Sys ema ic Re iew o Cu en Risk Managemen
Me hods in Cybe secu i y o Heal hca e
Ma ie SOUKUPOVÁ* and Radek DOSKOČIL
B no Uni e si y o Technology, B no, Czech Republic; Ma ie.Soukupo a1@ u .cz; Radek.Doskocil@ u .cz
* Co esponding au ho : Ma ie.Soukupo a1@ u .cz
Abs ac : P esen ed sys ema ic e iew is analyzingcybe isk managemen , mo e speci ically
economic aspec o he measu es esul ing om he isk analysis, h ough sea ch o Web o
Science and Scopus da abases. The a icle ques ions he cu en scien i ic knowledge in he
ield o applicabili y o quan i a i e me hods on measu ing o he nega i e impac o
success ul cybe a acks. The pu pose o he a icle is o de ine how hese shall be imp o ed
o eal applica ion in he en i onmen o heal hca e, being speci ic no only by ope a ing
wi h sensi i e pa ien da a, bu also by he u gency wi h which sys em mal unc ions mus be
deal wi h in o de o p e en h ea ening he heal h and li es o pa ien s ( he ac ha is
p o iding he a acke wi h a unique posi ion o p i ilege). While i is appa en ly necessa y
o in es mo e esou ces in o he cybe secu i y in heal hca e, i is a he same ime essen ial
o ensu e ha hese measu es a e p o i able and he esou ces o hem a e spen
economically. While cos o human li e canno easily be quan i ied, i is now ime o sea ch
o me hods on how o de ine an app op ia e cybe secu i y in es men as opposed o he
cos s o a po en ial cybe a ack.
Keywo ds: isk managemen ; cybe secu i y; heal hca e; measu e; cos
JEL Classi ica ion: G32; I15; K24
1. In oduc ion
Cybe a acks on hospi als a e some hing ha one can come ac oss e y o en hese days.
Wi h inc easing numbe o a acks, ollowed by inc ease o cos s o ansom and/o epai s
and dec ease o a ailabili y o heal h se ices, he ques ion o how hese si ua ions can be
p e en ed na u ally comes o mind. The causes o hese si ua ions (meaning speci ic
examples o he lack o cybe secu i y measu es in he cu en heal hca e) oge he wi h he
possible me hods o p e en ion (meaning he isk managemen app oaches) will be
discussed in his a icle.
The aim o his pape is o assess whe he he le el o scien i ic knowledge in he ield o
economic op imiza ion o measu es in he cybe isk managemen p ocess in heal hca e is
su icien and whe he he cu en me hods de eloped o measu ing cybe isks a e use ul.
The basic condi ion o he cybe isk managemen p ocess indica es ha he cos s o secu i y
measu es adop ed in o de o p e en cybe a acks shall be p opo ional o he amoun o
damage done in case o a success ul cybe a ack (ENISA, 2012). Thus, analyzing he
economical aspec o secu i y measu es and especially he me hods used o quan i y i is he
aim o his a icle.
doi: 10.36689/uhk/hed/2024-01-033
376
The opic o he a icle conce ns mul iple scien i ic ields consis ing o isk managemen
on one side, and cybe secu i y in heal hca e on he o he . While cybe secu i y is an u gen
and cu en opic amongo ganiza ions a ound he wo ld, one canno onlyunde s andi om
he pe spec i e o echnical and echnological imp o emen s, bu mus also always conside
he cos so he measu es. Tha is whe e isk managemen and i s me hods s ep in. Vice e sa,
cybe secu i y plays an indispensable ole in isk managemen , cybe a acks being o en
de ined as he mos se ious and a he same ime p obable isks known o o ganiza ions. The
mos common cos o cybe b eaches in heal hca e does no conce n he pu chase o new
ha dwa e, bu he dis up ion o ope a ions which means cu ing he hospi al o i s unding
om he heal h insu ance companies which a e inancing he ea men s (Lee, 2021).
1.1. Cybe secu i y in Heal hca e
Qui e a ew speci ics o he ield o cybe secu i y can be ound, among all else seeing ha
i is no some hing ha o ganiza ions would p oudly p oclaim.Fo ob ious easons, i he le el
o secu i y is low and p o en by ecen cybe b each, he o ganiza ion will ha e no desi e o
publicly alk abou i , bu e en i he le el o secu i y is conside ed high in an o ganiza ion, i
is ad ised no o be e y speci ic especially abou i s ulne abili ies. This ac makes esea ch
on he opic complica ed. As well as digi aliza ion, he cybe c ime has also been ising
exponen ially in he cou se o he pas ew yea s. Wi h he widening o he cybe space in he
ecen yea s, equen in oduc ion o new echnologies, he quan i y o de ices in a ne wo k,
wi h wi eless ones playing a majo ole, i has become easie o h ea en o ganiza ions.
