Â鶹´«Ã½

Skip to main content

Prevention key to cutting cyberattacks in hospitals, protecting patients: researchers

A health-care worker is seen at Toronto’s Hospital for Sick Children, on Wednesday, Nov. 30, 2022. (THE CANADIAN PRESS/Chris Young) A health-care worker is seen at Toronto’s Hospital for Sick Children, on Wednesday, Nov. 30, 2022. (THE CANADIAN PRESS/Chris Young)
Share

Hospitals must do more to protect patients' personal data from cyberattacks that can lead to disruptions in care, urges an article published Monday in the Canadian Medical Association Journal.

About 16 separate cyberattacks have occurred at health organizations across the country since 2015, but more go unreported, said lead author Vinyas Harish, a medical student at the University of Toronto and Unity Health Toronto.

Publicly funded systems are lucrative targets for hackers who may demand a ransom for patient information that could be sold on the dark web, says the article, co-authored by three Unity Health Toronto doctors with expertise in the use and management of medical information and another at the University of British Columbia.

Harish noted that a ransomware attack on five Ontario hospitals last month forced an unknown number of patients, including those that needed cancer treatment, to be diverted to another site because their medical records may have been inaccessible. Some data, such as lab results, would have been available through other shared electronic sources.

Clinicians who access medical records should be trained annually to recognize phishing attempts hackers use to install malware that can infect a system and encrypt data, he said.

"I think sometimes the risk that we run is people sort of rolling their eyes and looking at this as just another thing that they need to do on top of their busy clinical practice and all the documentation that they need to do to take care of patients."

The call for action comes as a national standard for cyberattack measures on health organizations is set to be released next week.

Funded by Public Safety Canada, it was developed by the Digital Governance Standards Institute and HealthCareCAN, which represents hospitals and health-care organizations.

"The main driver of all this is that we saw that too many of our health institutions in Canada were being attacked," said HealthCareCAN president Paul-Emile Cloutier.

"If there's no framework, if there's no planning -- which the standards will talk about -- that's when you're really in a mess," he said of the standards, expected Nov. 29.

"Anything that has to do with a cyberattack is not an IT issue. It's a governance issue. So, that means everyone in the organization should be made aware of what needs to be done to prevent it because often there's an error from a person in the hospital that triggers a cyberattack," said Cloutier.

Harish urged hospitals, labs and clinics to stop relying on older systems that have outdated security measures and use two-factor authentification and strong passwords.

When an attack does occur, staff should respond immediately by taking measures such as disconnecting devices from the internet, restoring systems from backups and getting help from external vendors, said Harish, who also has a computer science degree.

Yvette Coffey, president of the Registered Nurses Union Newfoundland and Labrador, said an October 2021 cyberattack paralyzed a primary network shared by all four regional health authorities. Some surgeries, lab tests and appointments were cancelled, adding to delays caused by the pandemic.

"When it happened, we basically went back to pre-1980s, with no access to patients' data or medical records. Emergency surgeries had to go ahead but even that was difficult because they had to produce a paper chart," she said.

"It was difficult to find a lab requisition and X-ray requisitions. We couldn't even call patients to say, 'Sorry your surgery is cancelled' because we didn't even have their phone number."

A provincial report in March said the credentials of a legitimate user had been compromised to access records of current and former patients going back to 1996. The breach revealed names, addresses, health care numbers, diagnoses, procedure types, email addresses and banking and financial information. Hackers obtained the social insurance numbers of 2,514 patients.

Sami Khoury, head of the Canadian Centre for Cyber Security, encouraged health organizations to report cyberattacks so more can be learned on a national level.

"Maybe it's one ransomware group that is going after all hospitals, or it's just a target of opportunity. We need to share a lot more about that ransomware group so that hospitals can protect themselves."

This report by The Canadian Press was first published Nov. 20, 2023.

CTVNews.ca Top Stories

Haitian group in Ohio files citizen criminal charges against Trump and Vance

The leader of a nonprofit representing the Haitian community invoked a private-citizen right to file charges Tuesday against former U.S. president Donald Trump and his running mate, JD Vance, over the chaos and threats experienced by Springfield, Ohio, since Trump first spread false claims about legal immigrants there during a presidential debate.

We've all had neighbours we didn't like, but two people from Sault Ste. Marie have been awarded more than half a million dollars for the 'extreme' behaviour of the people who lived next to them.

Local Spotlight

Police are looking to the public for help after thieves broke into a Lethbridge ice creamery, stealing from the store.

An ordinary day on the job delivering mail in East Elmwood quickly turned dramatic for Canada Post letter carrier Jared Plourde. A woman on his route was calling out in distress.

Fire has destroyed a barn and 17,000 plants at a family-owned business in Lower Coverdale, N.B.

Before influencers on social media, Canada’s Jeanne Beker was bringing the world of high fashion down to earth and as Calgary’s Glenbow Museum gets a major make-over, it will include a new exhibition showcasing the pop culture icon.

A sea lion swam free after a rescue team disentangled it near Vancouver Island earlier this week.

A Nova Scotian YouTuber has launched a mini-truck bookmobile.

Cole Haas is more than just an avid fan of the F.W. Johnson Wildcats football team. He's a fixture on the sidelines, a source of encouragement, and a beloved member of the team.

Getting a photograph of a rainbow? Common. Getting a photo of a lightning strike? Rare. Getting a photo of both at the same time? Extremely rare, but it happened to a Manitoba photographer this week.

An anonymous business owner paid off the mortgage for a New Brunswick not-for-profit.