Yesterday's government spending review included a major investment in NHS technology, as part of a record £29 billion funding boost for the health service.

Rachel Reeves announced plans to spend up to £10 billion on technology and digital transformation in the NHS by 2028‑29 - up almost 50% on today's figure.

Overall, the government said, funding provided through the review will enable the NHS to deliver productivity growth of 2% each year, unlocking £17 billion in savings over three years.

All of these savings, it noted, will be reinvested back into the NHS to improve patient care.

"There’s no strong economy without a strong NHS," Reeves told the House of Commons. "We are investing £10 billion to bring our analogue health system into the digital age, including through the NHS app, so patients can manage their prescriptions, get their test results, and book appointments all in one place."

Cash will also go to the development of the single patient record, giving patients a unified view of their medical history and enabling two-way communication and active management of their healthcare, along with the continued adoption of the Federated Data Platform.

With the NHS notoriously reliant on legacy technology, the move has been welcomed by tech experts as a positive move toward driving productivity.

"You can’t build a digital NHS on analogue infrastructure. The government knows this and understands it will only be able to drive long-term efficiency in the NHS through investments in technology to modernize healthcare," said Flann Horgan, head of the healthcare sector at NTT Data UK & Ireland.

"The ten-year plan for the NHS sets out a clear direction for this: move from analogue to digital, modernize infrastructure, and harness technology to deliver better care at lower cost. To get a return on the investment announced today, the government is looking to make digital the default across the NHS and not the exception."

NHS AI approach requires caution

The government is keen to exploit AI to improve efficiency across the board - and the NHS is no exception. However, the government needs to act with caution, warned Hogan.

"To get a return on the investment announced today, the government is looking to make digital the default across the NHS and not the exception. AI will be key to this, but it won’t be an easy feat to scale across the NHS without tackling siloed data and outdated systems," he said.

"At The Royal Marsden, we’ve seen this at work: AI tools being deployed to help radiologists diagnose and monitor cancer progression with greater accuracy and speed. This can be delivered, within real-world NHS constraints – when the right technical and clinical foundations are in place. Without these, AI risks becoming just another layer of complexity rather than a tool that genuinely improves care."

In last year’s Autumn Budget, Reeves pledged to invest more than £2 billion in NHS technology and digital initiatives.

However, there are questions over whether the money will be enough. Last month, research published by the Health Foundation charity concluded that digitizing NHS and adult social care services across the UK would require around £21 billion over the next five years.

MORE FROM ITPRO

• How is AI improving healthcare?
• NHS England launches cyber charter to shore up vendor security practices
• US healthcare data breaches are out of control

US-based healthcare provider Kettering Health was forced to cancel patient appointments following a cyber attack which caused a company-wide outage.

Kettering Health operates 14 medical centers and over 100 outpatient locations across the state of Ohio. In a statement confirming the outage on Tuesday 20th, the non-profit said the attack severely impacted call center operations and a number of patient care systems.

“Elective inpatient and outpatient procedures at Kettering Health facilities have been canceled for today Tuesday, May 20,” the company said.

“These procedures will be rescheduled for a later date and more information will be provided on this as updates are available. In addition, our call center is experiencing an outage and may not be accessible.”

In the wake of the attack, Kettering Health warned patients to be wary of potential phishing scams as threat actors look to capitalize on the disruption.

The provider told patients to never share financial details in the event they are contacted and report any cases to law enforcement.

"While it is customary for Kettering Health to contact patients by phone to discuss payment options for medical bills, out of an abundance of caution, we will not be making calls to ask for or receive payment over the phone until further notice," the firm said.

Who’s behind the Kettering Health attack?

According to reports from CNN, the Interlock ransomware group has claimed responsibility for the attack, with the group threatening to leak stolen information if it fails to pay a ransom.

"Your network was compromised, and we have secured your most vital files," read a ransom note seen by reporters at the publication.

Interlock is a relatively new ransomware group, but has quickly risen to prominence since first bursting onto the scene in late 2024. Rebecca Moody, head of data research at Comparitech, said the group first began adding victims to its data leak site in October 2024.

“As with most ransomware gangs today, it seeks a ransom payment for the decryption of systems and the deletion of stolen data,” she said.

Moody added that since October last year, Comparitech has tracked 16 confirmed attacks by the group and an additional 17 unconfirmed attacks that “haven’t been acknowledged by the organizations in question”.

The company has previously targeted healthcare organizations in the US, having claimed responsibility for a breach on DaVita, a kidney care provider that operates across the United States.

Most recently, Interlock was identified as the group behind an attack on a local authority’s school networks in Scotland. The local council for West Lothian, which is located on the outskirts of Edinburgh, confirmed the attack earlier this week.

The group has since leaked 3.3 million files on the dark web, according to reports from Edinburgh-based publication, Futurescot.

MORE FROM ITPRO

• US healthcare data breaches are out of control
• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks
• NHS England launches cyber charter to shore up vendor security practices

Two new reports have highlighted the immense scale of US healthcare data breaches, with 409 million personal records exposed over the last two years.

According to research from application security firm Indusface, there were 1,200 breaches in the US healthcare sector in the last 24 months, with 83% of incidents leaving patient records exposed.

Texas recorded 66 data breaches, the most of any state, as well as the most people affected, at 14,371,828. The state’s biggest breach was that of Concentra Health Services in January 2024, which saw data belonging to nearly four million people accessed or stolen.

California had the second-highest number of individuals affected by data breaches, at 9,218,788. Notably, it also experienced the largest healthcare data breach in the study, affecting 4,700,000 people, when Blue Shield of California’s member data was shared with Google for advertising.

At the other end of the scale, Ohio saw 45 incidents affecting the data of 3,767,504 people, and Massachusetts just 28, exposing data belonging to 3,743,999.

"The healthcare sector is vulnerable to these breaches due to both the vast amount of sensitive patient data, which is often sold to third parties for a high price, and weak or outdated software and systems," said Venky Sundar, founder and president of Indusface.

"According to Verizon’s latest DBIR, vulnerability exploits have now overtaken phishing as a leading cause of data breaches. What is particularly concerning is how patching an average vulnerability takes 200-plus days."

Ransomware contributing to healthcare data breaches

The figures come after a study from Michigan State University, Yale University, and Johns Hopkins University found that ransomware-related breaches have become a key issue for healthcare providers.

Researchers found that although ransomware accounted for just 11% of breaches in 2024 by number, those attacks alone were responsible for 69% of all patient records compromised that year.

The number of attacks has also been rising steadily over the last decade. While in 2010 there were no ransomware breaches, there were 222 in 2021, accounting for nearly a third of all major healthcare breaches that year.

Similarly, the overall share of breaches caused by hacking or IT incidents surged from 4% in 2010 to 81% in 2024.

Researchers said these numbers probably underestimate the true extent of the problem thanks to underreporting, reluctance to disclose ransom payments, and the fact that the study didn't look at smaller breaches affecting fewer than 500 individuals.

"Ransomware has become the most disruptive force in healthcare cybersecurity,” said John Jiang, Eli Broad endowed professor of accounting and information systems in the MSU Broad College of Business and lead author of the study.

"Healthcare providers have limited cybersecurity resources, so it’s essential to focus protection on the most sensitive types of information. The solutions are within reach — what we need now is coordination, transparency and urgency."

MORE FROM ITPRO

• Healthcare systems are rife with exploits — and ransomware gangs have noticed
• Five ways cyber criminals target healthcare and how to stop them
• More than 5 million Americans just had their personal information exposed

A data breach at Yale New Haven Health (YNHHS) has exposed data belonging to millions of people – and lawsuits have already been filed.

YNHHS runs more than 360 locations across Connecticut, New York, and Rhode Island, and is notifying patients that their personal data might have been affected.

According to an entry on the US Department of Health and Human Services breach portal, the data breach impacted 5,556,702 patients.

"The information involved varied by patient, but may have included demographic information (such as name, date of birth, address, telephone number, email address, race or ethnicity), Social Security number, patient type, and/or medical record number," said YNHHS.

"YNHHS’ electronic medical record and treatment information were not involved or accessed, and no financial account or payment information was involved in this incident."

The breach was first discovered on March 8th when YNHHS spotted unusual activity affecting its IT systems. The organization took steps immediately to contain the incident and began an investigation with the help of external cybersecurity experts from Mandiant.

It also reported the incident to law enforcement. However, patients weren't notified of the breach until late April.

It's now offering complimentary credit monitoring and identity protection services, but only to those whose Social Security number was involved.

Yale New Haven Health faces legal action

Legal action has already been launched. Hartford law firm Cicchiello & Cicchiello has filed two identical lawsuits in the Connecticut District Court on behalf of Michael Liparulo of New London and Jon Nathanson of Fairfield.

The lawsuits allege YNHHS failed to protect personally identifiable and health information, and took too long to notify patients.

Similarly, the cases claim IT practitioners failed to encrypt files, train employees on data security, or implement basic security measures such as multi-factor authentication.

They’re calling for damages, free lifetime identity protection, and major changes to the health system’s cybersecurity practices.

Healthcare in the crosshairs

Healthcare organizations are a prime target for hackers thanks to the vast amount of highly personal data that they hold. According to recent research from Trustwave, for example, 21% of all ransomware attacks worldwide are targeted at public health and government healthcare organizations.

The study found that 45% of attacks exploited public-facing applications and 56% of public-facing applications exploited were against Log4j, with 9% of all attacks coming from the threat group RansomHub.

Third-party threats within supply chains continue to pose 'significant' risks, the researchers found.

"Healthcare artificial intelligence and technology adoption presents a spectrum of risks that few other industries need to navigate. The risk is not just incredibly sensitive data privacy, but human life and quality of patient care," said Kory Daniels, CISO at Trustwave.

"Complex supply chains, lapses in patches and credential management all have consequences too serious for anyone in the healthcare industry to ignore".

MORE FROM ITPRO

• Healthcare systems are rife with exploits — and ransomware gangs have noticed
• Healthcare organizations need to shake up email security practices
• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks

The vast majority of phishing attacks against the healthcare sector go unreported to security teams, leaving organizations unable to fully learn from their mistakes.

In a survey of 150 US-based healthcare IT leaders for secure email firm Paubox, six-in-ten said they had experienced at least one email security breach last year, and three-quarters that they expected even more security challenges this year.

The top risks were phishing, man-in-the-middle attacks, and password guessing, often through personal information revealed on social media.

However, IT leaders said 95% of phishing attacks went unreported to security teams, along with 96% of known email violations of the 1996 Health Insurance Portability and Accountability Act (HIPAA), aimed at protecting sensitive health information from disclosure without patient's consent.

As a result, these incidents weren't investigated, meaning that systems weren’t patched, staff weren’t alerted, and patients weren’t warned that their data may be at risk.

"We encountered a significant case where an outdated email system directly impacted patient care due to a cybersecurity breach," said Matt Murren, CEO of healthcare IT support firm True North ITG.

"The phishing attack compromised user credentials and eventually deployed ransomware across the network. It shut systems down for two weeks. Appointments were delayed. Test results were inaccessible. Urgent care cases were diverted elsewhere. Patients lost trust. This isn’t just an IT failure — it’s a patient safety crisis."

The problem doesn't seem to be a lack of awareness amongst staff. Nine-in-ten said they carried out staff training.

Ryan Winchester, CareM director of information technology, said "no amount of training can completely eliminate human error, so businesses must have safeguards in place."

The report found that healthcare organizations currently allocate only 11–20% of their IT budgets to email security, despite email being their top risk area. One persistent problem is poor infrastructure, with 83% of healthcare IT leaders saying that legacy systems disrupt day-to-day operations.

"I’ve seen first-hand how legacy email platforms can quietly — but critically — undermine operational stability and efficiency across healthcare organizations" said Murren.

In larger healthcare networks, the most common challenges include high maintenance costs that drain IT resources, persistent security vulnerabilities, outdated and complex user interfaces, system performance bottlenecks, and limited support for mobile and remote working.

The result is reactive firefighting, with about 37% of healthcare IT leaders spending between 11 and 20 hours per week just resolving secure email tickets.

"Healthcare doesn’t need more patchwork fixes — it needs a mindset shift. Patients expect secure, convenient communication, and it’s on us to meet that standard," said CEO of Paubox Hoala Greevy.

MORE FROM ITPRO

• Are phishing tests a waste of time?
• 10 quick tips for identifying phishing emails
• Phishing tactics: The top attack trends

Healthcare organizations are facing serious threats from ransomware groups, with nearly nine-in-ten (89%) found to have medical devices that are vulnerable to exploits.

That's according to research from Claroty, which examined the state of security among healthcare organizations — and the diagnosis isn't good.

The report found that effectively all (99%) of healthcare organizations have at least one known, actively exploited vulnerability in their networks, with 78% of operational devices such as power supplies, temperature controls, and building management systems found to have a known exploited vulnerability.

Even imaging systems such as X-rays, CT scanners, MRIs, and ultrasound machines are at risk, with 8% of those examined found to have known flaws. A further 20% of hospital information systems also featured known vulnerabilities.

Beyond those known flaws, Claroty warned that healthcare organizations put themselves at risk of a security incident with insecure connections, using default passwords or hard coded credentials, and leaving data in cleartext.

Researchers advised companies to scope out what critical processes and devices could be impacted, follow a cybersecurity framework that considers the business impact and exploitability of exposures, and rollout mitigations and patches.

"We urge organizations to focus on the exposures that matter most: KEVs, KEVs linked to ransomware, and insecure connectivity," the report said.

Rise in ransomware attacks

The warning to address these known flaws comes amid a string of attacks against healthcare organizations, with analysis showing there had been 884 security incidents in the sector between January 2023 and February 2025.

The attacks have continued, with Sunflower Medical Group recently warning patient data had been accessed in a breach earlier this month.

Two of the biggest attacks in the healthcare space have been pinned on Russian ransomware gangs. Ascension, a private healthcare provider in the US, admitted a breach in May 2024 that caused $1.8 billion in losses following an attack attributed to Russian group Black Basta.

Earlier that year, Change Healthcare is believed to have paid out a $22 million ransom, the report noted, in an attack attributed to Russian group BlackCat.

Hospitals and other healthcare organizations are major targets because they are among the critical infrastructure targets most likely to meet ransom demands, the Claroty report noted.

Indeed, a previous report by Claroty, which surveyed 1,100 cybersecurity leaders globally, found that 78% of organizations in the healthcare sector reported making a ransomware payment above half a million dollars.

Meanwhile, more than a third shelled out more than $1 million.

"Ransomware and other attacks against hospitals are in reality attacks against patients, their safety, and the integrity and availability of care," the report added.

"The threat is real as the hundreds of incidents in the last half-decade bear out — and it’s getting complex. Attackers are targeting not only hospitals, but the supply chain, payment processors, and other third-party organizations in the sector."

MORE FROM ITPRO

• February was the worst month on record for ransomware attacks
• Building ransomware resilience to avoid paying out
• CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted

Two US healthcare organizations have warned threat actors were able to breach their internal systems, exposing more than 300,000 individuals.

On 7 March 2025, Kansas-based healthcare provider Sunflower Medical Group published an alert stating that over 220,000 patients had their personally identifiable information (PII) accessed in a data breach.

An advisory published by the firm revealed it discovered suspicious activity within its network on 7 January 2025 and engaged a leading security firm to conduct an investigation.

The subsequent investigation found an unknown third party had accessed Sunflower’s systems around 15 December 2024 and was able to copy files from the firm's internal systems while doing so.

The advisory stated that the specific information accessed by the attackers varied by individual, but could include their name, address, date of birth, social security number (SSN), driver’s license number, medical information, and health insurance information.

Sunflower said it has contacted the affected individuals for whom it had valid mailing addresses to notify them of their potential exposure and offer identity theft protection services to those whose SSNs and driver’s licenses were compromised.

It added that the firm has not found any evidence of personal information being abused by threat actors, but advised continued vigilance from affected individuals.

Rhysida linked to two breaches announced on the same day

The Rhysida ransomware group claimed responsibility for the attack back in January 2025 when it listed Sunflower on its leak site, stating the stolen information was available to the highest bidder.

The post claimed the group had stolen an SQL database consisting of more than 3TB of data and was in possession of 400,000 driver’s licences, insurance cards, and SSNs.

On the same day, another healthcare organization specializing in mental illness and addiction, the Community Care Alliance, informed authorities that it too had been breached in July 2024.