The s a e o cybe secu i y in heal hca e is inadequa e o he s a e o secu i y in o he
o ganiza ions, al hough in e es in his opic om he side o senio managemen o heal hca e
acili ies has changed conside ably in he pas ew yea s as se e e (especially ansomwa e)
a acks on hospi als ha e been success ul and g a ely damaging (Pea s & Kons an inidis, 2021).
Ne e heless, cybe secu i y, no being he p ima y se ice ha he medical sec o ocuses on,
s ill ge s less a en ion and unding han necessa y (Vuko ich, 2023).
Mo eo e , wha some senio manage s do no ealize is ha cybe secu i y does no only
a ec heIT depa men , bu he en i e pa ien ca e. As a ma e o ac , close a en ion o he
managemen should be paid o e e y aspec o he sys em ha i is o e looking, om he
pe spec i e o i s ulne abili ies o i s de ense mechanisms. The p oblem wi h ising
in es men s in cybe secu i y is he lackingda a-d i en s a egy (Ro h ock e al., 2017).Indeed
ea , a he han a clea ision, should ce ainly no be he p ima y eason o cybe secu i y
in es men s. Addi ionally, i is necessa y o he managemen o own esponsibili y o
cybe secu i y policies ha i should a i y and comply wi h (Ab aham e al., 2019).
I is no wonde ha wi hou cons uc i e guidance om he au ho i ies and wi h he
sho age o cybe secu i y specialis s on he labo ma ke , he acili ies a e unce ain abou he
secu i y decisions and pu chases ha hey should con ey. As a consequence, mos acili ies
lack cybe secu i y s a egies and since public spendings a e being cu due o go e nmen ’s
e o s o sa ings in almos all sec o s ([Czech] Go e nmen app o ed he s a e budge o 2024,
decided o pu chase F-35 supe sonic ai c a and ook ano he s ep o s eng hen ene gy secu i y, 2023),
cybe secu i y budge s o hospi als canalsobe expec ed o dec easein hecu en calenda yea .
377
Fu he mo e, he speci ic ulne abili y o he heal hca e sec o is caused by he sensi i e
pa ien da a ha i ope a es wi h. Conside ing ha sensi i e da a is e en mo e alued by
hacke s han he da a in banking o e ail sec o s (Syman ec, 2017) pu s ex a s ess on
secu i y in his indus y. Hence o h, he human ac o con inues o p o e as he weakes
poin o a secu i y sys em in any o ganiza ion (Lo d, 2018), which, in case o heal hca e, is
e en ampli ied by he no o ious o e wo k o s a (B anley-Bell e al., 2021).
1.2. De ices and Ne wo ks in Heal hca e
Al hough heal hca e acili ies usually do no ope a e wi h In e ne o Things (IoT) de ices
since hei echnologies a e mo e ou da ed and he e o e, hey do no ace he se e e h ea s o
dis ibu ed denial-o -se ice (DDoS) a acks h ough IoT, hey s ill ace many p oblems
conce ning hei ne wo ks. The p oblems a e, o cou se, caused by he ou da ed echnologies
hemsel es oge he wi h a lack o su eillance (SCADA) sys ems, esul ing in he ac ha he
adminis a o s o en do no ope a e wi h an up- o-da e o e iew o he ne wo ks ha i is hei
esponsibili y o moni o . In some sense, one can unde s and medical acili ies as
unde de eloped and/o amily businesses in e ms o hei le el o cybe secu i y, main
di e ence be ween he wo ca ego ies being he size o he ac ual o ganiza ion whe e hospi als
ensu e a wide ange o p ocesses a ying om heal hca e h ough ca e ing o adminis a ion.
Howe e , he cu en secu i y conce ns consis no only o s a and es ablished
echnological measu es (such as i ewalls, an i i us o enc yp ion) since hese a e no
su icien anymo e (B anley-Bell e al., 2021), bu also o inc easingly common wea able
de ices, especially hose connec ed o he cloud. These a e a e sion o IoT ha is beginning
o be used in heal hca e. As wi h echnological inno a ions in gene al, p essing ocus o
de elope son deli e ing he solu ions i s o ma ke pushes p oduc secu i y o hesidelines
(Mills e al., 2016).
Wea able de ices a e unique in many ways. Fi s o all, hey can no only be
comp omised in he sense o a da a b each, bu hey also ha e he po en ial o physically hu
he pa ien wea ing hem (Mills e al., 2016), being in di ec con ac wi h hei bodies (Mills
e al., 2016). Al hough wea ables a e no he eali y o he majo i y o hospi als oday, hey
a ede ini ely helong- e mgoalo heal hca e(since heyp o ide he pa ien s wi haddi ional
possibili y o mobili y du ing he eco e y o moni o ing phase o ea men ) which is why
i is necessa y o ake hei ulne abili ies in o conside a ion, especially since hey can se e
as means o comp omising he en i e ne wo k (Ab aham e al., 2019).
