From Attack to Recovery: An Integrated Cyber Resilience Framework for Healthcare Institutions

References

[1] L. Wasserman and Y. Wasserman, “Hospital cybersecurity risks and gaps: Review (for the non-cyber professional),” Front. Digit. Health, vol. 4, Art. no. 862221, 2022, doi: 10.3389/fdgth.2022.862221. Frontiers

[2] B. Abbou, B. Kessel, and M. Ben Natan, “When all computers shut down: The clinical impact of a major cyber-attack on a general hospital,” Front. Digit. Health, vol. 6, Art. no. 1321485, 2024, doi: 10.3389/fdgth.2024.1321485. Frontiers

[3] D. F. Sittig and H. Singh, “A socio-technical approach to preventing, mitigating, and recovering from ransomware attacks,” Appl. Clin. Inform., vol. 7, no. 2, pp. 624–632, 2016, doi: 10.4338/ACI-2016-04-SOA-0064. Thieme

[4] J. Riggi, “The importance of cybersecurity in protecting patient safety,” American Hospital Association, 2021. American Hospital Association

[5] C. M. Williams, R. Chaturvedi, R. D. Urman, et al., “Cybersecurity risks in a pandemic,” J. Med. Internet Res., vol. 22, no. 9, Art. no. e23692, 2020, doi: 10.2196/23692. JMIR

[6] D. Rees, “Cyber-attacks in healthcare: The position across Europe,” Pinsent Masons, 2021. Pinsent Masons

[7] M. Zarour, et al., “Ensuring data integrity of healthcare information in the era of digital health,” Healthc. Technol. Lett., 2021, doi: 10.1049/htl2.12008. Wiley

[8] G. Martin, P. Martin, C. Hankin, A. Darzi, and J. Kinross, “Cybersecurity and healthcare: How safe are we?,” BMJ, vol. 358, Art. no. j3179, 2017, doi: 10.1136/bmj.j3179. BMJ

[9] L. Coventry and D. Branley, “Cybersecurity in healthcare: A narrative review of trends, threats and ways forward,” Maturitas, vol. 113, pp. 48–52, 2018, doi: 10.1016/j.maturitas.2018.04.008. Crossref

[10] S. T. Argaw, J. R. Troncoso-Pastoriza, D. Lacey, et al., “Cybersecurity of hospitals: Discussing the challenges and working towards mitigating the risks,” BMC Med. Inform. Decis. Mak., vol. 20, Art. no. 146, 2020, doi: 10.1186/s12911-020-01161-7. Springer

[11] E. A. Al-Qarni, “Cybersecurity in healthcare: A review of recent attacks and mitigation strategies,” Int. J. Adv. Comput. Sci. Appl., vol. 14, no. 5, 2023, doi: 10.14569/IJACSA.2023.0140513. Crossref

[12] P. Ewoh and T. Vartiainen, “Vulnerability to cyberattacks and sociotechnical solutions for health care systems: Systematic review,” J. Med. Internet Res., vol. 26, Art. no. e46904, 2024, doi: 10.2196/46904. JMIR

[13] R. O. Chima, T. O. Odeyemi, A. Ojo, E. O. Ahmadu, and D. E. Akinbinu, “Cyberattacks on healthcare systems and the need for cybersecurity: A systematic literature review,” J. Int. Rev. Res. Stud., vol. 1, no. 10, pp. 1–15, 2026, doi: 10.66104/ptx1wg79.

[14] H. Ahmetoglu and R. Das, “A comprehensive review on detection of cyber-attacks: Data sets, methods, challenges, and future research directions,” Internet Things, vol. 20, Art. no. 100615, 2022, doi: 10.1016/j.iot.2022.100615. Crossref

[15] M. Glick, “Cyberattacks on health care are rising – but many hospitals aren’t prepared,” Discover Magazine, 2021.

[16] HIPAA Journal, “Healthcare cybersecurity,” 2022. HIPAA Journal

[17] S. Duguin, “If healthcare doesn’t strengthen its cybersecurity, it could soon be in critical condition,” World Economic Forum, 2021. World Economic Forum

[18] A. Zistler, “Hacking healthcare IT in 2016: Lessons the healthcare industry can learn from the OPM breach,” Medical Design & Outsourcing, 2016.

[19] S. Z. Shariff, S. A. Bejaimal, J. M. Sontrop, et al., “Retrieving clinical evidence: A comparison of PubMed and Google Scholar for quick clinical searches,” J. Med. Internet Res., vol. 15, no. 8, Art. no. e164, 2013, doi: 10.2196/jmir.2624. JMIR

[20] “Wiggins and Froome medical records released by ‘Russian hackers’,” BBC News, 2016.