The company told authorities that just under 115,000 individuals were affected by the breach.

“On or around January 8, 2025, we completed our investigation and determined the types of information potentially affected may include individuals’ name and one or more of the following: address, date of birth, driver’s license number, Social Security number, diagnosis/condition, lab results, medications, patient ID number, health insurance information, provider name and/or other treatment information,” the firm advised.

The Rhysida gang also claimed responsibility for this attack, claiming it had a 2.5TB SQL database available for sale.

The group was first observed in the summer of 2023, rising to fame after its notable attack on the British Library which crippled its online information systems and led to the release of 600GB of material online.

CISA has highlighted that the Rhysida ransomware gang has established a reputation for impacting “targets of opportunity” including organizations in the education, healthcare, manufacturing, information technology, and government sectors.

MORE FROM ITPRO

• 12,000 API keys and passwords were found in a popular AI training dataset
• Cobalt Strike abusers have been dealt a hammer blow
• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools

A Dutch IT company has demonstrated exactly how not to handle data protection after a number of hard drives containing sensitive medical data were found for sale at a Belgian flea market.

First reported in Dutch broadcaster Omroep Brabant, 62-year-old Robert Polet from Breda found the hard drives on sale for roughly €5 each in a flea market after taking a pit stop on his way back from Belgium.

Polet, a computer-crazy camera enthusiast, said that on returning to his home in Breda and inspecting the hard drives, he was shocked to find they were full of medical data from the period between 2011 and 2019.

The hard drives contained the Dutch citizen service numbers (BSN), dates of birth, addresses, prescriptions, and other medical information linked to individuals from the Utrecht, Delft, and Houten regions.

After contacting the affected healthcare organisation, based in Utrecht, Polet said he was informed the data originated from an IT company that no longer exists.

Nortade ICT Solutions used to develop software for the healthcare sector but exactly how the hard drives ended up at a flea market in Belgium is still unclear.

Polet told Omroep Brabant that once he had made the discovery he returned to the flea market to buy the rest of the hard drives, but could not ascertain where the seller had acquired them due to a language barrier.

“Nightmare” breach as “painful as anyone can imagine”

Speaking to ITPro Rick Goud, CIO and co-founder at email security and file transfer platform Zivver, described the incident as a business’ ‘worst nightmare’, but noted he was not totally surprised by the incident.

“It’s your worst nightmare right? If the company wasn’t already bankrupt they probably would be by now… It is not a surprise, but of course as painful as anyone can imagine a data leak to be.”

Elaborating on this, Goud said he feels the fact that this data managed to leak via improperly handled hardware was indicative of a period where data protection was not front of mind for some organizations working with healthcare data.

“What is interesting about this case is that it’s quite old data. I think it fits the mindset of how healthcare data was treated ten years ago,” he explained.

“It’s certainly not an excuse but it is something I do recognize from the early days when I started in healthcare. Around 20 years ago you could still walk around with DVDs inside a hospital and ask the administrator to install it and put it on the mainframe and they would just do it.”

He said that thankfully the risk profile attached to data leaks, especially those affecting health data, has meant businesses take cybersecurity and data protection more seriously over the last 10 years.

Attitudes around safeguarding data are changing

Goud attributed this improvement to a higher risk awareness driven by legislation and standards such as ISO 27001 and the NEN 7510 which set out procedures and best practices for data protection and deprecating old storage devices.

But he warned some businesses will run into this type of security weakness on a day-to-day basis, particularly when they have handed off the problem to a third party.

“They do not ask the vendor the right questions to ensure that a) as a healthcare provider they are sure that the vendor treats the data as well as they do it themselves but also think that basically by hiring somebody else to process your data that you are not responsible anymore and of course that is not true.”

Victoria Hordern, partner and data protection specialist at global law firm Taylor Wessing, told ITPro that as well as Nortade itself the healthcare organization that contracted it could be subject to investigation.

"The health organizations that engaged Nortrade ICT Solutions would be required to carry out appropriate due diligence before appointing a third party provider and ensuring that data security to protect the data is adequate," Horden said.

"Therefore, to the extent this incident reveals a failure to do this, they could also be subject to investigation and enforcement action from the data protection authority."

Goud added that regulations like ISO 27001 and NEN 7510 have been around for some time but only became legally enforceable on healthcare organizations roughly four years ago, noting that he feels there has been a ‘mindset shift’ in data protection since then.

“So that has significantly changed practices, until then it was something that the early adopters that had the intrinsic motivation to adequately protect healthcare pursued because, of course, it's costly to go through that kind of certification process. Nowadays it is a must have,” he said.

“In 2011 to 2019 where this data is from you would see probably 2 – 3% of suppliers and healthcare organizations had that type of certification, nowadays I would say that it’s closer to 70 or 80% in the Netherlands at least.”

MORE FROM ITPRO

• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claim
• Why government email servers are top targets for state-backed hackers

An NHS hospital has admitted its cancer treatment wait times increased in the wake of a cyber attack that took down its systems at the end of last year — and it will take many months to recover.

Last November, NHS hospitals and health centers that make up Wirral University Teaching Hospital Trust in Merseyside were hit by a major cybersecurity incident, with appointments cancelled and patients at some locations told to only attend A&E if necessary.

The incident was still ongoing weeks later, according to an update on 5 December.

Because the hackers accessed systems via an online portal for appointments, the hospitals had to switch to paper-based operations.

In a report referencing the incident, the trust admitted all outpatient appointments were cancelled from 25 November when the attack began until 4 December, when services were reinstated

"The trust has been in a strong position with improving waiting times for elective, diagnostic and cancer pathways but this performance has been significantly impacted by the cyber attack that was experienced late November and into early December," noted the report.

The human impact of cyber attacks

The report noted that cancer diagnosis and treatment performance for October and November was positive. However, that fell in December, in part due to seasonal reduced capacity but also because of the impact of the cyber attack — and that would take months to catch up.

"The cyber incident was seen to impact elective performance both in terms of the loss of activity that would have provided treatment / diagnostic and stopped waiting times for patients, and on the ability to validate the waiting times position. Performance across RTT, cancer and diagnostics was affected,” the report added.

Despite the admitted delays to care, a Wirral University Teaching Hospital Trust spokesperson told DigitalHealth that staff had managed to maintain some services by implementing business continuity plans.

“Recovery plans were implemented immediately to proactively recover any lost activity, ensuring patients affected by the disruption are prioritized," the spokesperson told the publication.

"Our teams are focused on restoring performance across elective, diagnostic, and cancer pathways as quickly as possible, and we have already made significant progress."

Healthcare attacks are a growing problem

Research shows the healthcare sector is a major target for hackers, with organizations operating in the sector attacked four times as frequently as the global average for all industries.

Indeed, the Merseyside attack is one of a long line of cyber incidents to impact British hospitals. Last year, NHS Dumfries and Galloway was hit by a data breach, while King's College Hospital Foundation Trust and Guy's and St Thomas' Hospitals Foundation Trust in London had to reduce operations after a cyber attack on provider Synnovis.

This incident led to at least two cases of severe patient harm, according to reports.

Trevor Dearing, director of critical infrastructure at Illumio, said at the time of the Merseyside incident in November that hospitals would continue to be targets, and needed to find ways to keep providing care to patients even when under attack.

"Cyber attacks aren’t going away, but hospitals must reach a point where patient care — urgent or routine — remains uninterrupted," he said.

MORE FROM ITPRO

• Why healthcare firms are a lucrative target for hackers
• Five ways threat actors target healthcare companies
• 190 million US citizens were impacted in the Change Healthcare breach

The US Department of Health and Human Services (HHS) has proposed extensive modifications to existing standards governing how healthcare information is stored and protected in the region.

Set to be published in the Federal Register on 6 January, the changes set out by the HHS would impact the ‘security rule’ of the Health Insurance Portability and Accountability Act (HIPAA).

The HHS said the security rule is one of several HIPAA rules that protect the privacy and security of an individual's protected health information (PHI), which refers to individually identifiable health information that is maintained electronically (ePHI) or otherwise.

The proposed modifications, which would mark the first major update to the HIPAA’s security rule in over 10 years, include new requirements for healthcare organizations to implement security controls such as multi-factor authentication (MFA), network segmentation, and rigorous encryption of healthcare data.

Healthcare organizations will also be required to build an inventory of their technology assets and provide information detailing how ePHI is moved and stored within their networks.

Anne Neuberger, deputy national security advisor for cyber and emerging technology, discussed the upcoming changes at a White House press briefing on 27 December, and outlined the projected costs of implementing these measures.

She said the modifications to the security rule are projected to cost roughly $9 billion during the first year of implementation, and then a further $6 billion for years two-to-five.

Growth in US healthcare breaches prompts action

Neuberger explained that the implementation costs pale in comparison to those incurred by breaches, citing the fact two of the most serious cyber attacks on healthcare organizations in the US ever took place within the last year.

The attack on Change Healthcare, for example, which occurred in February 2024, was one of the largest data breaches ever recorded in the US, which saw the PHI of over 100 million individuals compromised by the ALPHV/BlackCat group.

The threat group was able to steal health insurance information, medical data, as well as other PII including Social Security numbers, driver’s licenses, and passport numbers.

UnitedHealth Group, the parent company of Change Healthcare, admitted to having paid the group a $22 million ransom in order to retrieve the stolen data.

“In 2023, the average cost of a breach in healthcare was $10.1 million. The two biggest healthcare breaches we have ever experienced, Ascension Health and Change Healthcare, both occurred in the last year, and you may have noted Change Healthcare noted that the cost of the breach will be approaching $800 million in the cost of recovery and the cost of operations, and, frankly, in the cost to Americans’ healthcare data and the operations of hospitals affected by it.”

The HHS noted that since its publication in 2003, and revision in 2013, there have been a number of “significant changes to the environment in which healthcare is provided and how the health care industry operates”, adding that cybersecurity is a concern for “every facet of modern health care”.

As a result, it said an alarming growth in serious breaches affecting US citizens’ healthcare information and a “rampant escalation of cyberattacks using hacking and ransomware” required an update to the current security standards governing this data.

“The Department is concerned by the increasing numbers of breaches and other cybersecurity incidents experienced by regulated entities. We are also increasingly concerned by the upward trend in the numbers of individuals affected by such incidents and the magnitude of the potential harms from such incidents.”

Regulated entities will be required to comply with the modified security rule under the HIPAA within 60 days after publication, expected to be 6 January 2024.

Healthcare organizations around the world are continually weathering a barrage of cyber attacks that disrupt patient care and threaten lives.

In an industry where system downtime could potentially have fatal consequences, healthcare institutions need to be as prepared as they can to prevent and recover from cyber attacks.

But what are the major cyber threats facing healthcare organizations, and how can the threat actors behind them be stopped?

Phishing

Phishing attacks are by far the most popular initial access method used by threat actors to get a foothold in the network of their target.

This technique involves tricking staff at an organization into sharing sensitive information or downloading malware onto the corporate network.

Phishing has traditionally taken the guise of email messages encouraging receivers to click on malicious links that redirect them to spoofed websites which harvest their credentials.

Threat actors are continually evolving their techniques, however, developing more sophisticated social engineering scams that can dupe even the most cautious employee.

Spear phishing attacks are a highly personalized form of phishing where the attacker targets a specific person or group within an organization, using specific information tailored to them to make the message even more believable.

Data published by the US Department of Health and Human Services reveals that there were 4,419 reported breaches of protected health information affecting over 500 individuals between 2009 and 2021, and 18% of these were listed as healthcare phishing attacks.

Healthcare organizations can protect themselves from phishing by implementing strong email scanning tools that detect suspicious emails, according to their address, body text, or attachments to look for any malicious content.

If someone has fallen for a phishing email, ensuring all staff are using multi-factor authentication (MFA) on their account can help prevent the criminal from causing further damage, such as carrying out a business email compromise (BEC) attack.

Cybersecurity awareness training is also essential in helping employees identify social engineering techniques. Cyber defenses are all too often compromised by human error, so training employees in how to spot potential security threats and not give away sensitive information can be critical in keeping your organization secure.

Ransomware

Once the criminal has access to the victim’s network, they frequently deploy ransomware in order to encrypt and exfiltrate sensitive information that they can use to extort the victim down the line, and this is a particular problem for the healthcare industry.

Medical records are some of the most valuable digital records hackers can sell on the dark web due to their level of sensitivity. Unlike a financial or employment record, changing one’s medical history is almost impossible and so individuals are willing to go to great lengths to prevent this information from being made public.

As such, there is a lucrative trade among threat actors in stealing medical information and using it to extract ransoms from medical institutions or individuals.

Research conducted by Sophos found two thirds of healthcare organizations suffered ransomware attacks in the past year, preventing them from accessing devices and the data stored on them.

In the healthcare sector, downtime can have particularly severe consequences, and so falling victim to a ransomware attack is a serious concern for security professionals working at medical institutions.

A major part of keeping your organization protected from ransomware attacks is ensuring you are maintaining backups of all important data. This is the single most effective way to ensure you are able to recover from attacks quickly and minimize disruption.

A zero trust security model can also help prevent attackers from accessing sensitive data once they are on the network. This works by assuming no device, user, or application is trustworthy and requires they reauthenticate themselves each time they reach a different segment of the network.

DDoS

Distributed denial of service (DDoS) attacks are a popular tactic often used as a precursor to further attacks. Threat actors use DDoS attacks to overwhelm a network, disabling many critical functions and often bringing an organization's IT estate to its knees.

This is particularly serious for healthcare providers because, as previously mentioned, any amount of downtime can be a matter of life and death.

In 2023, a Russian-affiliated hacking group known as Killnet launched a series of DDoS attacks on healthcare organizations in the US, overloading the victims’ networks with traffic and making it impossible to access essential patient services.

Defending against DDoS attacks requires maintaining a strong partnership with your network service provider, and implementing strong DDoS protection and mitigation solutions.

These solutions could include using a web application firewall (WAF), paying a service to continuously analyze network traffic, or physical appliances deployed on the edge routers that stop DDoS attacks at the edge.

Software vulnerabilities

Medical organizations use a collection of programs to manage operations. These include electronic health record software, medical diagnosis programs, appointment scheduling tools, and many more.

This presents IT admins with great deal of complexity to manage, and unpatched software can create a host of problems for healthcare providers. Malfunctioning software can pose a significant risk to patients and any unpatched vulnerabilities presenting a juicy target for opportunistic cyber criminals.

One mitigation strategy to reduce the risk of unpatched software to your organization is implementing an automated patch management solution. These tools help take the time-consuming process of identifying, testing, and deploying patches off IT admins’ hands and reduce the likelihood of human error.

Organizations should also prioritize risk-based patching, where software is updated according to the relative severity of the vulnerability. Those flaws with higher CVSS scores should be prioritized as they are more likely to attract attention from cyber criminals and impact critical systems.

Medical device vulnerabilities

The healthcare industry has embraced the internet of things (IoT) to enhance patient care, birthing its own category of devices dubbed the internet of medical things (IoMT).

Remote patient monitoring is the most common application of IoT devices in healthcare settings, which automatically collect the patient’s heart rate, blood pressure, temperature and other health metrics.

But IoT technology brings with it a host of security risks, namely that it presents hackers with an expanded attack surface to threat actors. As a result, monitoring, managing, and protecting these IoT devices is essential if hospitals want to stay secure.

Healthcare organizations should prioritize establishing good device visibility and then continuously assessing the risk the devices and their associated vulnerabilities pose to the overall network.

Network segmentation and least privileged access controls, like zero trust, are key here too. This enables IT admins to create and enforce policies that limit an individual device’s access to only the resources it needs to function properly. Reducing the level of damage it could cause if it was compromised by a malicious actor.

Putting patients at the centre of design, smart medical devices, and digital health solutions can be the catalyst that further accelerates the transformation of healthcare delivery - streamlining patient care and optimising patient outcomes.

In this paper, IBM and Salesforce have come together with the ABHI (Association of British HealthTech Industries) to provide some practical steps, based on previous successes, to help MedTech companies seize the opportunity to deliver this transformation for their patients.

Download now to learn how to choose the right platform to ensure optimum data insights for a supported patient engagement experience

Cyber criminals are after data - the more sensitive, the better - which means that, unfortunately, the healthcare industry is a popular target for hackers.