1.3. Da a and Regula ions
Recen ine i able igh ening o egula ions conce ning da a p o ec ion (GDPR, 2018)
has made i e en mo e di icul o medical (as well as o he ) acili ies o na iga e
hemsel es in he cybe secu i y issues (Lee, 2021) which also inc eased equi emen s o
al eady unde s a ed cybe secu i y specialis s. A he same ime, mo e ecommenda ions
om he go e nmen in o de o educe he di e si y o sys ems in each medical acili y is
ad isable. A egula ion named HIPAA (Heal h Insu ance Po abili y and Accoun abili y Ac o
1996, 1996) which is in o ce in he USA can be used as a bes p ac ice, appa en ly aking
378
in o conside a ion he di e ences ha he heal hca e sys ems in he USA and in Eu opean
coun ies ha e.
Nowadays, da a is he mos aluable asse o o ganiza ions and he e o e needs o be
p o ec ed wi h special ca e. A he same ime, in each o ganiza ion, he e a e de ini ely
a ious ca ego ies o da a wi h di e en alue. A b each o ca e e ia menus will su ely cos
he heal hca e acili y less han he b each o esul s o sc eenings o pa ien s including hei
social secu i y numbe s. Tha is why da a wi hin an o ganiza ion shall be classi ied and
p o ec ed based on i s impo ance.
Heal hca e sec o , o a ce ain ex en compa able o unde de eloped companies, can in
some pe spec i e bene i om i s ou da ed echnologies in use. Since he e a e inc easing
isks wi h new echnologies (such as cloud se ices), he ac ha hose a e no commonly
used in his sec o migh be ecognized as a isk educ ion. Howe e , his a gumen is alse
since o en, he issue ha he cloud se ices do no co e mus s ill be eplaced by ano he ,
o en unsys ema ic and he e o e e en less secu e solu ion.
Fo ins ance, o en imes, he pa ien ’s da a (such as sc eenings o scans) is no s o ed on
a sha ed cloud s o age, howe e mul iple depa men s o he medical acili y need o access
i in o de o p o ide he pa ien wi h u he ea men . Wha hey do is o en ei he send he
da a physically (by p in ing each pape ou o w i ing he condi ions down by hand), o send
i h ough pe sonal, unsupe ised online communica ion ools (such as Wha sApp o email)
while nei he o hese solu ions complies wi h any basic secu i y ules. This is one o he
p ocesses ha shall wi hou a doub be eplaced by a obus con olled sys em so ha he
en i e heal hca e can sha e necessa y sensi i e in o ma ion in a conside ably sa e way
(D ape & Raymond, 2020).
The heal hca e sec o is now he e o e acing a c ucial ques ion: how o ully digi alize
i s p ocesses and da a. The main isks o he digi al ans o ma ion a e appa en , mos se ious
o hem being unau ho ized access o sensi i e da a. Howe e , hose isks (in limi ed sense)
al eady occu in he cu en (insu icien ) s a e o digi aliza ion. Wha digi aliza ion comes
wi h is he solu ion o backups coun ing wi h high olumes o da a being s o ed a sa e,
accessible cybe space so ha hey a e a ailable e en in case o c isis. Concluding ha
digi aliza ion is ce ainly he way o go.
1.4. Risk Managemen
While all he aspec s o cybe secu i y men ioned abo e can be economically pe cei ed as
a cos , he ques ion how omeasu e whe he he cos is adequa e o he isk and cos o po en ial
damage done is s ill p esen . Tha is wha he ollowing chap e s o he a icle a e discussing.
2. Me hodology
The sys ema ic e iew includes syn hesis o publica ions ha had o ul ill
p ede e mined eligibili y c i e ia such as belong o he ca ego y “Economics and Business”
wi hin he Web o Science da abase, o be published in 2018 o mo e ecen ly. The a icles
we e sea ched wi hin he Web o Science and Scopus da abases using he keywo ds
“cybe secu i y” AND “hospi als” and “cybe isk managemen ” AND “heal hca e”.
379
Figu e 1: Flowcha o selec ion p ocess o ele an a icles
The indings we e summa ized and he subsequen ou pu s we e analyzed. Implica ions
we e d awn based on hem. Rele an s udies we e selec ed while excluding duplici ies,
i ele an s udies based on he con en o hei abs ac , and una ailable s udies we e
excluded as well as s udies published in p eda o y jou nals. Use ul e e ences om sui able
a icles we e used o u he ex ension o he e iew.
Apa om he Web o Science and Scopus da abases, a numbe o espec able websi es
o egula o y ins i u ions was inspec ed (such as he o icial ENISA websi es) o he pu pose
o his e iew.
