5 takeaways from new ACR, Society for Imaging Informatics in Medicine cybersecurity guidance

The white paper outlines strategies to mitigate risk and restore regular operations in the event of an attack. It includes an overview of the current landscape, discussing different types of vulnerabilities, along with best practices on how to handle a hacking incident. 

Here are their five takeaways: 

1. Radiology is vulnerable: The modern radiology practice or hospital department is “highly vulnerable” to cyberattacks. Protecting data, devices and workflows requires layered administrative, physical and technical safeguards throughout an organization’s operations. 
2. Improving one’s odds: Effective incident response—including coordination among teams and regular simulation drills—can improve a radiology group’s odds of maintaining clinical continuity during a ransomware attack or other technology outages. 
3. Importance of training: Robust staff education and administrative oversight are both critical, the authors emphasized. Most successful cybersecurity threats exploit human behavior, making ongoing training “central to security.” 
4. AI, cloud add risk: Cloud storage and artificial intelligence integration can increase complexity and potential vulnerabilities. However, radiology groups can mitigate risk through data encryption, vendor compliance and monitoring for adversarial threats. 
5. Fostering culture: Organizations should seek to build a proactive culture, which performs regular cyber-safety drills during downtime and strives to sustain patient trust. 

“Establishing a culture of safety is a challenging yet important part of building resilience,” the authors advised. “With a dedicated group of downtime champions, the larger department can more effectively simulate and practice different downtime contingencies, refining procedures and protocols through frequent exercises.”

You can read much more in the white paper, which is published in both the Journal of the American College of Radiology and the Journal of Imaging Informatics in Medicine. Other authors included Benoit Desjardins, MD, PhD, chief medical information officer and cardiovascular radiologist with the University of Montreal Hospital Center; Brett Strassner, MA, medical physicist at Radiation Protection Services; Reza Forghani, MD, PhD, chief of imaging informatics at AdventHealth Medical Group, Central Florida Division; Robert Bodakk an imaging informatics analyst with extensive experience as a radiologic technologist; Judy Gichoya, MD, MS, associate professor in Emory University’s Department of Radiology & Imaging Sciences; James Whitfill, MD, MBA, senior vice president and chief transformation officer at HonorHealth; Eric Ehman, MD, chair of the Mayo Clinic Enterprise Radiology Downtime Committee; and Christoph Wald, MD, PhD, MBA, chair of the ACR Commission on Informatics and vice chair of the ACR Board of Chancellors.