According to a recent report by the World Economic Forum, there were 4 incidents per week over the last two years, where 60% of these attacks leaked data, resulting in diverted patients, cancelled appointments & delayed surgeries.

This whitepaper shares best practices to mitigate attacks - ransomware being the biggest threat - including a multi-layered approach and advice on how to meet NCSC guidelines.

Provided by

The threat of ransomware has swelled in recent years, with the indiscriminate WannaCry attack five years ago perhaps the first major incident to ring the alarm bells in the eyes of the public after it crippled the NHS. Indeed, while all sectors are vulnerable to ransomware – and can be targeted at any time – the health sector is especially susceptible. Attacks, too, must be headed off with more urgency. This isn’t just because healthcare, like much of the public sector, is lumbered with legacy IT and outdated processes, but the consequences of an attack might be particularly devastating for patients.

Ireland’s Health Service Executive (HSE), for example, was hit by a ransomware attack last May and was still in the process of recovering as late as September. The NHS, meanwhile, suffered losses of £92 million following the WannaCry attack. Healthcare services across the world have, since 2017, sought to rectify the issues that render them so vulnerable, seeking out systems developed by vendors like Wasabi to patch manifold issues including outdated infrastructure and insufficient backup provision. Despite these efforts, the health sector remains very much at risk.

Cause and effect

While it’s valid to question why healthcare is particularly vulnerable, it’s also worth pondering why ransomware gangs so frequently target institutions like hospitals. “Hackers are in the business of extorting as much money as possible by hitting organisations where they can inflict as much pain as possible,” says VP analyst for security and risk management at Gartner, Katell Thielemann. “When it comes to hospitals, particularly in the middle of a pandemic, they cannot take care of patients without technology, and they have been very responsive to ransomware demands, which just incentivises hackers to strike more.”

Beyond a compulsion to pay, in order to restore services and prevent patient harm, the sector also houses a goldmine of data including personal details and financial information. All these factors, combined with the stresses created by COVID-19, has unsurprisingly led to incidents rising in astonishing fashion.

The sector, too, suffers from a number of unique challenges, many of which centre around the growing volume of data held by healthcare services. “Their architecture is typically very complex,” continues Thielemann, adding that “the operational environment is very fluid with crisis after crisis and people coming and going around the clock”.

Beyond personal patient details, organisations host clinical information such as reports, scans, and genomic data. Much of this is also stored in on-premises infrastructure, as opposed to a streamlined, secure and accessible cloud-based platform.

With digital transformation on the agenda for many sectors, including healthcare, the transition of data from local, on-premises storage to the digital sphere over the last few years has also expanded the attack surface. The use of Internet of Things (IoT) devices in medical contexts, moreover, has inevitably opened more gateways into the sector. As Thielemann puts it: “They are full of all kinds of connected medical equipment that create a cyber-physical continuum of threats.”

The lack of modernised and state-of-the-art backup facilities is yet another thorn in the side of healthcare. Deemed the last line of defence against ransomware, backup systems ensure organisations minimise downtime and recover from attacks as quickly as possible. Multiple backups are preferable, as is ensuring geographical separation between backup copies enabled through cloud storage; in keeping with the ‘3-2-1’ rule.

Getting your backup strategy right, however, demands precision, given that opting for a cloud solution doesn’t eliminate risk in and of itself. These systems may still leave organisations vulnerable through misconfigured buckets, exposed remote desktop services and viruses that can slip into a network and inadvertently get uploaded to the cloud as part of a backup process.

The golden copy

For healthcare organisations seeking to raise their resilience against ransomware attacks in 2022 and beyond, cloud solution providers like Wasabi offer a variety of tools that can bolster defences. Dubbed hot cloud storage with immutability for data protection, Wasabi provides a secure, high-performing, air-gapped and immutable data protection system that’s almost impossible to penetrate.

Consistently and securely backing up applications, configurations and data is the cornerstone of ransomware mitigation, and there’s very little the health sector can do but pay the ransom in the event of an attack without a secure, offsite backup. Immutability, which can be achieved through a Wasabi storage bucket, is essential in ensuring any backup created cannot be tampered with. This means that any data written to the bucket can’t be deleted or manipulated through its storage lifetime. Other benefits include preventing encryption by crypto ransomware, while aiding compliance with a swathe of regulations.

It’s also essential that any ransomware-mitigation solution that healthcare IT deploys is cost-effective, given the need to prioritise expenditure on the front line. The cloud, moreover, is the most feasible in terms of storing data in a secure location off-site. The low cost involved in acquiring Wasabi’s hot cloud storage service, for example, offsets the licensing costs of the backup and recovery tools, reducing the overall cost and improving the expected return on investment dramatically.

Fighting ransomware, particularly for a sector as vulnerable as healthcare, requires engaging in a process of improving and enhancing the technology at your disposal on a continuous basis. It’s also a matter of when, and not if, you’ll suffer a cyber attack. In today’s environment, mitigating ransomware means investing in modern infrastructure and cloud-enabled backup systems that can offer secure and immutable storage. This ensures hospitals can always fall back on a golden copy that’s impossible to tamper with, so there’s no payout to cyber gangs, and patients can continue getting the treatment they need.

Learn more about Wasabi’s hot storage and immutable backups services

Nine in ten web applications used by US healthcare operators are highly susceptible to attack or vulnerability exposure, according to a new report.

The 2021 Web Application Security for Healthcare report, published by IT security firm Outpost24, found that most US healthcare providers (90%) had an external attack surface score of above 30 (out of 58.4). This score was categorized by the firm as ‘critically exposed’, indicating a high susceptibility for security and vulnerability exposure.

The report also found that US healthcare organizations had a larger attack surface with an average risk exposure score of 40.5 when compared to EU pharmaceutical organizations, which had a score of 32.79.

This is despite US healthcare providers running 30% fewer external web applications compared to the top ten largest EU pharma manufacturers, which had 20,394 apps.

The top ten US healthcare organizations ran 6,069 web applications over 2,197 domains, with 3% of these regarded as suspicious. The report said these could be test environments that should be closed, since they are open to hackers. It was also found that 24% of these applications were running on old components containing exploitable vulnerabilities.

The report said that it was important that healthcare security teams get a handle on their application security to reduce the risk of ransomware and other malware from both known and unknown applications.

“With security resources feeling the strain and having a multitude of elements to manage including hybrid working from the pandemic, it's challenging to identify all web services on the Internet containing old components. We identified 19.5% of all US and EU applications analyzed use old components, increasing the security exposure from known vulnerabilities which has a knock-on effect on security hygiene,” the report’s authors said.

Although the report found that EU healthcare applications were more up to date than those run by US organizations, the number of live applications was 236% higher.

“This reveals the different weaknesses in their attack surface - with EU organizations having a much larger attack surface, possibly a result of shadow IT; and US organizations being more at risk of potential exploits from vulnerable software components,” the authors stated.

Nicolas Renard, a security researcher at Outpost24, said it was essential that healthcare organizations carry out the necessary due diligence to continuously evaluate their internet security perimeter given the highly sensitive information stored.

“Any kind of data breach and downtime for healthcare organizations can be fatal, therefore they must take a proactive stance to identify and mitigate potential security issues before critical care can be impacted,” he added.

The Cybersecurity and Infrastructure Security Agency (CISA) has warned that flaws in the Philips Tasy electronic medical records (EMR) system could be exploited by hackers to steal confidential patient data from medical databases.

In a security advisory, CISA said successful exploitation of these vulnerabilities “could result in patients' confidential data being exposed or extracted from Tasy's database, give unauthorized access, or create a denial-of-service condition.”

The issue affects the Philips Healthcare Tasy Electronic Medical Record (EMR) product Tasy EMR HTML5 3.06.1803 and prior. There are two flaws, CVE-2021-39375 and CVE-2021-39376.

The first flaw may enable a successful SQL injection attack that could result in patient data exposure and extraction.

According to MITRE’s Common Weakness Enumeration (CWE) on this fault, “without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. This can be used to alter query logic to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands.”

The second flaw also allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter.

“SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes,” the advisory warned.

It should be noted that to take advantage of the flaws, a hacker must have credentials that allow them into the system in the first place.

"At this time, Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem," Philips said in an advisory. "Philips' analysis has shown that it is unlikely that this vulnerability would impact clinical use. Philips' analysis also indicates there is no expectation of patient hazard due to this issue."

To mitigate the problem, Philips recommended users update Tasy EMR HTML5 to Version 3.06.1804 or later with the latest available service pack where both CVEs are remediated.

The future of artificial intelligence (AI) in medicine is in Cambridge – and it’s superfast. Nvidia has unveiled Cambridge-1, the most powerful supercomputer in the UK and among the top 50 globally, installed during the pandemic at a cost of $100 million (£73 million) to the GPU giant.

The aim isn’t just to sweeten Nvidia’s acquisition of British chipmaker ARM, but to show off its DGX SuperPOD scalable computing setup for AI – and help power the future of medicine. “Cambridge-1 will empower world-leading researchers in business and academia with the ability to perform their life’s work on the UK’s most powerful supercomputer, unlocking clues to disease and treatments at a scale and speed previously impossible in the UK,” said Jen-Hsun Huang, CEO of Nvidia, at the launch of the new supercomputer.

“The discoveries developed on Cambridge-1 will take shape in the UK, but the impact will be global, driving groundbreaking research that has the potential to benefit millions around the world.”

Cambridge-1 is named in honour of the city where genomics and computing got its start, but it’s also where Nvidia plans to base its UK HQ. “Cambridge-1, and our purchase of ARM, is our giant investment in the UK, giving us a platform to work with the amazing universities, companies, and over 1,000 AI startups in this community,” said Huang.

Scalable supercomputing

With eight petaflops of Linpack performance, Cambridge-1 is the UK’s fastest supercomputer, just pipping the previous leader run by the Met Office. How has Nvidia, more famous for its gaming GPUs, achieved this feat? The answer lies two decades in the past, when researchers struggling with machine learning started trialling Nvidia’s hardware for their AI projects, sparking a boom in AI that continues today. Nvidia has since started developing custom hardware for AI tasks, including the Ampere processor at the core of Cambridge-1.

The key building block is Nvidia’s AI-system-in-a-box, the DGX. It features eight A100 Ampere GPUs as AI accelerators, alongside a 128-core AMD CPU, and includes networking and storage as well as AI software and models. The idea is that an organisation can easily scale its AI efforts by plugging together multiple DGX modules; the SuperPOD upon which Cambridge-1 is based stacks 80 together in one package, for a supercomputer in a box.

What’s intriguing about Cambridge-1 is that it’s the first Nvidia supercomputer that’s been made available for use outside of the company itself. The chipmaker has previously built supercomputers for its own uses, such as developing new GPU technology, but the Cambridge-1 is the first created for outside partners.

The Cambridge-1 isn’t actually in Cambridge, however. To enable the supercomputer to be powered by renewable energy, it’s situated at green hosting provider Kao Data’s location in Harlow, Essex.

Future of medicine

AI is increasingly assisting medicine in myriad ways, from scanning images to spot symptoms of cancer to sifting through data to identify patterns that can guide research into diseases such as dementia. It also develops models to help create new drugs. However, ethics and safety concerns mean development must be done carefully.

Right now, there are “two core problems”, said Sebastien Ourselin, head of the School of Biomedical Engineering and Imaging Sciences at King’s College London. One is access to data, and the other is access to the computing power needed to process it.

On the first problem, industry and the NHS need to work closely together to increase accessibility to relevant data, an area that’s been fraught in the UK because of privacy concerns. Ourselin noted that it’s key to ensure that AI is developed using unbiased datasets that represent the demographics of the local population. Otherwise, it won’t work for everyone.

The second problem is a growing one. The latest AI systems can do incredible things thanks to ever-more sophisticated models and massive datasets. But they demand a lot more computing resources than older, simpler systems. “The power of your computer limits you,” said Lindsay Edwards, vice president of data science and AI, respiratory and immunology, biopharmaceuticals R&D at AstraZeneca. “If it takes you three weeks to train a model, your ability to hone that model is really difficult – you need to be able to iterate quickly.”

Hence the eagerness of medical organisations to have a go on Cambridge-1. Access to this supercomputer could spark a leap forward in advanced medical modelling, finally allowing faster breakthroughs in drugs, genomics and understanding of diseases.

The first projects to access Cambridge-1 include drug discovery and medical imaging with AstraZeneca, genetics and health predictions with GSK and genomic sequencing with Oxford Nanopore Technologies. It will also generate synthetic brain images for King’s College London and Guy’s and St Thomas’ NHS Foundation Trust to power research into dementia, strokes, cancer and multiple sclerosis.

“Some of the first projects slated for the supercomputer are using AI to sequence genomics, discover novel drugs, and to unlock the mysteries of dementia by studying MRI scans,” said Huang.

AstraZeneca and drug discovery

AstraZeneca has had plenty of attention lately thanks to its production of the Oxford-developed COVID-19 vaccine, which was being jabbed into arms less than a year after the pandemic hit – and AstraZeneca is hoping that Cambridge-1 will accelerate future drug decvelopment. The pharmaceutical giant is using a new transformer-based neural network architecture to predict reactions to drugs and optimise the development process. It’s a pioneering approach because the network will effectively train itself: just as a natural language processing AI will learn the basic rules of language by “reading” as much text as possible, this system is aiming to learn the rules of chemistry, Edwards explained.

AstraZeneca is also running a trial looking at digital medical images, hoping to apply a trained algorithm to annotate images of tissue samples, while also looking for anything that could signal a drug reaction. “One of the challenges with digital pathology is that the images are huge. The files are incredibly large,” Edwards said. “What we’ve done in the past is break those files up and train models on those – but that comes with a whole host of problems. Computation on the scale of Cambridge-1 allows us to do whole-slide image processing, which is really transformational.”

Genetics, GSK and Oxford Nanopore

Elsewhere, GSK and Oxford Nanopore are both working on genetics and genomics projects, in the hopes of better understanding disease and potential treatments. GSK is using AI to better understand biology using genetic evidence, to not only develop drugs more quickly but also better understand when and how to use treatments. “We know that medicines which have genomic evidence behind them are twice as likely to succeed and result in successful medicines for patients,” said , Steve Crossan, VP for AI and machine learning at GSK.

Oxford Nanopore meanwhile is using Cambridge-1 to run a model originally developed for speech recognition, to examine biological markers that aren’t yet well understood. “There’s an enormous amount of work that goes into not just accelerating understanding what those markers are, and how you call them and how you get them working reproducibly, but how they impact health,” said Sinclair Dokos. The hope, she added, is that access to Cambridge-1 will let Oxford Nanopore speed up its algorithm development, leading to more accurate genomic analysis.

Brain scans for research

King’s College London and Guy’s and St Thomas’ NHS Foundation Trust are working to better understand brain diseases such as dementia, stroke, multiple sclerosis and cancer, with the aim of speeding up diagnosis and improving treatment. The model will be trained on tens of thousands MRI scans to teach it how to simulate brain images with features such as age or disease, giving researchers more material to work with.

“By generating so many images, you can create a situation where you are absolutely certain that you have all the possibilities of how a brain will look if it’s healthy,” explained Ourselin. “But what you could do as well is start to generate the same amount of data for a specific disease, and then start to understand the progression of the disease.”

These are only the initial projects: the aim is for Cambridge-1 to push British AI-based medical research to the forefront. “Cambridge-1 [allows us] to try things out that we couldn’t try before,” said Edwards. It could even help develop the field of personalised medicine, according to Ourselin: “By comparing in-depth information of a specific patient with the entirety of the population, and 20 years or 30 years of data, we will be able to do better precision medicine,” he said.

Nadine Hachach-Haram, clinical innovation lead at Guys and St Thomas’, predicts that finding new drugs and treatments will unquestionably change the pharmaceutical industry. But there’s more: “The even more exciting thing for me is reimagining healthcare where we’re bringing together cutting-edge life sciences innovation and compute power, to ultimately enable us to do what we’re all here trying to do: deliver the best care to our patients.”

The National Institutes of Health's (NIH) National Center for Advancing Translational Sciences (NCATS) has contracted Palantir to create a cloud-based data enclave to support COVID-19 research collaborations.

The new contract benefits the National COVID Cohort Collaborative (N3C) and is an indefinite-delivery indefinite-quantity (IDIQ) arrangement with a total potential value of $59.5 million over two years.

