Healthcare administration in the age of complex dynamics in hospital and health system cybersecurity risk mitigation
DOI:
https://doi.org/10.34140/bjbv8n1-015Palavras-chave:
health administration, healthcare cybersecurity, ransomware, hospital management, risk management, management consultingResumo
RAYTECH Hospital, a pseudonym for a major U.S. healthcare facility, experienced a severe ransomware attack resulting in widespread operational disruption, compromised clinical workflows, and delayed patient care. The incident eroded organizational credibility, triggered extensive legal exposure, and generated long-term financial instability reflective of escalating cybersecurity vulnerabilities across the healthcare sector. Similar attacks illustrate the magnitude of such events, including prolonged Electronic Health Record outages, canceled procedures, regional care diversion, and secondary extortion of sensitive patient data. Consequences extend beyond institutional boundaries, producing public-health cascades, misinformation, surge congestion, and diminished surveillance accuracy. The attack further exposed chronic underinvestment in cybersecurity infrastructure, networked-device lifecycle management, and cultural readiness. Long-term repercussions include reputational damage, workforce burnout, insurer disputes, and expanded regulatory oversight. Collectively, these outcomes underscore the urgent need for comprehensive, anticipatory cybersecurity strategies to safeguard patient welfare, preserve critical-infrastructure resilience, and sustain continuity of care in an increasingly volatile digital threat landscape.
Referências
Abraham, C., Chatterjee, D., & Sims, R. R. (2019). Muddling through cybersecurity: Insights from the U.S. healthcare industry. Business Horizons, 62(4), 539-548.
Almulihi, A. H., Alassery, F., Khan, A. I., Shukla, S., Gupta, B. K., & Kumar, R. (2022). Analyzing the implications of healthcare data breaches through computational technique. Intelligent Automation & Soft Computing, 32(3).
Amodu, O. (2024). Security auditors' perspective in tackling cyber-threats. Computer, 11(5).
Brensinger, J. (2023). Identity theft, trust breaches, and the production of economic insecurity. American Sociological Review, 88(5), 844-871
Burrell, D. N., Burton, S. L., Nobles, C., Springs, D., Huff, A. J., Brown-Jackson, K. L., Richardson, K., Wright, J.B., Muller, S.R., & Jones, A. J. (2023). The managerial ethical and operational challenges of hospital cybersecurity. In Transformational Interventions for Business, Technology, and Healthcare (pp. 444-458). IGI Global.
Burrell, D. N. (2024). Understanding healthcare cybersecurity risk management complexity. Land Forces Academy Review, 29(1), 38-49.
Burrell, D. N., Aridi, A. S., McLester, Q., Shufutinsky, A., Nobles, C., Dawson, M., & Muller, S. R. (2021). Exploring system thinking leadership approaches to the healthcare cybersecurity environment. International Journal of Extreme Automation and Connectivity in Healthcare (IJEACH), 3(2), 20-32.
Burton , S. L. (2025). Mitigating advanced social engineering threats: multi-factor authentication and the evolving tactics of Scattered Spider in the aviation sector. Brazilian Journal of Business, 7(3), e81057. https://doi.org/10.34140/bjbv7n3-003
Caino, A. R. (2024). Cybersecurity strategies information technology leaders use to protect healthcare information systems from ransomware (Order No. 30993688). Walden University. https://www.proquest.com/openview/d536d1866854baf6598de9ab8c74eaf8/1?pq-origsite=gscholar&cbl=18750&diss=y.
Cantú, C., Franco, C., & Frost, J. (2024). The economic implications of services in the metaverse. In Global perspectives in the metaverse: Law, economics, and finance (pp. 83-118). Cham: Springer Nature Switzerland.
