Rural hospitals may be more vulnerable to ransomware attacks

Ransomware attacks in the healthcare sector have more than doubled in the past five years, with hospitals being the most affected provider, with operational disruptions including limited access to servers, interrupted patient care, and significant financial losses.

A new study led by the University of Minnesota School of Public Health, published in Journal of Rural Healthconcludes that while ransomware attacks are more likely to occur in urban areas, the disruptions may have a more severe impact on financially strapped rural hospitals and their patients, who are often older, in poorer health and already face existing barriers to healthcare.

The researchers collected data on the operations of 43 rural hospitals and 117 urban hospitals that fell victim to ransomware attacks between 2016 and 2021. Comparing the urban hospitals attacked by ransomware with their rural counterparts, the study found:

• During the first week of a ransomware attack, the number and revenue from inpatient, outpatient, and emergency room visits declined in both rural and urban hospitals.
• Patients from rural hospitals had to travel further to reach the nearest hospital that was not the victim of a ransomware attack. The average travel time for patients from rural areas was over 30 minutes, compared to less than 10 minutes for patients from urban areas.
• The rural hospitals affected by ransomware attacks were smaller and less likely to be part of a large healthcare system than the urban hospitals affected by ransomware attacks.

“Ransomware attacks are bad news for hospitals and patients everywhere, but they are particularly damaging for rural hospitals and patients,” said Hannah Neprash, SPH associate professor and lead author. “Preparing for cyberattacks is a real coordination exercise, as it would likely require collaboration between hospitals that normally compete with each other to ensure everyone receives safe and effective treatment.”

While there is limited evidence on the impact of ransomware attacks on rural hospitals, this research highlights the need to tailor policies to the needs of the healthcare industry and hospitals, as rural hospitals tend to be smaller and more financially vulnerable and may require more support in improving their cybersecurity defenses.