Same threat, different substrate: protecting vulnerable health systems from digital viral pandemics

COVID-19 is not the first viral pandemic to devastate health systems in the twenty-first century. In May 2017, the WannaCry ransomware infected more than 230,000 computers in at least 150 countries and prevented access to critical digital systems in the UK's National Health Service (NHS).¹ Although WannaCry was a relatively unsophisticated attack that did not specifically target the NHS, the incident reveals the degree to which healthcare digitalisation renders these systems vulnerable to incapacitating cyberthreats and thereby presents substantial dangers to public health on a global scale.

It is widely acknowledged that health and well-being can be reliably enhanced by the implementation and scaling of digital technologies and that the uptake of digital health into nationwide health systems can accelerate progress towards the Sustainable Development Goals.² As such, ensuring the adequate cybersecurity of these technologies is paramount to the protection of digitalising health systems that incorporate growing numbers of network-connected medical devices and vast stores of sensitive data, which are otherwise susceptible to attack, exploitation and unintentional loss.³

Patient data may be stolen, deleted or corrupted in cyberattacks,⁴ such as the 2018 attack on the SingHealth database and the 2014 attack on US health insurance company Anthem, in which cybercriminals illegally accessed the personal information of 1.5 million Singaporeans and 80 million Americans, respectively.^{5 , 6} Simultaneously, the growing network of interconnected medical devices, including hospital-based equipment and implantable sensors, can be hacked, manipulated or entirely disconnected, with potentially devastating consequences for patient privacy and safety.⁷ Beyond health systems, the increasing sophistication and technical ability of individual, group-based and state-sponsored cyberadversaries is regularly demonstrated through attacks on financial industries, social media networks and even nuclear power plants. The deployment of such formidable digital weaponry on inadequately protected health systems would have catastrophic implications for millions of patients. Despite this, cybersecurity in these systems remains chronically underfunded, rendering them vulnerably exposed to unacceptable degrees of reputational, financial and patient safety risk.⁴

Concurrently, the COVID-19 pandemic has revealed the indispensable nature of digital technology in modern-day health systems, public health organisations and research institutions globally. The collection, synthesis, processing, storage and distribution of sensitive patient data has proven to be fundamental to dynamic epidemiological and health protection responses, including symptomatology data, biological test results and geolocated contact tracing. The primary care records of millions of people have been used to identify those patients most clinically vulnerable to viral infection, to undertake population-wide observational research⁸ and to coordinate the age-prioritised roll-out of mass vaccination programmes. Finally, the clinical management of infected individuals has used virtual care platforms, digital monitoring systems and machine learning algorithms to inform clinical decision-making, guide resource allocation and provide clinical care for large volumes of patients.⁹

Although offering plentiful advantages to the functioning of public health organisations and healthcare services, the complete dependence on digital technologies of the global response to COVID-19 exposes this reliance as a critical vulnerability in modern-day health systems and underscores the urgent need to safeguard these systems with adequate cybersecurity. Despite this, the long-term underinvestment of digital health system resilience is likely to intensify in the coming months as countries divert scarce resources to combating the social, economic and immediate health impacts of the ongoing pandemic. In an environment of rapid health system digitalisation and increasing cybercriminal capability, such deepening neglect of infrastructure protection would render these critical systems intolerably exposed.

The global decision to overlook biological pandemic preparedness has brought chaos and misery on an unprecedented scale during the COVID-19 pandemic. Although the substrate is different, the same failure to prepare for a digital viral pandemic could bring about even greater disruption to vulnerable health systems that increasingly depend on digital technologies. To mitigate this threat to global public health, significant commitments are urgently required to bolster health system cybersecurity and worldwide digital health resilience.