Dargin, M. (2020, October 29). “Credible threat”: How to protect networks from ransomware: Network World (Online). https://www.networkworld.com/article/964167/how-to-protect-your-network-from-ransomware-attacks. January 17, 2026
Drame, P. S. (2019). Ransomware attacks in the healthcare industry: Attack methods and preventive steps (Master's thesis, Utica College). https://www.proquest.com/openview/6fc2060ab53329f97deec56acd244c37/1?pq-origsite=gscholar&cbl=18750&diss=y. January 18, 2026
Dwyer III, S. J., Weaver, A. C., & Hughes, K. K. (2004). Health Insurance Portability and Accountability Act. Security Issues in the Digital Medical Enterprise, 72(2), 9-18.
Engmann, A., Eluerkeh, E., & Ngwakwe, C. (2024). Leading Change by Design-Integrating Design thinking with Kotter’s 8 Step Process. HOLISTICA Journal of Business and Public Administration, 15(2), 127-141. https://doi.org/10.2478/hjbpa-2024-0018
Jones, L. (2025). Dynamic modulation of imperceptible risks: Theoretical foundations and a rheostat analogy. RAIS Journal for Social Sciences, 9(2). https://doi.org./10.5281/zenodo.17468923
Jones, L. A., & Burrell, D. N. (2025). Illegal Cybersecurity Threats Created by Organizational Arsonists in Healthcare Organizations. Law, Economics and Society, 1(1), p93-p93. http://orcid.org/0000-0002-4675-9544
Jones, L. A. (2021). A content analysis review of literature to create a useable framework for reputation risk management. Handbook of Research on Multidisciplinary Perspectives on Managerial and Leadership Psychology, 91-133.
Kesarwani, A., & Gochhayat, S. (2023). Ransomware attacks in the healthcare industry. Journal of Student Research, 12(4).
Kitsios, F., Chatzidimitriou, E., & Kamariotou, M. (2023). The ISO/IEC 27001 information security management standard: how to extract value from data in the IT sector. Sustainability, 15(7), 5828.
Koyame-Marsh, R. O., & Marsh, J. L. (2014). Data breaches and identity theft: Costs and responses. IOSR Journal of Economics and Finance (IOSR-JEF), 5(3), 36-45.
Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25(1), 1-10. https://doi.org/10.3233/THC-161263
Lamé, G., Jouini, O., & Stal-Le Cardinal, J. (2017). Combining the viable system model and Kotter’s 8 steps for multidepartment integration in hospitals. IDEAS Working Paper Series from RePEc. https://hal.science/hal-01519593v1. Accessed on January 18, 2026
Lynn, J. (2024, May 16). Reactions to the Ascension Healthcare Ransomware Attack and Suggestions for Healthcare Organizations. HospitalEMRandEHR.com [Blog]. . https://healsecurity.com/reactions-to-the-ascension-healthcare-ransomware-attack-and-suggestions-for-healthcare-organizations. Accessed on 16 January 2026
Martin, G., Martin, P., Hankin, C., Darzi, A., & Kinross, J. (2017). Cybersecurity and healthcare: How safe are we? BMJ, 358, j3179. https://doi.org/10.1136/bmj.j3179
Niki, O. B., Saira, G., Arvind, S., & Mike, D. (2022). Cyber-attacks are a permanent and substantial threat to health systems: education must reflect that. Digital health, 8, 20552076221104665.
Ofe, M. A. (2023). A qualitative study exploring security practices healthcare providers need to reduce the risk of successful ransomware attacks on electronic health record systems (Order No. 30523518). Colorado Technical University. https://www.proquest.com/openview/675d545f322aecdce179edd0438b9879/1?pq-origsite=gscholar&cbl=18750&diss=y 2. Accessed on January 17, 2026
Pattison-Gordon, J. (2023, November 27). Ransomware impacts healthcare systems in six states. Government Technology. https://www.govtech.com/security/ransomware-impacts-health-care-systems-in-six-states. Accessed on January 18, 2026
Peltier, T. R. (2016). Information security policies, procedures, and standards: Guidelines for effective information security management. CRC Press.