[21] S. Ghafur, S. Kristensen, K. Honeyford, et al., “A retrospective impact analysis of the WannaCry cyberattack on the NHS,” npj Digit. Med., vol. 2, Art. no. 98, 2019, doi: 10.1038/s41746-019-0161-6. Nature

[22] National Audit Office, “Investigation: WannaCry cyber attack and the NHS,” HC 414, 2018.

[23] A. Wright, S. Aaron, and D. W. Bates, “The big phish: Cyberattacks against U.S. healthcare systems,” J. Gen. Intern. Med., vol. 31, no. 10, pp. 1115–1118, 2016, doi: 10.1007/s11606-016-3741-z. Springer

[24] M. Busdicker and P. Upendra, “The role of healthcare technology management in facilitating medical device cybersecurity,” Biomed. Instrum. Technol., vol. 51, no. s6, pp. 19–25, 2017, doi: 10.2345/0899-8205-51.s6.19. PubMed

[25] S. Alder, “Healthcare data breach statistics,” HIPAA Journal, 2024.

[26] American Medical Association, “Cybersecurity in medical practice,” AMA Ed Hub. [Online]. Available: [URL, year and access date to be verified]

[27] A. Kumar, A. K. Singh, and I. Ahmad, “A novel decentralized blockchain architecture for the preservation of privacy and data security against cyberattacks in healthcare,” Sensors, vol. 22, no. 15, Art. no. 5921, 2022, doi: 10.3390/s22155921.

[28] K. K. Haase, M. M. Whitworth, and K. Yalamanchili, “Clinicians’ experiences and reflections from a health system cyberattack,” J. Am. Coll. Clin. Pharm., vol. 4, no. 6, pp. 738–742, 2021, doi: 10.1002/jac5.1423. Wiley

[29] Kroll, “The state of cyber defense: Diagnosing cyber threats in healthcare,” 2024. Kroll

[30] W. J. Gordon, A. Wright, R. J. Glynn, et al., “Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system,” J. Am. Med. Inform. Assoc., vol. 26, no. 6, pp. 547–552, 2019, doi: 10.1093/jamia/ocz005. PubMed

[31] F. Rizzoni, S. Magalini, A. Casaroli, et al., “Phishing simulation exercise in a large hospital: A case study,” Digit. Health, vol. 8, 2022, doi: 10.1177/20552076221081716. SAGE

[32] M. Willing, C. Dresen, E. Gerlitz, et al., “Behavioral responses to a cyber-attack in a hospital environment,” Sci. Rep., vol. 11, Art. no. 19352, 2021, doi: 10.1038/s41598-021-98576-7. Nature

[33] P. A. Grassi, J. L. Fenton, E. M. Newton, et al., “Digital identity guidelines: Authentication and lifecycle management,” NIST Special Publication 800-63B, 2017, doi: 10.6028/NIST.SP.800-63b. NIST

[34] A. Ekblaw, A. Azaria, J. D. Halamka, and A. Lippman, “A case study for blockchain in healthcare: ‘MedRec’ prototype for electronic health records and medical research data,” in Proc. IEEE Open Big Data Conf., 2016.

[35] Hasselgren, K. Kralevska, D. Gligoroski, et al., “Blockchain in healthcare and health sciences: A scoping review,” Int. J. Med. Inform., vol. 134, Art. no. 104040, 2020, doi: 10.1016/j.ijmedinf.2019.104040. Crossref

@article{1723336,
      author = {Dr. Gulshan Kumar, Saharsh Gera, Jitender},
      title = {From Attack to Recovery: An Integrated Cyber Resilience Framework for Healthcare Institutions},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {3},
      pages = {2480-2487},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1723336.pdf},
      abstract = {Hospitals have become frequent targets of ransomware, phishing and data theft, and an outage can endanger patients as well as records. This review traces how attacks on healthcare organisations since 2016 turn into clinical harm and examines how strong the evidence is for the measures proposed against them. English-language literature was searched mainly in PubMed, and 29 records were synthesised thematically. Phishing-enabled ransomware and unpatched legacy systems account for most reported incidents, from WannaCry in 2017 to the Irish HSE attack in 2021, and their consequences include cancelled procedures, diverted emergencies and medication-safety risk during downtime. Mandatory annual awareness modules have not been shown to reduce successful phishing, whereas repeated simulation with feedback and rehearsed downtime drills look more promising, although most evidence comes from single sites. Only a small minority of organisations were reported to go beyond basic monitoring. The paper proposes a Prevent–Prepare–Respond–Recover framework that treats clinical downtime competence as a security control, and calls for outcome-based evaluation of drills, training and legacy-device management.},
      keywords = {Cyber-resilience, downtime procedures, healthcare cybersecurity, patient safety, phishing, ransomware},
      month = {September},
  }