N3C has accelerated patient research and advanced COVID-19 knowledge since the beginning of the pandemic, studying topics as varied as treatment inequities and long-term consequences.

To aid N3C’s research, Palantir launched its new software in 2020, ensuring a secure platform for integrating and analyzing COVID-19 data while providing controlled access to internal and external collaborators.

Together, N3C Data Enclave and Palantir’s software facilitate cross-institutional research teams exploring rich data sets, including populations most vulnerable to COVID-19. Under the NIH RECOVER Initiative, the N3C will also study post-acute sequelae from COVID-19 (PASC), commonly referred to as long COVID.

“We are very excited to continue our work with NCATS and the research community to support this critical resource in the fight against COVID-19 as well as to study long COVID and potentially other diseases that pose major public health challenges,” said Akash Jain, Palantir USG president.

Jain added: “Palantir was founded to put the most innovative software to work solving the world’s most pressing challenges, and working to empower scientific research, especially when it comes to helping the most vulnerable, fits squarely within our mission.”

Additionally, NCATS awarded Palantir a separate contract to use its software to accelerate cancer research at the National Cancer Institute (NCI) and help with efforts to support the President's Emergency Plan for AIDS Relief (PEPFAR). Originally valued at $36 million per year, this contract has been extended for an additional year, totaling $60 million.

Allurion Technologies has extended its Virtual Care Suite to include a remote patient monitoring service.

Designed exclusively for weight loss practitioners, Allurion Insights includes automated weight-loss monitoring, analytics, and instant text/video communications to simplify remote care.

The tool is available to Allurion partner clinics for follow-up with patients after an Allurion Balloon (swallowable gastric pill) placement procedure.

“High-quality follow-up care is critical to achieving lifelong weight loss, and Allurion is committed to offering our providers the digital services they need to efficiently deliver care,” said Jeff Feldgoise, head of digital product at Allurion Technologies.

Feldgoise added, “Allurion Insights is an easy-to-use and powerful digital solution that is tightly integrated with all of the other components in the Allurion Virtual Care Suite. We have designed Allurion Insights specifically for weight-loss providers, tailoring it for their needs.”

Furthermore, Allurion Insights allows health care providers to access patient information collected via the Allurion App, Connected Scale, and Health Tracker. Using real-time messaging, dieticians can instantly communicate and share files with their patients.

A private yet secure video consult feature helps medical professionals communicate with geographically distant patients. Allurion Insights also includes notes, a lightweight digital medical record that allows clinicians to streamline patient care.

Allurion App, Connected Scale, Health Tracker, and Allurion Insights provide a comprehensive set of software and hardware for weight loss.

“With the launch of Allurion Insights, we have taken the Allurion Program to the next level,” said Shantanu Gaur, co-founder and CEO of Allurion Technologies.

“Between the best-in-class results of the Allurion Balloon and our expanding digital health capabilities, the Allurion Program has become the most complete weight loss solution on the market.”

Sensome has begun human trials for its artificial intelligence (AI)-powered stroke guidewire at the Gold Coast University Hospital (GCUH).

The trial will evaluate the safety and efficacy of the Sensome’s Clotild Smart Guidewire system in acute ischemic stroke patients.

CLOT OUT is Sesome’s first-in-human, multicenter trial earmarked for leading stroke centers across Australia, Belgium, and France. The GCUH trial adds to this initiative.

Replacing invasive medical procedures, Sensome’s Clotild Smart Guidewire system pairs impedance-based tissue sensors with machine learning algorithms to provide physicians with valuable insights into the clot.

The AI-powered system recently gained FDA approval to aid in treating or diagnosing life-threatening and irreversibly debilitating diseases and conditions.

“Endovascular thrombectomy is no longer just about removing the clot. To get the best result for your patient, you need to get the clot out with complete revascularization the first time,” explains Dr. Hal Rice, director of interventional neuroradiology at GCUH.

Rice added, “The Clotild guidewire is the first device that promises to provide live real-time information during the intervention that can help increase our chances to choose the right interventional approach from the get-go.”

According to reports, Sensome aims to enroll up to 100 patients in its CLOT OUT study. Data from preliminary cases will be presented at this year's LINNC conference in Paris and at SLICE Worldwide, an online interactive stroke event.

“Evidence has been mounting over the past few years that factors like the biological clot composition should be considered when choosing the fastest method to remove a clot. The CLOT OUT trial aims to demonstrate that using Clotild in humans is safe and can detect clot composition,” stated Dr. Andrew Cheung, co-coordinating investigator of the study at Liverpool Hospital.

Medigate and CrowdStrike have joined forces to provide integrated endpoint security for Internet of Things (IoT) medical devices.

With more and more medical devices entering hospital networks, health care delivery organizations (HDOs) face the difficult challenge of ensuring visibility into every connected device or terminal.

Medigate and CrowdStrike aim to solve this problem by offering HDOs a consolidated view of threat activity across connected devices.

As part of the partnership, CrowdStrike will integrate its Falcon software with Medigate’s device security platform, allowing HDOs to manage risk outcomes, detect anomalies, and enhance response capabilities.

Falcon by CrowdStrike monitors and safeguards functions and applications installed on all managed endpoint devices and workloads. Medigate device security platform (MDSP) offers critical insights into clinical protocols, communications, and workflows in a network.

The integration will allow MDSP to incorporate Falcon’s telemetry into its passive network monitoring. In addition to providing a 360-degree view of the environment, the combined solution will enable HDOs to monitor their managed and unmanaged endpoints for signs of intrusion and block them from becoming successful.

“We have seen a significant number of cyber attacks and ransomware against hospitals over the past year and this number will only increase in the future. A hospital should focus on patient care, rather than seeking to respond to external threats, ” said Matthew Polly, vice president of worldwide alliances, channels, and business development at CrowdStrike.

“Medigate's unique interest in the healthcare IoT industry is very effective in helping to reduce the fields of attack. With CrowdStrike and Medigate, HDOs can accurately see, detect, respond and prevent attacks across the IT and clinical landscape to safeguard their operations and data - including patient information. "

Yext has announced an intelligent search solution to assist health care organizations with pre-appointment patient engagement.

Powered by artificial intelligence (AI), Find-a-Doc by Yext helps patients identify the right physician for their medical needs on a health care organization's website.

Unlike conventional search tools, Find-a-Doc features a comprehensive health care taxonomy encompassing patient and clinical search terms. Additionally, the platform leverages advanced natural language processing (NLP) to interpret patients’ queries.

Upon matching a query to the taxonomy, Find-a-Doc populates a list of relevant medical practitioners. Results also include intuitive prompts for making an appointment or finding directions.

Yext's search tool also comes with an integrated insights tracker. The feature helps organizations discover trends in patient requests, measure cost savings from virtual support, and track click-to-conversion rates.

"Today, more patients than ever are evaluating options for healthcare online, but far too often, healthcare organizations make it unnecessarily difficult for them to identify the right doctor for their needs," explained Carrie Liken, head of industry for health care at Yext.

Liken continued, "Yext's Find-a-Doc offers an intelligent solution, helping organizations unify all of the information about their providers in one search experience. Our goal is to make browsing and selecting providers a seamless experience for patients who are ready to convert."

IHA, a Michigan-based multispecialty medical group, saw its online appointment conversions increase by 400% after implementing Yext's Find-a-Doc solution.

“IHA made the switch to Yext's natural language search from a search that was comprised of blue links only with no opportunities for conversion, often sending visitors down a rabbit hole to find what they were looking for," said Meghan Brescia, brand strategy manager at IHA.

"Yext has given us much more intel to our queries than we had in the past. We identified query trends and prioritized creating some topical FAQs with conversion opportunities," added Brescia.

If you run a large, US-based non-health-care or -education company with revenue exceeding $100 million, then you will likely find yourself a victim of a ransomware attack.

These organizations are the most likely ransomware victims, according to a new report by cyber security firm Kela.

Kela searched dark web forums for hackers wanting to buy access to organizations. It found 48 active threads where hackers claimed they wanted to buy different kinds of accesses. Of those hackers, 40% were involved in ransomware in some way or another.

Victoria Kivilevich, a threat intelligence analyst at Kela, said ransomware attackers appear to form “industry standards” defining an ideal victim based on its revenue and geography and excluding specific sectors and countries from the targets list.

One of the hackers’ most basic requirements was network access such as RDP and VPN. The most common products mentioned were Citrix, Palo Alto Networks, VMware, Fortinet, and Cisco, according to Kivilevich.

She said that, on average, the actors active in July 2021 wanted to buy access to US companies with revenues exceeding $100 million. Almost half of them refused to buy access to companies in health care and education.

She added that the US was the most popular choice of hackers regarding victim location, as 47% of the actors mentioned it. Other top locations included Canada (37%), Australia (37%), and European countries (31%).

“Most of the advertisements included a call for multiple countries. The reason behind this geographical focus is that actors choose the wealthiest companies which are expected to be located in the biggest and the most developed countries,” she said.

The research found that the average minimum revenue ransomware attackers wanted was $100 million, but some stated the desired revenue depended on the location.

“For example, one of the actors described the following formula: revenue should be more than $5 million for US victims, more than $20 million for European victims, and more than $40 million for “the third world” countries,” said Kivilevich.

Almost half of ransomware-related threads included a blacklist of sectors, meaning the actors are not ready to buy access to companies from specific industries. 7% of ransomware attackers refused to buy access to companies from the health care and education industries. 37% prohibited compromising the government sector, and 26% claimed they would not purchase non-profit organizations access.

“When actors prohibit healthcare or non-profit industries offers, it is more likely due to the moral code of the actors. When the education sector is off the table, the reason is the same or the fact that education victims simply cannot afford to pay much,” she said.

“Finally, when actors refuse to target government companies, it is a precaution measure and an attempt to avoid unwanted attention from law enforcement.”

Unsurprisingly, Russian-speaking countries are off-limits for ransomware hackers, the research found.

“The actors based in CIS suppose that if they will not target these countries, local authorities will not hunt them,” she said.

NeuPath has signed a Memorandum of Understanding (MoU) with Cynergi to assess the efficacy of the company's virtual reality (VR) program for chronic pain management.

“Chronic pain is the leading cause of disability worldwide. Studies estimate the cost of this lost productivity to be in excess of $300 billion per year in the US alone,” said Harbir Singh, Cynergi CEO.

Singh added: “Collaborating with NeuPath and building a holistic chronic pain targeted treatment program provides an outstanding opportunity to work with employers and other payers to improve patient quality of life while also reducing disability-related costs as well as other direct health care costs.”

Per the new deal, Cynergi’s Rilaxta VRx will be used alongside NeuPath’s remote pain management and virtual care platform across Canada and the US.

Adding VR software to traditional interventions can provide extensive benefits in behavioral pain management.

Cynergi’s proprietary virtual reality tools pair soothing images and sound with proven psychological techniques to reduce anxiety and panic. Developed by renowned Harvard psychiatrist Arshya Vahabzadeh, Cynergi’s VR program also includes guided therapy for benzodiazepine, alcohol, and opioid addiction.

NeuPath’s centers for pain management provide multimodal treatments for patients with chronic pain. Together, Cynergi and NeuPath aim to offer customized VR treatment plans for psychological and behavioral pain.

Earlier this month, NeuPath acquired virtual care platform KumoCare. Designed to reduce wait times, KumoCare enables secure video chat with medical practitioners.

Beeline is teaming up with Sechenov Medical University to rapidly diagnose diseases and conditions in traumatology and histology.

Beeline is a subsidiary of telecommunications firm VEON. Per reports, the Sechenov-Beeline partnership will pioneer the use of neural network and pattern-matching algorithms for early detection of kidney disease, hip joint damage, and potentially cancerous cells.

In addition, the contract stipulates the use of Beeline's artificial intelligence (AI) technology, Lisa Alert. Beeline developed Lisa Alert as part of an initiative to locate and rescue missing people in Russia. Lisa Alert employs a comprehensive algorithm suite to track individuals using drone imagery. Medics at Moscow’s Sechenov Medical University will now have access to the same AI technology.

"Medicine is a new and very interesting area of research in terms of information technology," explains George Held, group director of digital operations at VEON.

Held added, "In cooperation with Sechenov University, we plan to create breakthrough products based on artificial intelligence and big data analytics that will enable medical professionals to speed up diagnoses and facilitate their work. We truly believe that our cooperation will contribute to saving lives and halt the development of critical diseases."

Specifically, Beeline and Sechenov Medical University will develop AI software and data analytics to facilitate the early diagnosis of trauma and histologic conditions.

For example, in traumatology, AI can help detect hip conditions at an earlier stage, thereby improving non-surgical outcomes. Additionally, AI analytics will help physicians identify pathologies, such as synovitis, cartilage lesions, and anomalies in subchondral structures. AI will also assist in the classification of histological sections obtained from kidney and intestinal biopsies.

"The technology developed by mobile operators now spans far beyond connectivity and embraces applications that help individuals live longer healthier lives," explains Aleksandr Torbakhov, Beeline CEO.

"The use of Beeline's AI technology in medical diagnosis demonstrates the contribution that mobile operators can make in this vital field, and we are proud to be part of this initiative with Sechenov Medical University."

The Sechenov-Beeline’s novel pattern recognition technology is also slated for use in oncology to help predict the likelihood of kidney cancer.

The healthcare sector is under a great deal of pressure right now, but while the pandemic has been a challenging time, it’s also led to an explosion in the adoption of digital healthcare tools. IT transformation is having a profound effect on the industry, as new technologies are revolutionising not just how care is delivered, but also how clinicians can track and even predict potential problems.

In this episode of the IT Pro Podcast, we talk to Diana Kennedy, CTO of global healthcare provider Bupa, about how the organisation is using a combination of data analysis, modern cloud architectures and API ecosystems to deliver personalised healthcare to its customers, and what recent technological developments could mean for the future of the industry.

Highlights

“When we think about personalised health care, we think about… moving from standardised procedures, interventions, outcomes as a result of a standard manifestation of a condition, to capturing and aggregating data from an individual to predict outcomes and prevent them through interventions. And then to personalise the ongoing care.”

“I think our readiness to adopt and use digital services is grounded in what is now our new experiences in interacting with practitioners, be that GP or physio, or whatever it might be. And I think that that explosion has been beyond anyone's wildest dreams, really, but is now enabling more. So I think, certainly in Bupa, as we start to think about our digital services, we're thinking way beyond GP, we're thinking diagnostics, vital signs diagnostic and critical care from your own home. And the great thing, and I think one of the reasons why adoption has been so good, is that it's super convenient.”

Read the full transcript here.

Footnotes

• How to personalise data while tip-toeing through the data protection minefield
• Salesforce enhances cloud-based health care offering
• Almost half of workers would share health data with their employer
• The IT Pro Podcast: Technology in healthcare
• Change Healthcare unveils its cloud-native medical imaging solution
• The IT Pro Podcast: Supercharging healthcare with data
• How technology is changing health care
• Microsoft launches public cloud service for health care
• Amazon launches big data service focused on health care
• IT Pro Live: From iPhones to healthcare in the middle of a crisis
• How NHS Bedfordshire is building a paperless hospital
• Health care organizations are unprepared for cloud migration
• The API economy: What your business needs to know
• Open APIs to fuel next-stages of NHS digitisation
• The IT Pro Podcast: Why data warehousing doesn’t work

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘The future of personalised healthcare’. To listen to the full episode, click here.

Adam Shepherd

Hi, I'm Adam Shepherd, and you're listening to the IT Pro Podcast, where today we're talking about healthcare transformation. Efficient medical care has never been more important than it is right now. And healthcare organisations across the globe have been striving to make themselves more agile and more flexible in an effort to better support their patients and staff. For Bupa, a key element of these efforts is an ongoing drive to leverage data driven insights in cloud platforms, building an infrastructure that can deliver personalised care to patients. Joining us today to discuss the technology that is enabling this is Bupa CTO, Diana Kennedy. Diana, thanks for coming on the show.

Diana Kennedy

Thank you, Adam. It's great to be here.

Adam

So for those who may not be familiar, can you give us a brief overview of what Bupa's IT estate looks like?

