2019a<\/a>, 2019b<\/a>; Rizzoni et al., 2022<\/a>). Apart from the individual training, creating an organizational security culture is crucial; a multi-site survey of health-care critical infrastructures designed instruments to measure and improve security culture (Gioulekas et al., 2022<\/a>), as well as cyber-hygiene methodologies to raise awareness (Argyridou et al., 2023<\/a>).<\/p>\n\n\n\n

Technical resilience and emerging safeguards<\/strong><\/h2>\n\n\n\n

Encryption, network segmentation (including the isolation of vulnerable devices), fast patching, and backup solutions minimize both the probability and consequences of a cyberattack (Bracciale et al., 2023<\/a>; Svandova & Smutny, 2024<\/a>; Williams & Woodward, 2015<\/a>) and comply with the technical safeguard requirements of the HIPAA Security Rule. Strong backups that are stored offline and\/or in an immutable manner and are tested by frequent restoration procedures make it possible to recover from ransomware without paying any money, depriving attackers of their means of blackmail based on encryption. Multi-factor authentication for remote logins and privileged users prevents two major attack surfaces, while network segmentation limits the possibility of lateral movement. Zero Trust security, which relies on verification of every attempt without assuming trust within the internal network, is now being applied in health care (Vukotich, 2023<\/a>). All these advances will help to strengthen the existing foundation of good governance and human factors. A hospital without backups, multi-factor authentication and qualified staff will not benefit much from these advanced analytics.<\/p>\n\n\n\n

Discussion<\/strong><\/h1>\n\n\n\n

Gaps and Recommendations for U.S. Hospitals<\/strong><\/h2>\n\n\n\n

In view of the synthesized research evidence in the context of U.S. hospitals, there are a variety of gaps and areas of concern that can be identified. First, the issue of cybersecurity needs to be integrated into the processes of hospital accreditation and clinical governance as a safety parameter for patients and not be seen as an IT-only activity (Aldosari, 2025<\/a>; Cartwright, 2023<\/a>). Second, considering the key role of humans in the process, it would be reasonable to provide employees with obligatory and continuous phishing awareness training along with other measures to promote the cybersecurity culture (Gioulekas et al., 2022<\/a>; Gordon et al., 2019a<\/a>; Rizzoni et al., 2022<\/a>). Third, the programs of cybersecurity in relation to medical devices and IoMT need to be developed; the first step could be the development of an inventory of assets, connectivity mapping, procurement criteria, and risk assessment (Bracciale et al., 2025<\/a>; Svandova & Smutny, 2024<\/a>; Willing et al., 2020<\/a>; Youssef, 2022<\/a>). Fourth, the hospitals must work on creating and practicing the plans for dealing with the incident and downtime (Abbou et al., 2024<\/a>; Willing et al., 2021<\/a>). Fifth, the small hospitals need to conduct self-assessment activities to develop a proper posture as well as to rationally allocate resources (Burke et al., 2024<\/a>; Hasegawa et al., 2024<\/a>). Sixth, the government, payers, and health care systems will have to ensure that the capacity building process is combined with current regulations to achieve the goal of becoming resilient (Clarke & Martin, 2023<\/a>; Jalali & Kaiser, 2018<\/a>; Virk et al., 2025<\/a>). All the abovementioned priorities can be realized step-by-step. Table 4 presents them in the form of recommendations for U.S. hospital leaders.<\/p>\n\n\n\n

Table 4<\/strong><\/p>\n\n\n\n

Key priorities for U.S. hospital cybersecurity<\/em><\/p>\n\n\n\n

\"Table<\/a><\/figure>\n\n\n\n

Limitations<\/strong><\/h2>\n\n\n\n

Several limitations are evident with respect to this review. As it has taken a narrative form, the literature has been selected based on purposeful selection instead of systematic selection. This means that there is a chance that relevant literature might have been overlooked and selection bias cannot be excluded. Limiting the scope to freely available, English-language articles ensured that every cited source could be independently verified, although relevant findings in subscription or non-English publications may have been missed. The most solid empirical data is that available for developed nations, and some statements regarding U.S. regulation and the national incident landscape rest on legislative and regulatory documents rather than peer-reviewed empirical studies. Because cybersecurity evolves rapidly, some developments may postdate the reviewed literature, and further U.S.-focused empirical research on the prevalence, costs, and effectiveness of hospital countermeasures is needed.<\/p>\n\n\n\n

