How Do Ransomware Attacks Impact Rural Hospitals?

Synopsis

Amid increasing cybersecurity threats aimed at urban and rural health care delivery systems, a novel study found that while ransomware attacks are less likely to occur in rural areas, the operational disruptions resulting from such attacks may have more pronounced effects on financially vulnerable rural hospitals. This study offers valuable insights for policymakers and health systems seeking to understand the ramifications of ransomware attacks on rural hospitals’ viability and operations, as well as the patients they serve.

Growing Ransomware Attacks Affect Rural Health Care Operations and Care Delivery

Ransomware attacks have nearly doubled annually in the health care sector, with health care delivery organizations particularly at risk due to interconnected health systems, outdated cybersecurity practices, and COVID-19-related financial strain. Recent incidents have highlighted how these attacks affect health care operations, beyond the attacked site. Among providers, hospitals experience the highest rate of operational disturbances, including restricted access to servers and disrupted or redirected patient care. This study contributes valuable findings to the limited body of evidence on the effects of ransomware attacks on rural hospitals.

Ransomware attacks lead to temporary declines in patient volume and revenue for rural and urban hospitals, but rural hospitals and patients may be more susceptible to the effects. Ransomware attacks can also disrupt hospital finances, including procedural interruptions and delays in processing claims. These disruptions can place rural hospitals in a more precarious financial situation, as they are typically smaller and more financially vulnerable. Additionally, ransomware attacks can significantly disrupt patients’ access to care, especially among rural residents who are often older, in poorer health, and facing existing barriers to care. The disruptions caused by ransomware attacks may have spillover effects on nearby sites of care by directing more patients to non-attacked facilities. For rural patients, the average non-ransomware-attacked hospital was over 30 minutes away, 4 to 7 times further than for urban patients. The increased distance could result in delayed or canceled services, impacting health care spending and outcomes, especially in medical emergencies.

These findings may be valuable for stakeholders aiming to understand the effects of ransomware attacks on hospital sustainability, particularly as rural areas are facing hospital closures which further impact health care markets and access. Additionally, the study may provide insights into enhancing cybersecurity protocols in rural settings, as these hospitals often have lower levels of preparedness against ransomware attacks.

Conversation with the Researcher

Key Findings

This study compared the hospital characteristics and operations of 43 rural and 117 urban hospitals that experienced ransomware attacks between 2016 and 2021.

Hospital Characteristics

Compared to their urban counterparts, rural hospitals:

• Had fewer hospital beds and annual Medicare admissions.

• Were less likely to be part of a larger health system or categorized as a Level 1 or 2 trauma center.

• Had higher rates of nonprofit status and were more likely to be designated as a Critical Access Hospital or Sole Community Hospital. Rural hospitals were equally likely to be Rural Referral Centers than urban hospitals.

• Were marginally less likely to operate an obstetric unit but equally likely to operate an emergency room.

• Required further travel to the nearest non-attacked hospital. The median non-ransomware-attacked rural hospital was over 30 minutes away, compared to less than 10 minutes for urban hospitals.

Hospital Operations

During the initial week of the ransomware attack:

• Rural and urban hospitals experienced similarly large declines in inpatient admissions and Medicare revenues from such admissions, compared to the week preceding the attack.

• Volume and revenue of hospital outpatient and emergency room visits also decreased for both rural and urban hospitals, but the decline was more pronounced among rural facilities.

• The return to pre-attack admissions and revenue levels took between two and three weeks for rural and urban hospitals.