Diana

Oh, for sure. Yeah. So I suppose Bupa is, you're probably not necessarily aware, we're a very large global company. So operating across 17 countries with possibly 50 plus businesses. And an IT estate to match. So we've grown through acquisition. And many of those geographies operate in a certain level of loose coupling from the, from the mothership, if you will. So you name a technology and we have it, I'd say, but predominantly, from a platform point of view, we have a dual cloud strategy. So primary with Microsoft Azure, secondary with Google Cloud Platform, specifically for advanced analytics and data. We're a Microsoft collaboration shop too, so we use Microsoft Teams, Power BI, et cetera. And then we have a large landscape of many thousands of applications supporting our healthcare ecosystem, in geographies where the combination of insurance and provision is different. So you're probably familiar in the UK of Bupa as predominantly an insurance company. And that's, that's, that's true in the UK. In other geographies, it's quite different. So for in Spain, for example, it's a very integrated insurance through to provision we have a large number of hospitals and clinics in Spain. Similarly, in Australia, we have the health insurance part of the business but also have a large number of opticians and dental provision and aged care as well. So yeah, very interesting and diverse healthcare portfolio across the globe.

Adam

I'd imagine that's a challenge at times to manage, particularly with the spread of very specialised kind of technology platforms and applications that need to be integrated as part of that.

Diana

Yes, absolutely. But I think what's super interesting about this sector now, is increasingly cloud technologies are democratising that and enabling the standardisation. And the evolution of platform ecosystems that for the first time are enabling global healthcare provision is, is what makes this interesting. So absolutely, we have a legacy to die for really, from mainframes in Australia through to architectures running on Oracle 10 in, in the UK and others, and everything else in between. But you know, the combination of cloud, microservice architectures, API integration, you know, is really unlocking the value of all these things in a way that you just simply wasn't possible before. And then we're a big ServiceNow user. So service management and IT for IT comes through a ServiceNow backbone that enables us to align on CMDB and our IT assets globally. So we're getting better at it, I'd say.

Adam

So, speaking of which, talk us through your platform-based approach to digital healthcare.

Diana

I joined Bupa back in January, having spent a number of years at BP in leading on digital transformation there. I joined this sector to bring a lot of that learning and knowledge and experience from the energy sector, but also because, because of the enormous vitality and relevance of digital and technology to this sector, in an industry which is in relative to others pretty late to digitise; certainly on the scale and of course, COVID-19 has without doubt accelerated that, hasn't it.

Adam

Yeah, and in terms of kind of times to join a healthcare business and kind of bring that digitisation and transformation to it, you know, you can't, you couldn't pick a better time than, you know, the start of this year with everything going on and the massive need for that kind of transformation. But what what's interesting is kind of you mentioned bringing some of your learnings from the energy sector to healthcare. And I think that's, that's a pairing that most people wouldn't necessarily think of. So what to you stands out as the main kind of, the main learnings and synergies that you can transfer from one to the other?

Diana

So a really great question, and probably more, more commonality than you might imagine. So healthcare, certainly in Bupa, is relatively late to the cloud. The oil and gas sector, and certainly the super majors, you know, are five, six years into their public cloud journey, if not longer. And you know, the value of hyperscale cloud, for cost efficiency, agility, pace, and modern application architectures that enable time to market and great customer experiences are so much more possible in the cloud than anywhere else. So a real focus on accelerating our journey to the cloud, using our transformation, but also the pivot of datacenter exit, datacenter lease terms, etc, as the as the sort of terminator to, to drive the urgency around that. So cloud is very definitely one. And I brought the experience of my large scale cloud migrations, but also application transformations to cloud native services. And that's a big part of our story here at Bupa now too, is that journey to the cloud and the value generation from the cloud. The second - and I describe these things as the digital foundations, if you will, of a large scale transformation, the scale of which we're in - the second is integration, and taking an API first approach to application integration and application architecture. And that's something too that is relatively nascent and new in, certainly in Bupa, but across the sector. There has of course been a lot of work done on data interoperability with the fire standards, etc. but bringing that to life into real tangible solutions and outcomes for our customers is the hard thing and, and API marketplaces, API brokers is a part of that ecosystem. And then thirdly, design systems. So you know, huge focus in, in healthcare and in Bupa right now is that seamless experience for our customers when you consume digital services. And as we increasingly seek digital options for our own healthcare, be that in the wellness space, or be that in the prevention space, or be that in the acute care through, increasingly, diabetes support and other conditions. And you know, real investment in human experience design, capability, mindset methodology, and the design system to support that. So I'd call those three things out, really, as the, as the big foundations of what we're doing here at Bupa. But those that I've really sort of brought from the adjacent energy industry.

Adam

So you mentioned cloud as a kind of key driver of what you're trying to do with this kind of platform based strategy. What was it in particular that attracted you to Microsoft's cloud ecosystem? Because you're heavily invested in kind of Microsoft, in particular, kind of across the across the stack. Was there anything that especially drew you to Microsoft?

Diana

A really great question. I, I would say that I joined in January and into an existing cloud relationship with Microsoft. At BP, we were a dual cloud shop with Microsoft and AWS. I've personally had a very strong relationship with Microsoft, and Amazon, and now, now Google and I think, you know, at a base level, it's great to have competition. The features and functionalities are broadly similar, but with with emerging capabilities, so I can't say that I chose Microsoft because of the functions and features but now, now, we're investing more significantly with them in the Azure space, the benefit of integration, the benefit of the platform services that come with Azure, and then specifically, the investments in ML studio, advanced analytics, seamlessly from your production and operational systems into your data platforms is, is great. It's a, it's very definitely a valuable feature from, from Azure. But having said that I think having a hybrid mix is right for most organisations, having a bit of commercial tension, of course, but also being able to deploy workloads to the, to the, to the place of best fit and the place of where there are more, perhaps more advanced features at that time as the hyperscalers leapfrog each other from one place to the other. I'm a big fan of Microsoft.

Adam

Yeah, most of the healthcare organisations - certainly that we've spoken to - tend to favour Microsoft in terms of their cloud deployments, which is largely a factor of the the existing relationships that these organisations have with with Microsoft, you know, they're already running Exchange servers, and Active Directory and Windows throughout all of their kind of, you know, client devices and like end user devices and whatnot. So it's a kind of fairly natural extension to broaden that relationship out into a, into a cloud environment, when you're you're looking at those kinds of projects. But in terms of kind of the healthcare industry, specifically, that's something that Microsoft has made some, you know, concerted efforts to try and actively support in terms of its cloud portfolio. Have you found that those initiatives have been particularly helpful?

Diana

Yeah, and I think all the hyperscalers have, haven't they? They all have their sort of health, health cloud equivalent. Absolutely. I mean, we, you know, we're investing heavily in Azure, and GCP. But in in Azure to take advantage of those features, in order to take advantage of industry standard data models, pre built templates, and automation. And the acceleration that gives us that that is aligned with our interoperability ambitions, through the fire standards, etc. So yeah, I mean, fantastic investment from those companies. So that at the sort of core platform level. And then we're, we're working with Microsoft at the the other end in the innovation space, with their startup community and others looking at really fantastic cutting edge solutions in the IoT domain to support aged care provision, for example, using motion detection to detect falls, for example, checking hydration, and some really, you know, fantastically impactful solutions through the out of the box capability that you get with edge compute. And then, and then you know, looking to invest in the data space, in running analysis and developing models in the genomics and proteomics space to drive much better view around predictive outcomes, and evidence based analysis of where we're using digital medical devices. And, and testing the value of those, the efficacy of those against more traditional solutions so that we can deliver the best outcome to our customers or patients. So yeah, some super interesting stuff, and the billions of dollars of investment that hyperscale cloud providers are putting in is, is massively beneficial to the planet, as well as us as individuals.

Adam

So talk us through some of these data led initiatives that you mentioned, what kind of benefits from a kind of patient perspective, if you like, from an outcomes perspective, are you expecting to see from these projects?

Diana

Yeah, so when we think about our digital transformation, we think of it across three fronts, we think of it in terms of optimising and improving process, in order to improve the customer experience, removing manual repeatable tasks, removing paper from the process, creating an integrated pathway whether you engage with Bupa as a, from a wellness point of view or in aged care or somewhere in between. And really going after digitising and automating those core processes. Then the use of advanced analytics and AI, and these are the pieces I talked about just now where we're using our scaled datasets to drive a predictive model, predictive models on the use of both our existing care provision and new. And really, in doing that, driving much more personalised care. And I think that's where the real transformation in in healthcare is happening is, is from standardised clinic, hospital based care through to personalised care. And using historical datasets, breadth of datasets across a number of interventions to to understand outcomes, how to improve those outcomes and how to personalise them. So lots in that space, which is super interesting. And then finally, the platform business models, so creating digital services for our customers. So in Spain, we've launched a really rich telemedicine offering which offers video consultation with the consultant, offers primary care with a GP via video consultation, offers wellness services, offers vital signs diagnostic using fantastic AI service, all available via mobile phone in a really slick and seamless interface. So these are the sorts of things that we're going after. But all all in service of becoming the, in our new chief executives words, the most customer centric healthcare company in the world. So really focused on those hyper personalised outcomes, evidence-led, great, great experience, be that digitally or in person, underpinned by super rich data science and data analytics.

Adam

So looking at personalised healthcare, this is something that we've heard more organisations talking about over the last couple of years, but I feel like it's still a bit of an alien concept to most people, particularly in the UK where the NHS is, let's say not exactly on the cutting edge of personalised health care and those kinds of developments. What does personalised healthcare mean to you? What does it look like from Bupa's perspective?

Diana

Yes, so, fantastic question. So when we think about personalised health care, we think about to my point earlier moving from standardised procedures, interventions, outcomes as a result of a standard manifestation of a condition to capturing and aggregating data from an individual to predict outcomes and prevent them through interventions. And then to personalise the ongoing care. And that shows up in two main ways. Firstly, this pivot almost, if you think of it as a data model shift from clinic, hospital, and all your your data assets aggregated around this physical asset of the hospital, to the data model being focused on the individual. And, and all of the care provision around that. And that shows up to us in the use of genomics, proteomics, so using genomic sequencing to identify propensity for conditions and intervening ahead of time. And I think that, to me, is one of the biggest shifts in the sector that is now possible that will allow us to really tackle this enormous explosion in health, health care provision and requirement for for care as we, as the population grows and as people live longer. And then secondly, proteomics. So using protein sequencing to predict outcomes as a result of human behaviours. So where you can actually take a personal intervention to improve your outcome be that your sugar intake, be that your diet, be that your exercise regime, and be able to predict forward outcomes and prevent them from happening. Those are the two big super exciting opportunities to drive that really hyper personalised care. And then, as an insurance company using more personalised algorithms and using analytics to develop behavioural economics, I think it's often called, where we can drive the cost of outcomes based on behaviour, and make you make make that available to individuals. So those are those are two main ways.

Adam

Yeah, that's a really interesting area, this idea of kind of almost predictive medicine. It relies by the sounds of it quite intensely on data and gathering data and making sure that data can flow efficiently from one system to the other, you know, healthcare systems, one of the main complaints that we've heard about legacy healthcare systems in particular is that they tend to be very siloed and very cut off from each other. How are you optimising your infrastructure to support the use of data in these kinds of new ways across the business?

Diana

Yes, I can't deny that that's a challenge. Of course it is. And we've developed a global data reference architecture, which has within it standards for tools, platforms, and reference architectures around models. So a common information model, a common approach to security and privacy, a common approach to data management. But that doesn't mean that we're building a single integrated global data platform across all of our geographies - we're not - but we are standardising on the local implementation of those and that makes life an awful lot easier. It means that we can share models, we can share expertise across different geographies. And we can run champion challenger tests across different platforms, and various other things. It isn't, you know, the cloud, of course, absolutely enables that and early investment in the cloud is a is a massive benefit. And back to my point earlier, the API led approach to developing services to be able to access those monolithic systems is really reaping dividends for us to avoid for more traditional, you having to merge and funge datasets and all of that horrible matching, which is impossible to get right. Haven't we all done that and regretted it forever? Yeah, so I think, yeah, modern technologies, modern, modern application architectures and capabilities are really helping.

Adam

And I would imagine, taking that API led approach allows you to democratise access to that data across a wider range of teams and departments and whatnot, then if every kind of request if you like, every kind of project that needs data, lead insights, if it has to go through a central kind of data management team, that's always harder to manage, and kind of always more likely to introduce bottlenecks. We were talking to Richard Spiegal from Nationwide on a previous episode about this very problem. And they've turned to kind of a federated model, if you like, where they've got kind of smaller satellite data teams that are kind of spreading, spreading the gospel of data, if you like, throughout the business, and they found that very helpful for democratising the, not just the access to data, but also the engagement with it.

Diana

I love that idea. Actually, I might steal that from Nationwide. Yeah, definitely. Yeah. So I mean, it's about matching the capabilities to the problem, I think. And that's one of the the the approaches that we're taking, but also the benefit of a loosely coupled architecture and micro microservices, increasingly serverless architecture enables you to do which is just brilliant. You have to have the culture shift and mindset and operating model shift to enable that. Yeah, you're going through all of that too, of course. Yeah, definitely.

Adam

Of course. And it's often a challenge for I think healthcare organisations or I should say, the NHS in particular. It's often a challenge from what we hear, to adopt these newer technologies, particularly things like you know, containers or serverless architectures, you know, these kind of much more cutting edge methodologies that are maybe a bit more reliant on organisational flexibility, which public sector organisations, of course don't always have, but those that have adopted it universally sing their praises for just the sheer agility, that it that it gives them in terms of iterating on their, their models and their development processes and just delivering those outcomes and a faster way.

Diana

Yeah, absolutely. And I think if you've not seen that, you probably don't believe it, it's almost, if you've been in a world of legacy and more traditional architectures, I think you haven't understood the value that actually these things really, really are possible now. Which is one of the fantastic things about people like me, coming from different industries, and having lived this world for a number of years. Actually, you know, bringing that to life for people is amazing, because the outcomes are so much quicker, of course. And it's so much more fun to be part of.

Adam

Yeah, I can imagine. So speaking of adoption, do you think that COVID-19 has accelerated the development and adoption of digital healthcare tools and processes? I mean, we, we spoke earlier on in the episode about kind of the the need for transformation, particularly in light of the pandemic. But do you think it's kind of enabled a lot more of these kind of cultural shifts that you've mentioned?

Diana

Absolutely. 100%, yes. And in an extraordinary way, I think, beyond anything anyone would have ever imagined. In our Spanish business, we were able to deliver 70% of consultation appointments, consultant appointments, virtually during during 2020. Yeah. And that's, that's gone up to - I believe these numbers are correct - about 30% or more here in the UK, is something that, and now the default of, you know, GP consultations being virtual. And that was just something that was just not even conceived 18 months ago.

Adam

Absolutely unthinkable.

Diana

Yeah, yeah, exactly, for lots of reasons, for clinical reasons, for that personal engagement reason, and inertia and lack of technology. And that's the new normal. So I think our readiness to adopt and use digital services is grounded in what is now our new experiences in interacting with with practitioners, be that GP or physio, or whatever it might be. And, and I think that that explosion has been beyond anyone's wildest dreams, really, but is now enabling more. So I think, certainly in Bupa, as we start to think about our sort of digital services, we're thinking way beyond GP, we're thinking diagnostics, vital signs diagnostic and critical care from your own home. And, and the great thing, and I think one of the reasons why adoption has been so good is that it's super convenient. The aggro of having to jump in your car, get a bus or public transport to a hospital, and you hang around and wait forever and it is super inconvenient. Whereas if you can do that from the comfort of your own home, and now a lot of the investment in clinical devices to make those for personal use, or at least for use in your own home. Again, it's that convenience factor. So if you can, you can have your your renal care in your own home, if you can you do your diabetes diagnostics at home, if you can... There's so many so many things. Cancer care now, chemotherapy delivered to your home. It's a perfect combination of convenience and more seamless experience. So I think it's definitely here to stay without doubt, and expect to see more. And I love this, it plays back into this sort of personalised care thing. It allows clinicians to, to, to be able to think of you as an individual as opposed to someone else on their list to get through in the clinic today.

Adam

So I think one of the biggest challenges in healthcare is, or certainly prior to 18 months ago, was the fact that the inconvenience frankly of most kind of healthcare processes from a patient point of view, just put up huge kind of barriers to people so you know, the the rigmarole of getting an appointment at your GP you know, you have to call in a certain, often very small, window, the appointment might not be for several weeks after that, and then you've got to go down and wait. And all these barriers, I think a lot of people unless it was something, you know, obviously serious, would just say, ah do you know what, I can't be bothered, it's probably fine. And then there's just the these slew of, you know, potential warning signs and contraindications that just don't get picked up on because people aren't in regular contact with practitioners and healthcare professionals. And the more you can remove those barriers and make it more convenient for people to access healthcare professionals, and for healthcare professionals to access them, and to access kind of diagnostic information, whether that's from wearables, or in home devices, or whatever, I think the more potential issues you can catch earlier.