Conclusion<\/strong><\/h2>\n\n\n\n

Cyberattacks on hospital information systems evolved from incidents related to data privacy and confidentiality into patient-safety events capable of causing delayed treatment, disruption of emergency services, and an increase in the mortality rate even among patients who visited other hospitals that were not affected by the attacks. Consequently, the issues of cybersecurity should not be considered in terms of breaches of confidentiality but in terms of availability and integrity that can be measured by clinical outcomes. The most important vulnerabilities are human, procedural, and cultural, not technological. The major online risks, including ransomware, phishing, data breaches, and insecure connectivity, exploit vulnerabilities that are well-known and solvable. The United States has the framework of regulations in the field of health-care cybersecurity (HIPAA, the HITECH Act, and FDA regulation of medical devices), but making this framework work requires the acquisition of competencies, cybersecurity culture, incident preparedness, governance of the medical devices, and modernization of legacy systems; these tasks are unevenly distributed among integrated delivery networks, academic medical centers, and resource-poor rural and safety-net hospitals. As U.S. health care keeps digitizing, cybersecurity should be considered an essential part of safe and equitable care delivery.<\/p>\n\n\n\n

Acknowledgments<\/strong><\/h2>\n\n\n\n

AI software (Claude, Anthropic) was used only for citation assistance. All references were independently validated by the author against their sources. Literature review and manuscript writing were conducted independently by the author, and the author alone is responsible for the correctness of the references presented.<\/p>\n\n\n\n

Declarations<\/strong><\/h2>\n\n\n\n

Ethics approval and consent to participate. Not applicable. This review uses only articles that have already been published and peer reviewed; it does not include any experiments on humans or animals and does not use primary data; therefore, ethics-committee approval or consent to participate was unnecessary for this review.<\/p>\n\n\n\n

Funding. This research did not receive financial support from any public, private, or non-governmental organization.<\/p>\n\n\n\n

Conflict of interest. The author declares no competing interests.<\/p>\n\n\n\n

Data availability. No new data or materials were generated. All data and materials cited are peer-reviewed, open access articles referenced in the References list.<\/p>\n\n\n\n

Author contributions. CS is the sole author and performed the conceptualization, literature search and screening, analysis, interpretation, and manuscript preparation herself and approved the final version of the manuscript.<\/p>\n\n\n\n

References<\/strong><\/h2>\n\n\n\n

Abbas, H. S. M., Qaisar, Z. H., Ali, G., Alturise, F., & Alkhalifah, T. (2022). Impact of cybersecurity measures on improving institutional governance and digitalization for sustainable healthcare. PloS One<\/em>, 17<\/em>(11), e0274550. https:\/\/doi.org\/10.1371\/journal.pone.0274550<\/a><\/p>\n\n\n\n

Abbou, B., Kessel, B., Ben Natan, M., Gabbay-Benziv, R., Dahan Shriki, D., Ophir, A., Goldschmid, N., Klein, A., Roguin, A., & Dudkiewicz, M. (2024). When all computers shut down: The clinical impact of a major cyber-attack on a general hospital. Frontiers in Digital Health, 6<\/em>, 1321485. https:\/\/doi.org\/10.3389\/fdgth.2024.1321485<\/a><\/p>\n\n\n\n

Abdelhamid M. (2020). The role of health concerns in phishing susceptibility: Survey Design study. Journal of Medical Internet Research<\/em>, 22<\/em>(5), e18394. https:\/\/doi.org\/10.2196\/18394<\/p>\n\n\n\n

