Cybersecurity in Hospitals: A Systematic, Organizational Perspective

MIT Sloan Research Paper No. 5264-18

Journal of Medical Internet Research; 2018, 20(5):e10059

17 Pages Posted: 12 Jan 2018 Last revised: 26 Jul 2018

See all articles by Mohammad Jalali

Mohammad Jalali

Massachusetts Institute of Technology (MIT) - Sloan School of Management; Harvard University - Harvard Medical School

Jessica Kaiser

Massachusetts Institute of Technology (MIT), Students

Date Written: January 11, 2018

Abstract

Background: Cybersecurity incidents are a growing threat to the health care industry in general and hospitals in particular. The health care industry has lagged behind other industries in protecting its main stakeholder (ie, patients), and now hospitals must invest considerable capital and effort in protecting their systems. However, this is easier said than done because hospitals are extraordinarily technology-saturated, complex organizations with high end point complexity, internal politics, and regulatory pressures.

Objective: The purpose of this study was to develop a systematic and organizational perspective for studying (1) the dynamics of cybersecurity capability development at hospitals and (2) how these internal organizational dynamics interact to form a system of hospital cybersecurity in the United States.

Methods: We conducted interviews with hospital chief information officers, chief information security officers, and health care cybersecurity experts; analyzed the interview data; and developed a system dynamics model that unravels the mechanisms by which hospitals build cybersecurity capabilities. We then use simulation analysis to examine how changes to variables within the model affect the likelihood of cyberattacks across both individual hospitals and a system of hospitals.

Results: We discuss several key mechanisms that hospitals use to reduce the likelihood of cybercriminal activity. The variable that most influences the risk of cyberattack in a hospital is end point complexity, followed by internal stakeholder alignment. Although resource availability is important in fueling efforts to close cybersecurity capability gaps, low levels of resources could be compensated for by setting a high target level of cybersecurity.

Conclusions: To enhance cybersecurity capabilities at hospitals, the main focus of chief information officers and chief information security officers should be on reducing end point complexity and improving internal stakeholder alignment. These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. On a macro level, the cyber vulnerability of a country’s hospital infrastructure is affected by the vulnerabilities of all individual hospitals. In this large system, reducing variation in resource availability makes the whole system less vulnerable—a few hospitals with low resources for cybersecurity threaten the entire infrastructure of health care. In other words, hospitals need to move forward together to make the industry less attractive to cybercriminals. Moreover, although compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies. As of today, policies mostly address data privacy, not data security. Thus, policy makers need to introduce policies that not only raise the target level of cybersecurity capabilities but also reduce the variability in resource availability across the entire health care system.

Keywords: cybersecurity; hospitals; system dynamics analysis

JEL Classification: M15

Suggested Citation

Jalali, Mohammad and Kaiser, Jessica, Cybersecurity in Hospitals: A Systematic, Organizational Perspective (January 11, 2018). MIT Sloan Research Paper No. 5264-18. Available at SSRN: https://ssrn.com/abstract=3100364 or http://dx.doi.org/10.2139/ssrn.3100364

Mohammad Jalali (Contact Author)

Massachusetts Institute of Technology (MIT) - Sloan School of Management ( email )

77 Massachusetts Avenue
50 Memorial Drive
Cambridge, MA 02139-4307
United States

HOME PAGE: http://scholar.harvard.edu/jalali

Harvard University - Harvard Medical School ( email )

101 Merrimac St
Suite 1010
Boston, MA 02114
United States

HOME PAGE: http://scholar.harvard.edu/jalali

Jessica Kaiser

Massachusetts Institute of Technology (MIT), Students ( email )

Cambridge, MA
United States

Register to save articles to
your library

Register

Paper statistics

Downloads
203
rank
147,039
Abstract Views
912
PlumX Metrics
!

Under construction: SSRN citations while be offline until July when we will launch a brand new and improved citations service, check here for more details.

For more information