Diana

indeed. And back to that perfect storm, it's, it's, there's only upside for everybody, you know, the technology that that we love, and are really motivated by really making a difference and being able to really just transform this industry and the experience for good.

Adam

So what is the future of healthcare look like, from your perspective, over the next five years?

Diana

Wow, my goodness, what an amazing question. So I'm a little bit of a rookie, as you know, so I'm sort of six months into this industry. So I guess I can give you my point of view, and you can take it with the...

Adam

Always helpful to have a fresh perspective.

Diana

Yeah. So it is clearly digital. It's hyper personalised. It's data driven. It's sensor enabled. And it's preventative rather than prescriptive. And I think those five characteristics are the things that will define the future of healthcare. And all of that is underpinned by the technologies that we've discussed. And I think, perhaps I'd add a sixth one, is that the other dimension that digital does, of course, is to democratise access. So access to healthcare services, for geographies, for communities, for individuals who previously either had no access at all, or simply was unaffordable. And that's the other thing I love about the future that I'm personally incredibly optimistic about is our ability to tackle some of the world's most complex challenges like the COVID 19 pandemic. Our response to that has now created a legacy that will really, is reinventing healthcare for the future, to be more personalised, to be more data driven, to be more accessible, and to be more global.

Adam

Well, I'm afraid that's all we've got time for in this week's episode. But thanks once again, Diana, for joining me.

Diana

Thank you very much. It's great to be here and great to spend time with you.

Adam

You can find links to all of the topics we've spoken about today. in the show notes, and even more on our website, itpro.co.uk. You can also follow us on Twitter at @ITPro as well as Facebook and LinkedIn. And don't forget to subscribe to the IT Pro Podcast wherever you find podcasts. If you're enjoying the show, leave us a rating and a review. And we'll be back next week with more analysis from the world of IT. But until then, goodbye.

GE Healthcare will leverage VMware’s software-defined wide-area networking (SD-WAN) to enable faster, safer, and more convenient virtual care.

For its cloud-hosted applications, GE Healthcare offers OnWatch Network Edge. The platform allows for fully automated monitoring of critical subsystems within medical imaging, including CT scanners, MRI, and mammography machines. Should there be any deviation in equipment performances, OnWatch will send an alert, enabling proactive repairs.

By integrating VMware’s SD-WAN technology into OnWatch Network Edge, GE Healthcare will empower organizations to sync latency-sensitive data with the cloud and between edge locations without compromising security or quality of service.

“GE Healthcare offers a suite of precision healthcare applications that are both on-premises and cloud-based. OnWatch Network Edge provides an easy way to deploy these large-scale integrations quickly and more securely. VMware’s SD-WAN technology enables reliable deployment of latency-sensitive and data-intensive applications,” said Paul Jones, global product manager at GE Healthcare.

When a WAN link fails, VMware SD-WAN can identify and prioritize traffic for over 3,000 applications. Intrinsic safety features, including stateful firewalls, virtual network functions (VNFs), and configurable business policies, direct traffic to the designated cloud or data center.

VMware SD-WAN is available as part of VMware secure access service edge (SASE), which combines cloud networking and security in a comprehensive, standalone platform.

GE Healthcare previously integrated VMware's AIOps solution and Edge Network Intelligence with its OnWatch Network Performance software to help health care providers track their enterprise and clinical networks.

“Patient monitoring and diagnostic data analysis are moving from the datacenter to the edge. With this shift, healthcare providers and their technology partners require a software-defined, high-performing, secure network,” said Sanjay Uppal, senior vice president and general manager of service provider and edge at VMware.

Uppal added, “VMware SD-WAN provides this network overlay to prioritize and move high-fidelity, latency-sensitive data to the cloud and between edge locations. Leveraging VMware SD-WAN enables GE Healthcare to offer rapid, more securely deployed, and easily accessed virtual care solutions.”

Salesforce has expanded Health Cloud, its cloud-based service for health care organizations, with several new features targeting remote patient management and data protection.

The company has added four enhancements to Health Cloud. The first addition, remote patient exception monitoring, harvests data from connected health care devices and presents it in a single dashboard interface targeting care coordinators.

Metrics displayable in the dashboard include heart rate and blood glucose levels. This will enable health care workers to better understand patient conditions without needing physical visits, Salesforce said.

Salesforce's new appointment management feature suggests remote and in-person appointment times for patients. Users can select available appointment types and times via any device, and the system can also offer pre-appointment questionnaires to help gather the necessary data ahead of the appointment.

The cloud service provider says this will reduce no-shows and administrative costs incurred through manual back and forth with human schedulers.

The third new feature, medication management, tackles the management of medication lists. Many clinics still use manual, paper-based systems to track patient medication, making it difficult to monitor medication adherence, Salesforce said.

Targeting pharmacies, small clinics, and retail outlets, medication management will reduce the administrative overhead of tracking patient medication lists. The service will also integrate with RXNorm, a system that standardizes naming conventions for generic and brand name drugs in the US.

The final enhancement focuses on regulatory compliance and helps in-home patient care companies protect patients' health information. Salesforce is certifying Salesforce Maps, B2C Commerce, and Order Management services as compliant with the US government's HIPAA health care privacy regulations.

This certification gives mobile health care workers access to sensitive patient data on the move via Salesforce Maps while staying compliant with regulations, the company said. It also enables companies, including retail health locations and pharmacies, to set up e-commerce stores dealing with sensitive patient orders via HIPAA support in Salesforce B2C Commerce and Salesforce Order Management.

Change Healthcare has announced its new cloud-native software as a service (SaaS) solution for radiology practitioners.

Dubbed picture archiving and communication system (PACS), the new solution offers advanced image analysis for CT and MRI scans. PACS also helps radiologists build custom workflows to manage communications and resolve interruptions.

The application adds to Change Healthcare’s Stratus Imaging cloud solution suite.PACS, which is currently in beta testing, will be extended to hospitals in the future.

“We have worked with Change Healthcare for years and are excited to be development partners for their zero-footprint PACS,” said Eric Lacy, director of clinical applications at Central Illinois Radiology Associates (CIRA).

“The speed of the viewer and the rich feature set struck me as truly game-changing from the moment I first saw it. I am truly looking forward to what the solution can do for CIRA, our partners, and our patients.”

Change Healthcare also announced plans to consolidate its cloud-native enterprise imaging solutions under the category name Change Healthcare Stratus Imaging.

Exclusively designed for medical imaging, Change Healthcare’s Anatomical AI algorithm, which it recently earned FDA approval for, accurately outlines body parts via image pixels, eliminating the barriers posed by inaccurate or incomplete metadata.

The algorithm is currently available as an on-premises solution through Change Healthcare Radiology Solutions, and will be installed in Stratus Imaging's cloud-based solution suite in future releases.

“The move of medical imaging to the cloud and the use of AI to help improve clinical outcomes is inevitable and accelerating. We’re thrilled to be bringing a feature-rich, highly secure, zero-footprint cloud-native PACS and our natively built AI solutions to market,” said Tracy Byers, senior vice president and general manager of enterprise imaging at Change Healthcare.

“We remain focused on delivering cutting-edge, innovative imaging solutions that allow our customers to accelerate their digital transformation with confidence and immediately realize benefits that will continue to evolve for providers and patients over time.”

Peraton and the Department of Veterans Affairs (VA) have signed a new contract, extending their long-standing partnership.

Per the new deal, Peraton will help VA develop an enterprise-scale infrastructure-as-a-managed-service (laaMS), connecting VA’s on-premise infrastructure with VA Enterprise Cloud (VAEC).

IaaMS will host up to 220 petabytes of mission-critical VA data, ranging from business operations data to medical images used in veteran care. IaaMS will also enable VA to establish a centralized service delivery model that eliminates application-specific infrastructure silos, integrates cloud-based storage capabilities, and adopts industry-best storage practices.

According to the VA, its upcoming IaaMS solution will aid storage and computing facilities in the US and abroad.

"Peraton is proud to build on our 20-year history as one of VA's technology partners. This award demonstrates Peraton's unique capabilities in health data management and storage, and deep understanding of VA's mission. Our innovative laaMS solution simplifies infrastructure consumption into an easy-to-use managed service, enabling enterprise-level transparency across clouds and facilities," Tarik Reyes, president of global health and financial solutions sector at Peraton.

Peraton will provide the VA with its services for seven years. The contract will encompass up to 300 VA sites across the continental US and abroad.

"Peraton is uniquely positioned to deliver next-generation storage capability and services to the VA and the veterans who have proudly served our country," said George Rollins, vice president of VA and defense health at Peraton.

"This is an incredible win for the team. We look forward to our continued partnership with the VA, and to helping the Department realize the expected benefits from its major modernization initiatives."

Qlarity Imaging and Blackford have signed a new pact to improve breast magnetic resonance imaging (MRI) accuracy.

QuantX by Qlarity Imaging differentiates benign from malignant breast lesions by synthesizing 34 radiomic features into a single value. The QuantX Score, derived from analysis of proven lesions, indicates the likelihood of malignancy in a specimen. The FDA-cleared artificial intelligence (AI) also assists radiologists with volumetric and surface area measurements.

Per the new deal, Qlarity will integrate its AI diagnostic software with Blackford’s centralized imaging platform to help radiologists and health care systems achieve better clinical outcomes.

The Qlarity-Blackford partnership is also geared toward reducing breast MRI deployment time, costs, maintenance, monitoring, and support requirements.

"Breast MRI evaluations are one of the more difficult exams for radiologists. Factoring in the current challenges contributing to widespread radiologist burnout, the question is not if technological advancements are needed, but how they can be developed and implemented to add the most value," said Jon DeVries, Qlarity Imaging CEO.

DeVries added, "Partnering with Blackford will help radiologists and their teams overcome current workflow, budget, and productivity challenges, while also providing unique opportunities for innovation with partners to improve the quality of breast cancer screening and diagnosis strategies."

Commenting on its tool’s scope, Qlarity stated QuantX is designed for screening patients at high risk for breast abnormalities. QuantX's clinical trials that earned it FDA approval found it reduced missed cancers by 39% and increased clinical accuracy by 20%.

QuantX is not intended for the primary interpretation of digital mammograms.

"We are delighted that Qlarity's QuantX™ will be available through Blackford's curated marketplace of applications. We look forward to working with Qlarity to provide our customers and channel partners with simplified access to QuantX™ through our dedicated platform, to help drive additional clinical value for patients," said Ben Panter, Blackford Analysis CEO.

Nine critical vulnerabilities in a popular hospital pneumatic tube software could enable hackers to take control of systems and launch a range of attacks.

Researchers at security platform provider Armis unearthed the flaws and dubbed them PwnedPiper. They found the vulnerabilities in the Nexus Control Panel, which powers all current models of Translogic’s pneumatic tube system (PTS) stations by Swisslog Healthcare.

This technology is a critical piece of health care infrastructure used in more than 3,000 hospitals worldwide. The tubes deliver medication, blood, and lab samples across multiple departments of a hospital.

Researchers noted the tube systems are connected to the internet but "despite the prevalence of these systems, and the reliance of hospitals on their availability to deliver care, the security of these systems has never been thoroughly analyzed or researched."

According to researchers, these flaws could let hackers take over PTS stations and gain full control over the target hospital’s tube network. In turn, an attacker could launch a denial-of-service on critical infrastructure or man-in-the-middle attacks, resulting in deliberate sabotage of the hospital’s workings.

"Understanding that patient care depends not only on medical devices, but also on the operational infrastructure of a hospital is an important milestone to securing healthcare environments," said Nadir Izrael, co-founder and CTO at Armis.

Five of the vulnerabilities in PwnedPiper allow remote code execution, which hackers could use to access a hospital network and then take over Nexus stations.

By compromising a Nexus station, an attacker can carry out reconnaissance, including harvesting data from the station, such as RFID credentials of any employee who uses the PTS system, details about each station’s functions or location, and the physical layout of the PTS network.

From there, hackers can take over all Nexus stations in the tube network and possibly launch a ransomware attack.

Armis said it disclosed the vulnerabilities to Swisslog in early May and has been working with the manufacturer to test the available patch and ensure proper security measures will be provided to customers. Swisslog Healthcare has released a security advisory today.

Researchers said while such an attack may ultimately be remediated with manual firmware upgrades of all compromised stations, such a process will take considerable time and effort.

“Hospitals don’t necessarily have any contingency in place to handle a prolonged shutdown of the PTS system, which ultimately may translate to harm to patient care,” said researchers.

Unilabs and Ibex are teaming up to make cancer diagnosis more accurate, timely, and targeted.

Per the new deal, Unilabs will deploy Ibex’s AI-powered, multi-tissue Galen platform in pathology labs across Europe. Backed by advanced machine learning algorithms, the platform evaluates tissue biopsies in real time to offer valuable insights on tumor grading and size.

Other notable features of the Galen include worklists for case prioritization and cancer heatmaps for increased diagnostic accuracy.

"This cutting-edge AI technology will help our teams quickly prioritise urgent cases, speed up diagnosis, and improve quality by adding an extra set of digital eyes," said Dr. Christian Rebhan, chief medical and operations officer at Unilabs.

Rebhan continued, "When it comes to cancer, the earlier you catch it, the better the prognosis – so getting us critical results faster will help save lives. The partnership with Ibex underlines Unilabs' pioneering role in digital pathology and represents yet another step in our ambition to become the most digitally enabled provider of diagnostic services in Europe."

Galen by Ibex is CE-marked for breast and prostate cancer detection. Unilabs will roll out Ibex's platform to 16 countries, starting with Sweden.

"Ibex is transforming cancer diagnosis with innovative AI solutions across the diagnostic pathway," said Joseph Mossel, chief executive officer (CEO) and co-founder of Ibex Medical Analytics.

"We are excited to partner with Unilabs to deploy our AI solutions and empower their pathologists with faster turnaround times and quality diagnosis. This cooperation follows a thorough evaluation of our technology at Unilabs, and demonstrates the robustness and utility of our platform for everyday clinical practice."

The worldwide medical telepresence robots market is expected to increase to $159.5 million by 2028, according to a new analyst report.

Published by Grand View Research, the report said the market is projected to expand at a compound annual growth rate (CAGR) of 18.5% from 2021 to 2028. The growing adoption of telepresence robots in the health care sector and product innovations catering to the increasing demand have contributed to this growth.

The report also said that with an increasingly elderly population with chronic illnesses requiring regular monitoring, demand for such robots in home situations will only grow.

The telepresence robot market experienced solid growth during the COVID-19 pandemic because of increasing deployments of such devices in hospitals worldwide.

The report cited one example in the Yatharth Hospital in Noida, which deployed Mitra robots to help health care providers deliver care with telepresence technology.

In another example, the Providence Regional Medical Center in Everett, Washington used the InTouch Health Robot Vici to aid the virtual presence and communication between doctors and patients.

The report added that features enabling two-way communication and connecting from any location to monitor patients remotely further boost the demand for medical telepresence robots.

The report said several companies are breaking into the market, offering technologically advanced robots, introducing new features catering to the current demand, and bolstering R&D efforts. These factors also boost the adoption of medical telepresence robots.

The report added that most governments worldwide were taking initiatives to support artificial intelligence and robotics, attracting new entrants to enter the market.

In 2020, North America dominated the market with a revenue share of over 40%, thanks to the higher adoption of artificial intelligence and robotics in the health care sector and the increasing number of players in the region. In addition, the rise in disposable income, the growing geriatric population, and the increasing prevalence of chronic illnesses are expected to support the demand for medical telepresence robots.

The report found that last year, hospitals and assisted living facilities held the largest share of the medical telepresence robots market at over 70%. However, the home use telepresence robot segment is set to increase at the highest CAGR of 19.5% over the forecast period due to the increase in the geriatric population, rise in the number of patients with chronic illnesses needing regular monitoring, and the availability of some affordable telepresence robots in the market.

Mobile robots dominated the market with a revenue share of over 65% in 2020 and are expected to witness the fastest growth over the forecast period.