Aldosari, B. (2025). Cybersecurity in healthcare: New threat to patient safety. Cureus<\/em>. https:\/\/doi.org\/10.7759\/cureus.83614<\/p>\n\n\n\n

Argyridou, E., Nifakos, S., Laoudias, C., Panda, S., Panaousis, E., Chandramouli, K., Navarro-Llobet, D., Mora Zamorano, J., Papachristou, P., & Bonacina, S. (2023). Cyber hygiene methodology for raising cybersecurity and data privacy awareness in health care organizations: Concept study. Journal of Medical Internet Research, 25<\/em>, e41294. https:\/\/doi.org\/10.2196\/41294<\/p>\n\n\n\n

Bracciale, L., Loreti, P., & Bianchi, G. (2023). Cybersecurity vulnerability analysis of medical devices purchased by national health services. Scientific Reports, 13<\/em>(1), 19509. https:\/\/doi.org\/10.1038\/s41598-023-45927-1<\/p>\n\n\n\n

Bracciale, L., Riozzi, S., Panico, G., Raso, E., Bianchi, G., & Loreti, P. (2025). Quantifying medical device cybersecurity risk with CVSS BTE. Scientific Reports, 15<\/em>(1), 42635. https:\/\/doi.org\/10.1038\/s41598-025-26898-x<\/p>\n\n\n\n

Burke, W., Stranieri, A., Oseni, T., & Gondal, I. (2024). The need for cybersecurity self-evaluation in healthcare. BMC Medical Informatics and Decision Making, 24<\/em>(1), 133. https:\/\/doi.org\/10.1186\/s12911-024-02551-x<\/p>\n\n\n\n

Cartwright, A. J. (2023). The elephant in the room: Cybersecurity in healthcare. Journal of Clinical Monitoring and Computing, 37<\/em>(5), 1123-1132. https:\/\/doi.org\/10.1007\/s10877-023-01013-5<\/p>\n\n\n\n

Clarke, M., & Martin, K. (2023). Managing cybersecurity risk in healthcare settings. Healthcare Management Forum, 37<\/em>(1), 17-20. https:\/\/doi.org\/10.1177\/08404704231195804<\/p>\n\n\n\n

Di Palma, G., Scendoni, R., Ferorelli, D., De Benedictis, A., Tambone, V., & De Micco, F. (2025). AI-induced cybersecurity risks in healthcare: A narrative review of blockchain-based solutions within a clinical risk management framework. Risk Management and Healthcare Policy, 18<\/em>, 3479-3497. https:\/\/doi.org\/10.2147\/rmhp.s544523<\/p>\n\n\n\n

Gioulekas, F., Stamatiadis, E., Tzikas, A., Gounaris, K., Georgiadou, A., Michalitsi-Psarrou, A., Doukas, G., Kontoulis, M., Nikoloudakis, Y., Marin, S., Cabecinha, R., & Ntanos, C. (2022). A cybersecurity culture survey targeting healthcare critical infrastructures. Healthcare, 10<\/em>(2), 327. https:\/\/doi.org\/10.3390\/healthcare10020327<\/p>\n\n\n\n

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019a). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2<\/em>(3), e190393. https:\/\/doi.org\/10.1001\/jamanetworkopen.2019.0393<\/p>\n\n\n\n

Gordon, W. J., Wright, A., Glynn, R. J., Kadakia, J., Mazzone, C., Leinbach, E., & Landman, A. (2019b). Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system. Journal of the American Medical Informatics Association, 26<\/em>(6), 547-552. https:\/\/doi.org\/10.1093\/jamia\/ocz005<\/p>\n\n\n\n

Hameed, S. S., Hassan, W. H., Abdul Latiff, L., & Ghabban, F. (2021). A systematic review of security and privacy issues in the Internet of Medical Things; The role of machine learning approaches. PeerJ Computer Science, 7<\/em>, e414. https:\/\/doi.org\/10.7717\/peerj-cs.414<\/p>\n\n\n\n