Pimenta Rodrigues, G. A., Marques Serrano, A. L., Lopes Espiñeira Lemos, A. N., Canedo, E. D., Mendonça, F. L. L., de Oliveira Albuquerque, R., Sandoval Orozco, A. L., & García Villalba, L. J. (2024). Understanding data breach from a global perspective: Incident visualization and data protection law review. Data, 9(2), Article 27. https://doi.org/10.3390/data9020027
Portela, D., Nogueira-Leite, D., Almeida, R., & Cruz-Correia, R. (2023). Economic impact of a hospital cyberattack in a national health system: Descriptive case study. JMIR Formative Research, 7(1), e41738.
Rostek, K., Wiśniewski, M., & Skomra, W. (2022). Analysis and Evaluation of Business Continuity Measures Employed in Critical Infrastructure during the COVID-19 Pandemic. Sustainability, 14(22), 15388.
Romanosky, S., Hoffman, D., & Acquisti, A. (2014). Empirical analysis of data breach litigation. Journal of Empirical Legal Studies, 11(1), 74-104. https://doi.org/10.1111/jels.12035
Schein, E. H. (2010). Organizational culture and leadership (Vol. 2). John Wiley & Sons
Sendelj, R., & Ognjanovic, I. (2022). Cybersecurity challenges in healthcare. In Achievements, Milestones and Challenges in Biomedical and Health Informatics (pp. 190-202). IOS Press. https://doi.org/10.3233/SHT1220951
Shah, C., Nachand, D., Wald, C., & Chen, P. H. (2023). Keeping patient data secure in the age of radiology artificial intelligence: cybersecurity considerations and future directions. Journal of the American College of Radiology, 20(9), 828-835.
Spence, N., Paul III, D. P., & Coustasse, A. (2017). Ransomware in healthcare facilities: The future is now. Marshall University. https://mds.marshall.edu/cgi/viewcontent.cgi?article=1185&context=mgmt_faculty. Accessed on January 18, 2026
Strating, A. J. E. (2024). Effectiveness of information-security awareness training to prevent success of social engineering in healthcare: A meta-analysis (Bachelor's thesis, University of Twente).
Taherdoost, H. (2022). Understanding cybersecurity frameworks and information security standards—a review and comprehensive overview. Electronics, 11(14), 2181.
Tosh, P. K., Feldman, H., Christian, M. D., Devereaux, A. V., Kissoon, N., & Dichter, J. R. (2014). Business and continuity of operations: care of the critically ill and injured during pandemics and disasters: CHEST consensus statement. Chest, 146(4), e103S-e117S.
Triplett, W. (2022). Ransomware attacks on the healthcare industry. Journal of Business, Technology and Leadership, 4(1), 1-13.
U.S. Department of Health & Human Services. (2024). HIPAA for professionals. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html. Accessed on January 17, 2026
Wright, J. B., & Burrell, D. N. (2023). Cybersecurity leadership ethics in healthcare. In Handbook of Research on Cybersecurity Risk in Contemporary Business Systems (pp. 137-148). IGI Global.
van Boven, L. S., Kusters, R. W., Tin, D., van Osch, F. H., De Cauwer, H., Ketelings, L., Rao, M., Dameff, C., & Barten, D. G. (2024). Hacking acute care: A qualitative study on the health care impacts of ransomware attacks against hospitals. Annals of Emergency Medicine, 83(1), 46-56. https://doi.org/10.1016/j.annemergmed.2023.04.025
Vikash, B. S. (2022). Exploring challenges faced by information technology security managers in implementing risk management framework to protect protected health information and personally identifiable information (Order No. 29996025). Northcentral University.https://marymountuniv.idm.oclc.org/login?url=https://www.proquest.com/dissertations-theses/exploring-challenges-faced-information-technology/docview/2746479688/se-2. Accessed on January 17, 2026
Whitman, M. E., & Mattord, H. J. (2018). Principles of information security (6th ed.). Cengage Learning.
Xenikou, A., & Furnham, A. (2022). Leadership and organizational culture. Handbook of research methods for organisational culture, 23-38.
