Operational Indicators of Clinical Service Disruption and Recovery Following Healthcare Ransomware Attacks: A Critical Review of Empirical Evidence
Article Sidebar
Main Article Content
Abstract
Ransomware attacks against healthcare organizations can disrupt clinical services even when the immediate technical compromise is confined to information systems. Electronic health record unavailability, communication failures, diversion of emergency patients, interruption of diagnostic workflows, and dependence on manual procedures can affect service delivery both within attacked hospitals and across surrounding healthcare networks. However, the operational consequences of ransomware are not adequately represented by technical indicators such as system downtime or restoration time alone. This critical narrative review examines empirical evidence concerning healthcare ransomware incidents and identifies operational indicators that can be used to assess clinical service disruption and recovery. We draw on studies of hospital activity, emergency department spillover, emergency medical services, clinical workflows, patient outcomes, and post-incident recovery. Particular attention is given to distinguishing directly measured operational effects from broader claims that remain insufficiently supported by empirical evidence. A five-domain framework is proposed encompassing service availability, patient flow and capacity, clinical workflow continuity, patient safety and outcomes, and recovery stability. The framework separates technical restoration from operational normalization and clinical recovery. The review finds that ransomware-related disruption may extend beyond the attacked institution, that routine healthcare activity measures can reveal consequences not captured by cybersecurity reporting, and that recovery should be assessed through multiple operational indicators rather than a single restoration milestone. Further longitudinal and multicenter research is needed to establish standardized measures of healthcare service resilience following ransomware attacks
Article statistics
- Abstract views
- 220
- PDF Downloads
- 45
- Total views
- 265
Downloads
Article Details
Section
This work is licensed under a Creative Commons Attribution 4.0 International License.
All articles published in International Journal of Security Sciences (IJSS) are licensed under the terms of the Creative Commons Attribution 4.0 International License (CC BY 4.0).
This license allows others to share, copy, distribute, and adapt the work, provided that appropriate credit is given to the original author(s) and the source.
Authors retain copyright and grant International Journal of Security Sciences (IJSS) the right of first publication.
How to Cite
References
[1] Ghafur, S., Kristensen, S., Honeyford, K., Martin, G., Darzi, A., & Aylin, P. (2019). A retrospective impact analysis of the WannaCry cyberattack on the NHS. npj Digital Medicine, 2, 98 https://doi.org/10.1038/s41746-019-0161-6 DOI: https://doi.org/10.1038/s41746-019-0161-6
[2] Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016–2021. JAMA Health Forum, 3(12), e224873. https://doi.org/10.1001/jamahealthforum.2022.4873 DOI: https://doi.org/10.1001/jamahealthforum.2022.4873
[3] Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A. (2023). Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open, 6(5), e2312270. https://doi.org/10.1001/jamanetworkopen.2023.12270 DOI: https://doi.org/10.1001/jamanetworkopen.2023.12270
[4] Neprash, H. T., McGlave, C. C., Rydberg, K., & Henning-Smith, C. (2024). What happens to rural hospitals during a ransomware attack? Evidence from Medicare data. The Journal of Rural Health, 40(4), 728–737. https://doi.org/10.1111/jrh.12834 DOI: https://doi.org/10.1111/jrh.12834
[5] van Boven, L. S., Kusters, R. W. J., Tin, D., van Osch, F. H. M., De Cauwer, H., Ketelings, L., Rao, M., Dameff, C., & Barten, D. G. (2024). Hacking acute care: A qualitative study on the health care impacts of ransomware attacks against hospitals. Annals of Emergency Medicine, 83(1), 46–56. https://doi.org/10.1016/j.annemergmed.2023.04.025 DOI: https://doi.org/10.1016/j.annemergmed.2023.04.025
[6] Neprash, H. T., McGlave, C. C., & Nikpay, S. S. (2026). Hacked to pieces? The effects of ransomware attacks on hospitals and patients. American Economic Journal: Economic Policy, 18(1), 256–281. https://doi.org/10.1257/pol.20240594 DOI: https://doi.org/10.1257/pol.20240594
[7] Arsalani, P., Dayarian, I., Freeman, N., Kim, Y., Peng, D., Zhao, M., Gray, J., & Crawford, W. (2026). Impact of ransomware on emergency medical services: Empirical estimation and risk assessment framework. Omega, 143, 103578. https://doi.org/10.1016/j.omega.2026.103578 DOI: https://doi.org/10.1016/j.omega.2026.103578
[8] Abouk, R., & Powell, D. (2024). Ransomware attacks, ED visits and inpatient admissions in targeted and nearby hospitals. JAMA, 331(24), 2129–2131. https://doi.org/10.1001/jama.2024.7752 DOI: https://doi.org/10.1001/jama.2024.7752
[9] Pham, T. T., Loo, T. M., Malhotra, A., Longhurst, C. A., Hylton, D., Dameff, C., Tully, J., Wardi, G., Sell, R. E., & Pearce, A. K. (2024). Ransomware cyberattack associated with cardiac arrest incidence and outcomes at untargeted, adjacent hospitals. Critical Care Explorations, 6(4), e1079. https://doi.org/10.1097/CCE.0000000000001079 DOI: https://doi.org/10.1097/CCE.0000000000001079
[10] Straw, I., Kumar, D., Kweon, S., Selzer, J., Dameff, C., & Tully, J. (2026). Unveiling patient-level harms and at-risk clinical groups during hospital cyberattacks: Systematic review of global case studies and social media data. Journal of Medical Internet Research, 28, e88257. https://doi.org/10.2196/88257 DOI: https://doi.org/10.2196/88257
[11] Swanson, M., Bowen, P., Phillips, A. W., Gallup, D., & Lynes, D. (2010). Contingency Planning Guide for Federal Information Systems. NIST Special Publication 800-34 Revision 1. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-34r1 DOI: https://doi.org/10.6028/NIST.SP.800-34r1
[12] Ewoh, P., & Vartiainen, T. (2024). Vulnerability to cyberattacks and sociotechnical solutions for health care systems: Systematic review. Journal of Medical Internet Research, 26, e46904. https://doi.org/10.2196/46904 DOI: https://doi.org/10.2196/46904
[13] Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware Guide. U.S. Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/stopransomware/ransomware-guide
[14] U.S. Department of Health and Human Services. (2023). Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals. https://hhscyber.hhs.gov/documents/cybersecurity-performance-goals.pdf