Is a hospital to blame if a patient dies in a ransomware attack?

[ad_1]

A few months ago, a colleague told me that the hangar gave birth to her first child in a hospital amid a ransomware attack. This is the sort of thing that happens when you’re working on cybersecurity, people confiding in you about their terrible passwords, or how much they hate two-factor authentication, or the time they have it. gave birth in a hospital without a working computer. I said something like I’m so sorry, it must have been so hard, and she said: Oh, that was good, people kept walking into the room and wondering if anyone ‘one had already examined me. She didn’t mind, she said she just felt sorry for all the people working in the hospital trying to work with no idea what was going on with all of their patients.

I thought about this story a lot this week, after reading the Wall Street Journal report on the Teiranni Kidd case. Kidd is suing Springhill Medical Center in Alabama, where she gave birth to her daughter in July 2019 when the hospital’s internal computer network was down due to a ransomware attack. His daughter Nicko Silar was born with her umbilical cord wrapped around her neck, a disease that caused severe brain damage; she died nine months later. According to the Journal, the heart rate monitor in the room recorded signs of fetal distress, but because the hospital’s computer network was down, hospital staff were unable to monitor for these signs from the nurse’s station monitor. After the delivery, the attending obstetrician got the reading in the patient’s room and texted the nurse manager to tell her that she would have performed a Caesarean on Kidd if she had seen her earlier.

So it’s not hard to see why Kidd alleges in his lawsuit against the hospital and attending obstetrician that the ransomware attack resulted in the death of his daughter. But even though the ransomware is ultimately to blame for what happened, it is still far from straightforward to determine whether that means the hospital and its staff were at fault for the way they were. responded to the attack.

The crux of Kidds’ lawsuit appears to be that she was not made aware of the ransomware attack by anyone in the hospital and, more importantly, that the staff missed the warning signs from the rate monitor. heart in his room. The first of these complaints seems reasonable, if a little odd. Reasonable to expect a hospital to notify its patients when facing a major cyberattack, but also somewhat surprising that patients need to be formally informed unless a hospital goes out of its way to hide what is happening from patients. The coworker who told me about her birthing experience during a ransomware attack heard about it from almost everyone who entered her hospital room. And although Springhill did not immediately publicly acknowledge the attack, the day Kidd was admitted to hospital, he issued a press release saying he had suffered a security incident, although he did not did not specify that it was a ransomware attack. So by the time Kidd entered the hospital, the ransomware attack dating back over a week was certainly no secret, but the hospital had also not been fully transparent about what was going on. was happening. And I think, overall, Kidd is probably correct in expecting hospitals to notify patients when their computer networks are down.

I am less convinced, however, that it is reasonable to expect these hospitals to be able to monitor all of their patients as continuously as they would when their computers are operating normally. Springhill was doing his best with the resources at his disposal. Maybe the patient care was not as good as it was before the attack, but what alternative would have been to turn the patients away and send them to other hospitals? That’s what a hospital in Düsseldorf did last year when it was hit by ransomware. One of the patients who was forced to go to a hospital 20 miles away instead died of delayed treatment.

There were very few good options for Springhill once its network was compromised. He could have paid the ransom he chose not to, but that wouldn’t have been a guarantee that the criminals would have restored his systems. Even if the payment had put hospital computers back up and running sooner, it would have helped fuel more ransomware attacks by funding the criminal enterprises that carry them out. He could have closed the hospital or stopped admitting new patients, but those decisions could also have taken a heavy toll on patient care. Or the staff could do their best with the resources they had, which they did. And even if that choice ended up tragically, it would be a mistake to conclude that it was the wrong choice.

If Springhill were to be held accountable for all that he allowed his systems to be compromised in the first place and not having a solid restoration plan in place to get his network back online faster (it took three weeks in the hospital to restore his computer systems). But the complaint barely mentions these issues. He alleges that Springhill withheld information about his lack of adequate preparation and training for a cyberattack and that the hospital failed for no reason.[ed] to have adequate rules, policies, procedures and / or standards related to cyber attacks, but it never describes in detail the ways in which the hospital has failed to adequately prepare and defend against ransomware. Without knowing more details about how the ransomware infected the hospital and the corrective technical measures taken by the hospital management following the attack, it is however difficult to know exactly where it was. cause.

Springhill shouldn’t be blamed for continuing to treat patients or even for not being able to monitor all of their patients as continuously as they would have if their computer systems hadn’t been down. If the hospital deliberately withheld information about the attack from patients, they should be blamed for it, but this transparency issue still doesn’t relate to the larger issue of protecting hospitals from ransomware, rather than just informing people when attacked. Indeed, many patients in Kidds’ situation probably wouldn’t know what to do with this information or how to decide whether to leave and go to another hospital without being notified by medical staff. If the Kidds case is successful, I’m concerned that other healthcare providers might not continue to admit patients during cyber attacks, or that they might have to pay ransoms to try and resolve these attacks faster, and that would be exactly. the wrong lessons to be learned. learn from this incident.

Facebook whistleblower finally allowed Republicans to stop gossiping about anti-conservative biases Facebook scandal The most important response from the Facebook whistleblower

The moral of the Kidds story is that we need to do a much better job of helping healthcare organizations (and other institutions) defend themselves against ransomware and have incident response plans in place that affect them. allow their systems to be restored in a matter of hours. , not days. It can sometimes be productive to use lawsuits to hold companies accountable for failing to protect themselves and their customers from cyber attacks, but only if those lawsuits really focus on the right things – the things that could have prevented the attacks or minimized. their impacts. Most lawsuits against organizations that are victims of data breaches or serious cyber attacks, such as Equifax or T-Mobile, focus on all the ways the breached organizations have failed to implement established security best practices, such as such as encryption or multi-factor authentication or installing software updates. These lawsuits are not always successful, but they at least target the security holes of the organizations in question, thus putting pressure on these (and other) companies to do a better job of implementing measures. prevention and mitigation measures for future cybersecurity incidents.

But Kidds follows focuses on all of the ways the hospital was unable to monitor its patients as effectively during the cyberattack because its networks were down, rather than the things the hospital could have done to prevent the attack or restore its networks to working order. earlier. I don’t know what hospitals are supposed to take away from Kidds’ complaint other than if they can’t provide the same level of patient care in a cyber attack (and they certainly can’t), so they shouldn’t treat patients at all when dealing with cybersecurity breaches. In this regard, it may prove counterproductive to the broader goal of making hospitals better defend themselves against ransomware and prevent future tragedies.

Future Tense is a partnership between Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.

[ad_2]