Analysts said this growth was because of features such as autonomous navigation, adjustable height, head motion, and obstacle avoidance that enable smooth and efficient delivery of services and virtual monitoring, thereby facilitating effective teleconsultation.

AWS has made its cloud-based health care data lake solution, Amazon HealthLake, generally available to customers, enabling health care organizations to pull medical information from different sources into a single environment and use it to improve patient care.

With the solution, the tech giant wants to end the enormous spread of medical data across various applications and other systems.

Various patient medical information, such as clinical notes, lab results, and insurance information, is often housed in separate databases. This makes it extremely difficult for health care professionals to get a complete overview of a patient’s information. Moreover, collecting this information takes a lot of time.

With HealthLake, this could be a thing of the past, as it merges all patient data into a single data repository. In concrete terms, the solution offers a collection of connectors that automatically import records from commonly used health applications. When these records are in the data repository, algorithms based on natural language processing ensure the data is organized. This makes it easier to work with, according to AWS.

The algorithms scan medical documentation, such as clinical notes, and extract patient information. Then, Amazon HealthLake indexes this information and offers it as search pages in a search engine, adapting the raw data into easily searchable data. The ultimate result is doctors can search patient information faster than manually scrolling through all the information.

Additionally, Amazon HealthLake makes it possible to move the combined patient data to other systems for further processing. For this purpose, the data is stored in the industry-standard FHIR. The moving process takes place with a separate API that AWS provides in its Amazon product.

AWS also aims to provide added services to health care customers within the solution. This includes providing artificial intelligence (AI) services to improve patient care. AI can automate tasks, such as making medical diagnoses and planning treatment trajectories. AI can also provide general recommendations.

The underlying infrastructure of the Amazon HealthLake solution is fully managed by AWS. IT specialists from health care institutions only need to create a new data store. This data store is fully operational within minutes, the tech giant indicates. AWS handles the management, configuration and setup of the underlying infrastructure.

“More and more of our customers in the healthcare and life sciences space are looking to organize and make sense of their reams of data, but are finding this process challenging and cumbersome,” said Swami Sivasubramanian, vice president of Amazon Machine Learning for AWS.

“We built Amazon HealthLake to remove this heavy lifting for healthcare organizations so they can transform health data in the cloud in minutes and begin analyzing that information securely at scale. Alongside AWS for Health, we’re excited about how Amazon HealthLake can help medical providers, health insurers, and pharmaceutical companies provide patients and populations with data-driven, personalized, and predictive care.”

Oncotech‌ ‌Nordic‌ ‌AB has developed a mobile cancer diagnosis tool that can spot precancerous symptoms and underlying cancer-related diseases.

Dubbed Ophtascan, the real-time screening and detection system can also identify all four stages of cancer and targeted oncological diseases in the human body.

"By simply using their own smartphone devices, users can photograph their iris, and upload the image to Oncotech's server," said Oncotech.

Oncotech's artificial intelligence-powered diagnostic and deep learning system then sends the results back to the user. All of this happens in under 25 seconds.

"People will be able to self-diagnose for pre-cancerous and targeted existing cancerous conditions via a smartphone in-real time. The process is quick, on demand, cost effective - and does not overload the public health care diagnostic system unnecessarily, hence eliminating patient cancer screening waiting lists," explained Andre Rafnsson, Oncotech CEO.

Ophtascan can screen for lung cancer, liver cancer, breast cancer, uterine cancer, and prostate cancer in its current version.

Ophtascan was validated last year following tests on 800 oncology patients over three years. The tool's scanning precision hit a reported 96% success rate. Rafnsson anticipates reaching a 98-99% precision scanning rate by the third quarter of 2021.

Furthermore, a new study is underway to determine whether Ophtascan tests can provide early warning signs for Type 2 diabetes.

"Our patent is now pending for the software and design algorithms. We have diligently started discussions with several telemedicine and remote health diagnostic business partners in Europe, North America and Asia with a view to license the Ophtascan™ technology," added Rafnsson.

"Technically advanced businesses can see the potential impact of this breakthrough in increased positive medical outcomes for patients. Many factors determine cancer survival rate, and early detection is one of the most significant determinants. Ophtascan ™ is precise, quick, well documented and is highly cost-effective."

Google Cloud has expanded its Intelligent Vaccine Impact solutions (IVIs) platform to ensure equitable access to COVID-19 vaccines.

The expanded IVIs platform now includes a Contact Center AI (CCAI) with intelligent virtual agents that understand and offer real-time responses to customers' vaccine queries 24/7. Customers can use various methods to contact an agent, including chat, text, web, mobile, and phone.

Through a secure web channel, CCAI’s virtual agents can also direct users to local resources, answer questions, and provide assistance at each step of the process, including registration, eligibility, locating vaccination sites, and appointment scheduling process. Furthermore, callers can alter their appointment time or date over the phone instead of logging into a website.

“This technology is especially important in reaching those with limited technology proficiency; those without access to a computer, a smartphone, or the internet; and those who are non-native speakers, as CCAI supports up to 28 languages and dialects,” comments Mike Daniels, vice president of global public sector at Google Cloud.

Built on Google Cloud’s industry-leading Conversational AI, CCAI also offers protection against fraud and threats. Most notably, virtual agents within the CCAI platform allow public health agencies to automatically update their responses in real-time for rapidly changing questions related to vaccine eligibility.

For instance, CCAI has helped New York’s state government deliver real-time answers to New Yorkers’ most pressing concerns about the safety and efficacy of vaccines. A 25% reduction in incoming calls was achieved via the CCAI program, as constituents used virtual agents to obtain information and answers. This allowed the call center personnel to devote themselves to more unique questions and cases.

“The virtual agents will not replace human agents, but will provide a menu of interactive options. AI assisted call centers can expedite the delivery of information, triage calls and streamline the final resolution based on the needs of the individual. To accommodate the diverse New York population, the State also provided enhanced options by enabling the virtual agents to understand and respond in Spanish, with plans to add more languages soon,” added Google.

Varian has announced it’s collaborating with Google Cloud to develop an advanced artificial intelligence (AI)-based diagnostic platform for cancer patients.

Often viewed as a crucial and laborious step, organ segmentation in radiation oncology can constrict treatment workflow.

The Varian-Google partnership intends to address this problem by using neural architecture search (NAS) technology via the Google Cloud AI Platform to determine which organs and tissues in diagnostic images must be targeted or protected during a course of radiation therapy.

Additionally, Varian will leverage Google’s NAS technology to create an AI segmentation engine that generates customized auto-segmentation models for the body’s organs. Medical professionals can use the segmented images to design treatment plans that detail where and how much radiation they’ll deposit during treatment.

The AI models for organ segmentation will be trained using Varian’s proprietary treatment planning image data. According to reports, Varian intends to incorporate these models in its treatment planning software tools for use by cancer centers worldwide.

"At Varian, we are working towards a world without fear of cancer, where high-quality cancer care—personalized and optimized for each patient—is available everywhere,” said Corey Zankowski, senior vice president of technology and innovation office at Varian.

Zankowski continued, “To that end, we have committed ourselves to Intelligent Cancer Care, which seeks to automate routine or repetitive tasks in the radiation oncology workflow through the use of smart algorithms, machine learning, and AI. This collaboration with Google Cloud will turbocharge our efforts in this area."

A fully managed and end-to-end platform for data science, Google’s AI platform also features a built-in data-labeling service that’s ideal for classification, object detection, entity extraction, and more.

"At Google Cloud, we believe AI technology has the power to impact a wide variety of industries, which is especially true in the field of medicine," comments Craig Wiley, director of product management at Google Cloud.

"We are excited to see how Varian accelerates AI innovation and segmentation quality to improve cancer care with radiation therapy using our state-of-the-art NAS technology. As Varian's AI platform of choice, our teams are working closely to deliver best-in-class AI for cancer treatment to patients around the world."

IBM is teaming up with one of the most prestigious hospitals in the US to bring quantum technology to the field of medical research in order to derive deep insight from complex data at the heart of the biggest health care challenges.

The computing giant has signed a 10-year partnership with the Cleveland Clinic, a world-class nonprofit research hospital. They’re joining forces to use quantum computing to analyze massive amounts of data, intent on making discoveries in fields such as genomics and medications. They’re calling it the Discovery Accelerator.

“Through this innovative collaboration, we have a unique opportunity to bring the future to life,” said Tom Mihaljevic, CEO and president of Cleveland Clinic. “These new computing technologies can help revolutionize discovery in the life sciences. The Discovery Accelerator will enable our renowned teams to build a forward-looking digital infrastructure and help transform medicine, while training the workforce of the future and potentially growing our economy.”

As part of the collaboration, IBM will install a new quantum computer on the Cleveland Clinic’s campus. IBM also plans to install the first of its next-generation 1,000+ qubit quantum systems at a client facility, also to be located in Cleveland, in the coming years.

IBM says quantum computing could have an immense impact on key health care challenges, such as discovering new molecules that can serve as the basis of new pharmaceutical breakthroughs.

IBM keeps hitting quantum computing milestones. The company has built 28 quantum computers in the last four years - eight of them developed in 2020 alone.

The company has successfully doubled its quantum volume for three years running. Quantum volume measures the length and complexity of circuits. The higher the volume, the higher the potential for exploring solutions to real-world problems across industry, government, and research.

The Discovery Accelerator will leverage IBM’s multi-year roadmap for advancing quantum computing, bringing its revolutionary capabilities into the hands of scientists and practitioners in health care and life sciences. In addition to an on-premises quantum system, Cleveland Clinic will also have access to IBM’s fleet of currently more than 20 quantum systems, accessible via the cloud.

“The COVID-19 pandemic has spawned one of the greatest races in the history of scientific discovery – one that demands unprecedented agility and speed,” said Arvind Krishna, chairman and CEO of IBM. “At the same time, science is experiencing a change of its own – with high performance computing, hybrid cloud, data, AI, and quantum computing, being used in new ways to break through long-standing bottlenecks in scientific discovery.”

Chicago-based CNA Financial, one of the country’s largest insurance providers, has been hit by a cyber attack that’s left its website out of action and many network systems disrupted.

The insurance firm is the sixth-largest in the US and offers an extensive range of products, including policies against cyber attacks.

On March 21, the firm revealed it sustained a sophisticated cyber security attack.

“The attack caused a network disruption and impacted certain CNA systems, including corporate email,” the company statement read.

“Upon learning of the incident, we immediately engaged a team of third-party forensic experts to investigate and determine the full scope of this incident, which is ongoing. We have alerted law enforcement and will be cooperating with them as they conduct their own investigation.”

It added that it disconnected systems from its network, “out of an abundance of caution,” notified employees, and provided workarounds where possible to ensure they can continue operating.

“The security of our data and that of our insureds ’and other stakeholders is of the utmost importance to us. Should we determine that this incident impacted our insureds’ or policyholders’ data, we’ll notify those parties directly,” said the company.

CNA has also set up several email addresses to keep in contact with policyholders.

According to The Insurer, a publication serving the insurance industry, CNA’s network may be out of commission for a while, with the attack mainly impacting the underwriting and claims side of its business.

According to a tweet by Joshua Motta, CEO of security firm Coalition, there are rumors that the incident could be a ransomware attack. He added this could be a “nightmare scenario if cyber insurance policyholder data [is] compromised.”

Such data could give hackers information on how much money insurers could payout if a policyholder is attacked in the future. That would mean a hacker has more leverage over a victim, as they know how much money the insurer would pay out as a ransom. Such data could allow hackers to prioritize victims with larger or more comprehensive insurance policies.

CNA hasn’t yet revealed any further details of the attack or any lost or stolen data.

For years, organisations have dreamed of the paperless office. IT managers fantasise about doing away with the racks of filing cabinets and storage boxes containing hard copies of contracts, purchase orders, financial statements and other business ephemera. Truly eliminating paper from an organisation’s workloads can be a daunting – and often impossible – task, but the benefits of document digitisation in terms of productivity, security and collaboration are well established.

For healthcare organisations, these benefits can be even more pronounced; hospitals and doctors’ surgeries are notorious for their somewhat anachronistic reliance on physical forms and documents, and even the slightest efficiency gains can have life-saving results for patients. Sadly, the healthcare sector also tends to have more difficulty than most when it comes to transformation projects. Budgets have little wiggle room for new ventures, and any new system must meet stringent regulatory requirements.

In order to help address these difficulties and start working towards the utopian vision of a paperless facility, Bedfordshire Hospital NHS Trust has been working with Xerox to roll out a three-pronged system designed to cut down its paper usage and increase the level of digitisation throughout its campus.

The centrepiece of the project is MediViewer – an electronic document management system for handling patient records, which Xerox is managing on the Trust’s behalf. This is complemented by an on-campus scan centre to digitise paper documents, as well as a system providing electronic access to scanned data.

Like most healthcare organisations, the Trust’s main priority is providing clinicians with fast and accurate data to support the diagnosis and treatment of patients, and the inefficiency of analogue workflows was a key driver behind its desire to implement a more modern system, according to Josh Chandler, associate director of IT for the Trust.

“There are some inherent issues that exist when you have paper, which I think many healthcare providers have just grown accustomed to dealing with,” he says. “Generally, I find paper generates more paper. And so we need a way of digitising the historical records, but also creating a mechanism to stem the flow of the creation of more paper.”

Data security was also a key concern. Physical documents can be lost, tampered with or destroyed, which not only impedes the efficient delivery of care but also runs the risk of sensitive and highly protected medical data falling into the wrong hands. Digital medical records, he says, can be protected much more easily and comprehensively.

“I won't say it’s impossible, but it’s a lot harder to simply lose digital information,” he says; “certainly a lot harder than it is to lose a piece of paper within a medical record.”

A scanner quickly

One of the main factors in the hospital’s decision to go with Xerox for the delivery of the system was that the company was seen as a safe pair of hands, thanks to the fact that it had previously rolled out similar systems for other NHS organisations. One of these was Luton and Dunstable hospital, which Bedfordshire NHS Trust merged with in April last year, and Chandler’s team consulted with colleagues both there and at Worcestershire Acute Hospitals NHS Trust prior to making the decision.

Another advantage he cites was the fact that Xerox provided an end-to-end managed service, rather than a standalone software package, but Chandler is also quick to point out that the MediViewer software itself ticked all of the Trust’s main boxes as well.

“It provided us with all of the flexibility, from a technological point of view, that we wanted; provision of integration with other systems and adherence to standards that are relevant now. But also the dynamic nature of their development team worked for us with what we were aiming to achieve in the coming years. The functionality met our requirements, and ease of use was a key component of that.”

Since starting the rollout in September last year, the system has been deployed across six departments within the hospital, including paediatrics, gynaecology and diabetes. More than 16,500 patient records have been scanned, and Chandler says benefits are already being seen by Trust staff. The ability to access digital records from a wider variety of locations has allowed clinicians to conduct more remote consultations, making it easier to care for patients while mitigating the spread of COVID, and the system has also reduced logistical pressures within the hospital itself.

“Normally speaking, there was an area within the paediatric service with benching on the side,” Chandler explains, “and it was always completely taken up with patient notes that had been tracked in for that day's clinics. That's now all completely empty, because it's all accessible through a computer.”

Administrative staff throughout the Trust have also reported that not having to order, organise and physically transport vast reams of paper records and notes has given them more time to focus on other tasks. It’s even made their shifts less painful in a literal sense, as Chandler reveals.

“We had nurses carrying around reams and reams of notes,” he says, “and actually, that's not a benefit that we foresaw, but it's been mentioned by a few clinical staff; not having to carry around notes – and often heavy notes – has really helped them in their day-to-day.”

As with any new technology, the rollout of this system hasn’t been entirely without challenges; one particular bugbear that Chandler highlights is integrating MediViewer with some of the Trust’s legacy IT systems, which may not support newer standards. He was also keen, he said, to make the process of scanning existing records as efficient as possible, while also making sure that the results remained accessible for staff.

“That was one of the lessons learned that was shared with us from one of the previous trusts we had engaged with, because the indexing of their records was causing them significant problems,” he says. “They wanted to limit the amount of cost and time coming from the scanning process, but it meant that clinicians were often dealing with a huge, long PDF that they have to scroll through and they can't really search.”