Hasegawa, K., O’Brien, N., Prendergast, M., Ajah, C. A., Neves, A. L., & Ghafur, S. (2024). Cybersecurity interventions in health care organizations in low- and middle-income countries: Scoping review. Journal of Medical Internet Research, 26<\/em>, e47311. https:\/\/doi.org\/10.2196\/47311<\/p>\n\n\n\n

He, Y., Aliyu, A., Evans, M., & Luo, C. (2021). Health care cybersecurity challenges and solutions under the climate of COVID-19: Scoping review. Journal of Medical Internet Research, 23<\/em>(4), e21747. https:\/\/doi.org\/10.2196\/21747<\/a><\/p>\n\n\n\n

Ignatovski M. (2024). For-profit versus non-profit cybersecurity posture: Breach types and locations in healthcare organisations. Health Information Management: Journal of the Health Information Management Association of Australia<\/em>, 53<\/em>(3), 198\u2013205. https:\/\/doi.org\/10.1177\/18333583231158886<\/p>\n\n\n\n

Jalali, M. S., & Kaiser, J. P. (2018). Cybersecurity in hospitals: A systematic, organizational perspective. Journal of Medical Internet Research, 20<\/em>(5), e10059. https:\/\/doi.org\/10.2196\/10059<\/p>\n\n\n\n

Jalali, M. S., & Largman, K. (2025). Bridging data gaps and tackling human vulnerabilities in healthcare cybersecurity with generative AI. PLOS Digital Health, 4<\/em>(10), e0001063. https:\/\/doi.org\/10.1371\/journal.pdig.0001063<\/p>\n\n\n\n

Jiang, J. X., Ross, J. S., & Bai, G. (2025). Ransomware attacks and data breaches in US health care systems. JAMA Network Open, 8<\/em>(5), e2510180. https:\/\/doi.org\/10.1001\/jamanetworkopen.2025.10180<\/p>\n\n\n\n

Kaushik, A., Barcellona, C., Mandyam, N. K., Tan, S. Y., & Tromp, J. (2025). Challenges and opportunities for data sharing related to artificial intelligence tools in health care in low- and middle-income countries: Systematic review and case study from Thailand. Journal of Medical Internet Research, 27<\/em>, e58338. https:\/\/doi.org\/10.2196\/58338<\/p>\n\n\n\n

Martin, M. J., Patel, P. P., & Egodage, T. (2026). Ransomware attacks and cybersecurity concerns in modern hospitals: Vulnerabilities and impacts on trauma centers and patient care. Trauma Surgery & Acute Care Open, 11<\/em>(Suppl 1), e002293. https:\/\/doi.org\/10.1136\/tsaco-2026-002293<\/p>\n\n\n\n

McGlave, C. C., Nikpay, S. S., Henning-Smith, C., Rydberg, K., & Neprash, H. T. (2023). Characteristics of short-term acute care hospitals that experienced a ransomware attack from 2016 to 2021. Health Affairs Scholar, 1<\/em>(3), qxad037. https:\/\/doi.org\/10.1093\/haschl\/qxad037<\/p>\n\n\n\n

Pham, T. T., Loo, T. M., Malhotra, A., Longhurst, C. A., Hylton, D., Dameff, C., Tully, J., Wardi, G., Sell, R. E., & Pearce, A. K. (2024). Ransomware cyberattack associated with cardiac arrest incidence and outcomes at untargeted, adjacent hospitals. Critical Care Explorations, 6<\/em>(4), e1079. https:\/\/doi.org\/10.1097\/cce.0000000000001079<\/a><\/p>\n\n\n\n

Radanliev, P., & De Roure, D. (2022). Advancing the cybersecurity of the healthcare system with self-optimising and self-adaptative artificial intelligence (part 2). Health and Technology<\/em>, 12<\/em>(5), 923\u2013929. https:\/\/doi.org\/10.1007\/s12553-022-00691-6<\/p>\n\n\n\n

