Send Us the Bitcoin or Patients Will Die: Addressing the Risks of Ransomware Attacks on Hospitals

49 Pages Posted: 30 Jun 2017

See all articles by Deborah Farringer

Deborah Farringer

Belmont University - College of Law

Date Written: 2017

Abstract

“You just have 10 days to send us the Bitcoin. After 10 days we will remove your private key and it's impossible to recover your files.” Message to Medstar employees.

Within a span of just a few months in the spring of 2016, fourteen hospitals (four hospital systems) experienced ransomware attacks resulting in an inability for the hospitals to access any of their electronic medical records, including necessary patient data. Knowing that hospitals must have access to this data in order to appropriately treat and monitor patients, those responsible for the attacks requested a bitcoin payment as ransom for the ability to regain access to the data. At least one hospital, Hollywood Presbyterian Medical Center in Los Angeles, California, publicly acknowledging to paying the asking price of 40 bitcoin, which is equivalent to about $17,000. While these hospitals are not the only ones experiencing these ransomware attacks, the potential consequences of such attacks in the health care context are severe. With the enactment of the Health Insurance and Portability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, hospitals and other health care providers are required to adopt and meaningful use electronic health records. Thus, in order to comply with federal law, all patient health records and all patient health information that might be necessary to treat, monitor, or even admit and triage patients is tied to an electronic record keeping system. While the ultimate goals of better efficiency and better coordination (and, thus, better patient care) demonstrate the need for this push towards electronic health records, the manner in which these laws have been implemented has left hospitals and other health care providers with some challenges that were never faced in a system of paper records. This article examines recent attacks and addresses why hospitals and health care providers might be especially vulnerable to these sorts of attacks. It further surveys the various hospital responses and analyzes whether such responses may be helpful or hurtful for avoiding future attacks. This article concludes that the fractured approach to data exchange in the healthcare industry leaves hospitals and other providers open to attack, and thus, hospitals and providers need to move quickly towards a more coordinated and uniform approach to electronic health records. This can be accomplished either through federal regulations that will obligate a movement towards more coordinated systems or a grass roots movement of providers themselves in an effort to stave off these attacks, which can be devastating to providers, both operationally and financially.

Keywords: Ransomware, HIPAA, HITECH, Hospitals, Cybersecurity, IT, Malware, Bitcoin, Electronic Health Records, EHR, EMR, Electronic Medical Records

JEL Classification: I1, I00, I18, I19

Suggested Citation

Farringer, Deborah, Send Us the Bitcoin or Patients Will Die: Addressing the Risks of Ransomware Attacks on Hospitals (2017). Seattle University Law Review, Vol. 40, p. 937, 2017; Belmont University College of Law Research Paper No. 2017-35 . Available at SSRN: https://ssrn.com/abstract=2995095

Deborah Farringer (Contact Author)

Belmont University - College of Law ( email )

1900 Belmont Boulevard
Nashville, TN 37212
United States

Register to save articles to
your library

Register

Paper statistics

Downloads
120
Abstract Views
537
rank
234,664
PlumX Metrics