In order to avoid this, the Trust is making use of optical character recognition (OCR) technology as part of the scanning process, to help with categorising pages into sections and index them in the system. This makes it easier for clinicians to navigate the system, and also prevents delays and bottlenecks at the scanning bureau – although Chandler jokes that “there's no technology on the market that can read the writing of a doctor; there's very few doctors that can read the handwriting of doctors!”

Pushing at an open door

In many digital transformation projects, user education and adoption can be as much of a challenge as technical integration, but according to Chandler, the Trust has been actively anticipating the rollout of the new system, with staff looking forward to going live with it.

“Often in organisations like our own, of the complexity and size that we are, that end user buy-in is sometimes very difficult to achieve,” he explains. “But actually, I think that Bedford as a site was in some ways behind the curve, and it really did give many of the clinicians an appetite for digitisation and the strategy that we were adopting.

“This has meant in most areas we've gone live with, we've been pushing against an open door, which has been great, but it would be remiss of me not to reflect that as a challenge that's experienced for most projects like this.”

The Trust is about a quarter of the way through rolling out MediViewer across its estate, he says, and expects it to be live across all key systems by the end of September, barring any major COVID-related disruptions. This will be followed by moving to an on-demand scanning model driven by the new scan centre, but after that, the Trust has further ambitions.

The next step in its plan is hooking MediViewer up to its electronic patient record systems, allowing it to capture more data that can be used to generate further insights and reporting. Chandler says he wants to get away from what he calls ‘flat’ data and integrate the hospital’s systems with data streams from across the wider healthcare community to help build a more holistic picture of regional trends.

In addition, he says he’s looking to expand clinicians’ ability to access the new system remotely, as well as examining how to integrate it with Luton and Dunstable’s systems to create a cross-site solution for the entire Trust.

“I think this forms a basis for much of the work that we're now going to be doing, simply by virtue of the fact that it presents all of that historical information that's held about patients in an electronic format that we can access quite fluidly from a range of locations,” he says, “and I think that for me, this was a key step in our digitalisation journey.”

Medical internet of things (IoT) devices promise great benefits, but companies working with them must tighten their cyber security, according to new research from Irdeto.

The security company surveyed senior executives at Fortune 1000-sized US-based companies working in the medical device sector to assess their cyber security stance.

Responses to the survey suggested a high level of confidence in medical IoT security among just one in five companies, with 18% believing their medical device security was strong. Slightly fewer (13%) believed they were well-prepared to mitigate future risks, while 18% weren’t prepared at all.

These responses correlated with the rate of reported security incidents. The survey found 80% of companies suffered at least one cyber attack in the past five years, with over two-thirds (67.5%) sustaining multiple attacks.

Poor cyber security is often linked to a lack of visibility, as you can’t manage what you can't see. Most companies (78%) found device inventory management problematic, often because of bureaucracy. Many failed to patch the devices they could see, warned the report. And if they did patch them, they used inefficient and possibly dangerous methods, such as passing patches around on USB keys.

Most companies want to mitigate their medical device cyber security problems by turning to the cloud, with 48% advocating for this solution. This clashes with a separate Trend Micro survey that revealed significant cloud adoption challenges, including privacy and security concerns.

When assessing the importance of cyber security, companies concentrated heavily on compliance rather than the risk of business disruption or financial losses. Of the respondents, 80% cited regulatory requirements as a driving factor for cyber security, with just over two-thirds pointing to brand protection as an issue. Only 2.5% worried about ransomware or financial losses.

Understanding those regulations was not universal, with 40% saying they had a good handle on new cyber security rules. Another 45% said their cyber security knowledge was adequate. A worrying 15% claimed to have no knowledge of regulations at all. Some companies were escalating regulatory compliance to board level, while others called in their legal teams. Other companies working with medical devices focused on external help.

According to a new Trend Micro-commissioned survey, global health care organizations (HCOs) are increasingly leaning toward adopting the cloud but lack the preparedness for the security risks that come with it.

Remote working, cost savings, and improved IT agility were crucial reasons behind HCOs’ accelerated migration to the cloud amid the COVID-19 pandemic, the report found.

SaaS-based video conferencing tools helped remote workers connect with branch hospitals, while telemedicine platforms quickly became indispensable to physicians. Cloud infrastructure also offered multiple benefits for HCOs looking to augment IT scalability and reliability.

Despite the positive outcomes, the report indicates high risks and costs associated with the cloud significantly outweighed its benefits in the health sector.

For example, 43% of HCO IT decision-makers revealed privacy and security challenges were constant barriers to cloud adoption. The biggest day-to-day operational challenges included setting and maintaining consistent security policies, patching, vulnerability management, and cloud misconfiguration.

What’s more, nearly half of survey respondents (45%) said introducing cloud-based security tools added more complexity to IT security teams’ tasks. Furthermore, 43% spent more on capital expenses to procure contract-based cloud services. Most concerningly, fewer than half of respondents said they were confident they understood “shared responsibility,” a key cloud security concept.

“While cloud migration isn’t simple, it can be enabled and improved using the right security tools,” said Trend Micro.

According to Trend Micro, a cloud security solution should feature automation to streamline compliance and minimize risks stemming from misconfigurations.

“With the right cloud-ready solutions in place, HCOs can maximize cloud benefits without putting mission-critical systems or patient data at risk. Such tools can also minimize skills challenges by spotting misconfigurations, automating patching and policy management, and integrating security into DevOps, across both cloud and on-premise environments,” said the company.

Healthcare has always been a vital industry, but for obvious reasons, it’s more important now than it’s ever been. Hospitals are being faced with an environment in which they must do all they can to limit physical contact, and technology is playing a key role in making that possible. On top of the COVID-19 crisis, however, healthcare organisations still have to grapple with everyday IT challenges like improving operational efficiency and maintaining their security.

To discuss these issues, and how the healthcare sector is using technology to tackle them, we’re joined this week by Craig York, CTO of Milton Keynes University Hospital Foundation Trust, and member of the IT Pro Panel.

Footnotes

• How technology is changing health care
• Microsoft Cloud for Healthcare launches Oct. 30
• Microsoft offers free cyber security protection to healthcare staff
• Panel Profile: MKUH NHS Foundation Trust CTO Craig York
• IT Pro Panel: The state of cloud infrastructure
• How to beat coronavirus with the Internet of Things
• VDI vs DaaS: the flavors of desktop virtualization
• How AI can improve medical diagnosis
• NHS must spend now to prevent devastation of ‘WannaCry 2.0’
• The IT Pro Podcast: Supercharging healthcare with data

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Microsoft has announced it's moving its Healthcare Bot service to Azure to create the new Azure Health Bot.

Built for developing virtual health care assistants, Microsoft Healthcare Bot has been at the leading edge of helping organizations be more agile with patient engagement amid the COVID-19 pandemic.

For example, using nothing but Healthcare Bot, the US Centers for Disease Control (CDC), Walgreens, Premera, and Providence created multi-purpose bots that can triage symptoms, answer lab and COVID-related questions, and locate nearby clinics.

Microsoft said Healthcare Bot’s migration to Azure would further enable organizations to leverage Azure’s enhanced tooling, security, and compliance offerings. Azure Health Bot combines built-in medical databases with natural language capabilities to understand clinical terminology, and organizations can easily customize it to support clinical and operational use cases.

Furthermore, developers in the health care industries can use the platform to build and deploy AI-powered and HIPPA-compliant conversational health care experiences at scale. Health care providers can migrate from Microsoft Healthcare Bot to Azure Health Bot with minimal operator intervention and no downtime.

Lastly, as a native Azure service, Azure Health Bot benefits from Azure’s security investments, including the most comprehensive compliance coverage of any cloud service provider. Customers can use standard Azure management tools that come with an assurance of 99.9% SLA. While currently available in two regions (East US and West Europe), Azure Health Bot will expand to eight regions over the coming months.

“As part of our Well-Being Initiative, we created the Stress Self-Assessment tool using the Azure Health Bot,” said Kate Judge, executive director, American Nurses Foundation.

Judge continued: “This tool offers an anonymous way for nurses to check on themselves and receive guidance to safeguard their well-being. The bot helps nurses discover and make use of a variety of evidence-based ways to build strength and maintain health, like peer support, guided relaxation, apps with well-being tools, and webinars.”

Despite health care organizations heroically battling the coronavirus, a new report indicates they continue to endure ransomware attacks.

In a blog post, researchers from Check Point Software said that since the start of November, there has been a 45% increase in attacks targeting health care organizations globally, compared to an average 22% increase in attacks against other industry sectors.

“This is more than double the overall increase in cyber-attacks across all industry sectors worldwide seen during the same time,” said researchers.

The average number of weekly attacks in the health care sector reached 626 per organization in November, compared with 430 in October. The main ransomware variant used in attacks is Ryuk, followed by Sodinokibi.

Researchers reported a rising wave of ransomware attacks had targeted hospitals and health care organizations at the end of October. Most of those attacks used the infamous Ryuk ransomware. This followed a Joint Cybersecurity Advisory issued by the CISA, FBI, and HHS, which warned of an increased and imminent cyber crime threat to US hospitals and health care providers.

The latest rise in attacks involves a range of vectors, including ransomware, botnets, remote code execution, and DDoS attacks.

“However, ransomware shows the largest increase and is the biggest malware threat to healthcare organizations when compared to other industry sectors,” said researchers.

Ransomware attacks against hospitals and related organizations are particularly damaging because any disruption to their systems could affect their ability to deliver care, endangering lives. All this adds to the pressures these systems face trying to cope with the global increase in COVID-19 cases.

“This is precisely why criminals are specifically and callously targeting the healthcare sector: because they believe hospitals are more likely to meet their ransom demands,” researchers warned.

“The major motivation for threat actors with these attacks is financial. They are looking for large amounts of money, and fast. It seems that these attacks have paid off very well for the criminals behind them over the past year, and this success has made them hungry for more.”

Broken down regionally, Central Europe tops the list of affected regions with a 145% increase in health care organization attacks. East Asia comes in second with a 137% increase while Latin America is third with a 112% increase. Europe and North America saw 67% and 37% increases, respectively.

Researchers warned that the use of test and trace apps for tracking individuals, which previously would have caused strong privacy-related opposition, has widely been adopted worldwide and is expected to outlive the pandemic.

“As the world’s attention continues to focus on dealing with the pandemic, cyber-criminals will also continue to use and try to exploit that focus for their own illegal purposes – so it is essential that both organizations and individuals maintain good cyber-hygiene to protect themselves against Covid-related online crime,” researchers said.

Cyber security company CyberAngel has found 45 million unique medical images exposed online. The images, which include sensitive patient metadata, are accessible without a username or password, said the company, adding that some were indexed by search engines.

The report details a six-month investigation into the security of Digital Imaging and Communications in Medicine (DICOM), a standard protocol for storing medical images. Medical equipment uses DICOM to exchange images, which also carry over 200 lines of metadata, including physician and patient name, the patient's date of birth, and medical comments.

Health care workers can store and distribute these images on a picture archiving and communication system (PACS), which is typically a workstation running web server software. The researchers used internet of things (IoT) search engines, including Shodan, to scan for the non-standard ports these servers used. They found 300 open portals online.

"While the manuals indicate steps to secure the portal using encryption and password-restricted access, it is not mandatory and thus not enforced by default," the report said. In some cases, the portals granted the researchers direct administrative access within any login at all, meaning they could view, create, edit, or delete patient data.

"Worse is these web services are unprotected, which allow search engines to index the content and more easily expose it," they added.

CyberAngel's team was also able to watch the medical imaging equipment directly. Scanning for the specific ports these machines used for DICOM communications yielded 3,092 imaging devices communicating online, most of which (819) were in the US.

They obtained access to these devices 88% of the time in 50 random tests and noted the devices transmitted data without encrypting it.

Searching beyond PACS portals and imaging devices revealed a variety of other services exposing DICOM images. CyberAngel found 45 million unique DICOM images hosted on 2,138 unique IP addresses across 67 countries.

The US hosted 9.8 million of these files, the largest proportion in the study. Korea came a close second with 9.6 million files.

Digging into these leaks’ sources on a sample of 18 servers revealed that two-thirds were medical centers or hospitals. Other sources included independent doctors.

One of the leakiest sources was a server advertising a DICOM image-hosting service. The server exposed more than 500,000 unique files via the Network File System (NFS) protocol.

Most devices exposing the service were network attached storage (NAS) devices, which allow access using the FTP or SMB protocols, the report added.

Of the images CyberAngel discovered, 59% are from 2019 or later. Researchers also found 12 servers hosting at least a million unique files each.

Hackers had already compromised some of the servers the company found and were hosting malicious scripts.

CyberAngel warned that exposing images like these put patients at risk. "The comments made on a medical image can reveal a great deal about your health, such as a serious illness, which could be damaging if your bank, insurance, or employer were made aware of your condition," it noted. "The privacy and security risks includes, but are not limited to blackmail, specifically ransomware."

Criminals have already exploited patient data in this way. In October, someone attempted to blackmail thousands of Finnish therapy patients after stealing their records.

VaxAtlas has launched a digital platform to aid COVID-19 vaccine distribution, making it easy for anyone to schedule and manage their vaccinations.

The platform provides access to certified pharmacies for local appointment scheduling, updates on outbreaks, recall and second-dose reminders, and QR clearance passes for vaccine validation. VaxAtlas’ tool is also HIPAA-compliant and leverages current payment and eligibility standards.

"With no structured approach to reopening, the vaccine management process will be confusing and hard to navigate," said Judi Korzec, CEO and founder, VaxAtlas.

Judi continued, "We want to alleviate the chaos and confusion of waiting in lines, scheduling or being turned away because of supply issues while providing tools to make lives easier for families, employers, travelers and physicians."

VaxAtlas has previously launched support platforms for the H1N1 pandemic and Medicare prescription drug coverage. Building on its over 15 years of vaccine-management experience, VaxAtlas aims to offer a full range of COVID-19 vaccination options, including travel and seasonal vaccines, through a convenient location-based scheduling app.

Additionally, VaxAtlas looks to offer portable vaccination options for employers through dashboards that give a bird's-eye view into COVID-19 hotspots and vaccination uptake. VaxAtlas also includes tools to help manage employee communication.

“Through convenient app-based scheduling anyone anywhere can find a trusted pharmacy, receive reminders, alerts and family vaccinations records compiled into one convenient place,” said VaxAtlas.

Amazon has launched another business venture, this time pushing into the health care and life sciences sectors. The company announced a preview of HealthLake, a big data service housed in its Amazon Web Services (AWS) cloud.

Announced at Amazon's AWS re:Invent conference, the service will help companies in the health care and pharmaceutical sectors analyze medical data trends.

HealthLake is a data lake tailored to health applications. Data lakes store structured data, like financial records and contact information, alongside unstructured data, like Word documents, PDFs, and images, indexing it all so big data applications can mine that information.

HealthLake consumes information, ranging from diagnoses, medications, doctors' notes, and medical imaging reports to insurance claims. Many of these are in non-standard formats, and some are handwritten, but Amazon uses machine learning to mine the text.

The service interprets handwritten text and makes it readable, along with digital documents. It then uses natural language processing to identify and index distinct pieces of health care information, tagging it with metadata to make it searchable. This includes chronological metadata, enabling data scientists to create a timeline of medical events.

Amazon wants health care companies to use this information for big data analytics. That includes making predictions about individual patients, such as when a person with diabetes is likely to develop high blood pressure based on parameters, including their age, gender, and lifestyle. It will also help analyze larger trend data across populations for applications ranging from health insurance to epidemiology.

The system stores all this information in the Fast Healthcare Interoperability Resources (FHIR) format from medical data standards nonprofit organization Health Level Seven. It enables health providers to share data, Amazon explained.

The system supports data privacy and security standards created under the 1996 Health Insurance Portability and Accountability Act (HIPAA), The Department of Health and Human Services (HHS) imposes penalties of up to almost $60,000 per violation with an annual cap of $1,786,000.

Insecure medical document storage has been a thorny issue in the US. In September 2019, investigative nonprofit journalism team organization ProPublica uncovered medical images and health records for over five million US patients publicly exposed on 187 servers.

This is Amazon's second major health-care-related move in a few weeks. In mid-November, it announced Amazon Pharmacy, an online store enabling people to buy prescription medicines via the Amazon App using their health insurance.

In 2019, it launched its Amazon Care health insurance initiative, targeting its own employees. This service offers telemedicine services to participants using a mobile app.