Rizzoni, F., Magalini, S., Casaroli, A., Mari, P., Dixon, M., & Coventry, L. (2022). Phishing simulation exercise in a large hospital: A case study. Digital Health, 8<\/em>, 20552076221081716. https:\/\/doi.org\/10.1177\/20552076221081716<\/a><\/p>\n\n\n\n

Selvarajan, S., & Mouratidis, H. (2023). A quantum trust and consultative transaction-based blockchain cybersecurity model for healthcare systems. Scientific Reports<\/em>, 13<\/em>(1), 7107. https:\/\/doi.org\/10.1038\/s41598-023-34354-x<\/p>\n\n\n\n

Svandova, K., & Smutny, Z. (2024). Internet of Medical Things security frameworks for risk assessment and management: A scoping review. Journal of Multidisciplinary Healthcare, 17<\/em>, 2281-2301. https:\/\/doi.org\/10.2147\/JMDH.S459987<\/p>\n\n\n\n

Virk, A., Alasmari, S., Patel, D., & Allison, K. (2025). Digital health policy and cybersecurity regulations regarding artificial intelligence (AI) implementation in healthcare. Cureus<\/em>. https:\/\/doi.org\/10.7759\/cureus.80676<\/p>\n\n\n\n

Vukotich, G. (2023). Healthcare and cybersecurity: Taking a zero trust approach. Health Services Insights, 16<\/em>, 11786329231187826. https:\/\/doi.org\/10.1177\/11786329231187826<\/p>\n\n\n\n

Wasserman, L., & Wasserman, Y. (2022). Hospital cybersecurity risks and gaps: Review (for the non-cyber professional). Frontiers in Digital Health, 4<\/em>, 862221. https:\/\/doi.org\/10.3389\/fdgth.2022.862221<\/p>\n\n\n\n

Williams, P., & Woodward, A. (2015). Cybersecurity vulnerabilities in medical devices: A complex environment and multifaceted problem. Medical Devices: Evidence and Research<\/em>, 305. https:\/\/doi.org\/10.2147\/MDER.S50048<\/p>\n\n\n\n

Willing, M., Dresen, C., Gerlitz, E., Haering, M., Smith, M., Binnewies, C., Guess, T., Haverkamp, U., & Schinzel, S. (2021). Behavioral responses to a cyber attack in a hospital environment. Scientific Reports, 11<\/em>(1), 19352. https:\/\/doi.org\/10.1038\/s41598-021-98576-7<\/p>\n\n\n\n

Willing, M., Dresen, C., Haverkamp, U., & Schinzel, S. (2020). Analyzing medical device connectivity and its effect on cyber security in German hospitals. BMC Medical Informatics and Decision Making, 20<\/em>(1), 246. https:\/\/doi.org\/10.1186\/s12911-020-01259-y<\/p>\n\n\n\n

Youssef, A. (2022). A framework for a medical device security program at a healthcare delivery organization. Biomedical Instrumentation & Technology, 56<\/em>(3), 92-97. https:\/\/doi.org\/10.2345\/0899-8205-56.3.92<\/p>\n\n\n\n

Author Biography<\/strong><\/h2>\n\n\n\n

Crissinee Sucharitrak holds an MBA and a Master of Science in Information Technology Management (Business Analytics) from California Baptist University in Riverside, California, United States, and is a Certified Nursing Assistant (CNA). Her research interests include health-care cybersecurity, digital health, health informatics, and patient safety in U.S. hospitals.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

by Crissinee Sucharitrak<\/p>\n

Volume 21 No 3 2026<\/p>\n","protected":false},"author":1,"featured_media":17393,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,2211,2301],"tags":[2315,1670,2311,900,2313,577,2312,2316,769,1784,2314],"_links":{"self":[{"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17359"}],"collection":[{"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17359"}],"version-history":[{"count":69,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17359\/revisions"}],"predecessor-version":[{"id":17556,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/posts\/17359\/revisions\/17556"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=\/wp\/v2\/media\/17393"}],"wp:attachment":[{"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cjni.net\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}