3. Resul s
The e iew has concluded ha he e a e qui e a ew app oaches o cybe isk
managemen . Some o hem highligh he echnological measu es (Lockheed, 2009), some
o he s poin ou he secu i y o he en i e supply chain (NIST, 2018)and o he ones conside
380

Table 1: Bibliome ic analysis o a icles
Au ho
Ti le o A icle
Ti le o Jou nal
Yea o
publica ion
Lee, In
Cybe secu i y: Risk managemen
amewo k and in es men cos
analysis
Business Ho izons
2021
Ab aham, Chon,
Cha e jee, Da e, Sims,
Ronald R.
Muddling h ough cybe secu i y:
Insigh s om he U.S. heal hca e
indus y
Business Ho izons
2019
Ea on, Tim V., G enie ,
Jona han H., Layman,
Da id
Accoun ing and Cybe secu i y
Risk Managemen
Cu en Issues in
Audi ing
2019
D ape , Ch is, Raymond,
Anjane e H.
Building a isk model o da a
inciden s: A guide o assis
businesses in making e hical da a
decisions
Business Ho izons
2019
B anley-Bell, Dawn,
Co en y, Lynne,
Sillence, Elizabe h
P omo ing Cybe secu i y Cul u e
Change in Heal hca e
The 14 h Pe asi e
Technologies Rela ed o
Assis i e En i onmen s
Con e ence
2021
Vuko ich, Geo ge
Heal hca e and Cybe secu i y:
Taking a Ze o T us App oach
Heal h Se ices Insigh s
2023
he human ac o and consequen o ganiza ional measu es as well. While all o ha makes
pe ec sense, he p oblem in ques ion is no only he de ini ion o he measu es hemsel es,
as much as measu ing o hei cos s and he cos s o a po en ial cybe b each, ollowed by a
cos -bene i analysis.
Cybe secu i y depa men s should h i e o quan i y he impac s o isks as well as
measu es in o de o jus i y in es men s in o hem (Lee, 2021) which is whe e he e iew
ound a blind spo . No ha ing access o accu a e quan i ied da a makes he wo k o
cybe secu i y manage s in all so s o o ganiza ions conside ably mo e di icul especially in
he aspec o nego ia ions on unding o cybe measu es wi h he op managemen .
A ew o he pape s ha we e analyzed o he pu pose o his e iew o e somewha o
a solu ion. The p oposed cybe isk managemen amewo k designs ou laye s consis ing
o cybe ecosys em (ou side o he o ganiza ion i sel ), cybe in as uc u e (o ganiza ion,
employees, echnologies), cybe isk assessmen (designing he isk managemen oge he
wi h in es men s needed) and cybe pe o mance (consis ing o he implemen a ion,
moni o ing and con inuous imp o emen o he cybe isk managemen ) (Lee, 2021) ha a e
o be go e ned by he cybe isk managemen .
Beyond doub , he ecosys em laye (Lee, 2021) is a a he impo an one in case o
heal hca e, aking in o accoun he di e en s akeholde s in- and ou side o i s own ield.
Di e en heal hca e acili ies shall be able (unde he condi ion o accessing only he da a
ele an o hei own wo k – meaning he da a o he pa ien s ha a e in hei ca e – no
he da a o all pa ien s as is o en he case) o exchange and discuss in o ma ion ela ed o
he pa ien .
381
The e a e also ongoing deba es abou whe he heal hca e da a should be used o o he
public se ice pu poses (such as gi ing ax bene i s o paye s ha p o e ha hey a end
check-ups). These deba es a e o cou se highly hypo he ical a he momen since he e a e
conside able p oblems accompanying he ans e o da a wi hin he heal hca e sec o i sel ,
le alone i s ans e beyond i . Howe e , his only p o es he impo ance o aking he
su oundings o a single hospi al in o accoun when designing a cybe isk managemen
amewo k in i .
In case o heal hca e, he ecosys em consis s mainly o i s global supply chain
managemen , pa ien s, au ho i ies, and he heal h insu ance companies which a e usually he
main p o ide s o income o he hospi als. Rega ding cybe secu i y a ea speci ically, one
shall also ake in o accoun he consul ing specialis s and he hacke s.
Nex on he lis , he cybe in as uc u e laye , consis ing o IT and non-IT s a as well as
echnologies wi hin he o ganiza ion (Lee, 2021), shall in opinion o he au ho so his e iew
be mo e speci ied by he public au ho i ies, especially om he echnological poin o iew.
Fi s o all, IT s a in hospi als could use guidelines o ollow whe eas minimaliza ion o he
di e si y o ne wo ks in heal hca e would help inc ease secu i y o e all. Cybe de ense
s a egies ollowed by ecu ing ainings o all s a and possibly mos impo an ly, a cul u e
o posi i e cybe secu i y beha io , a e a pa o his laye (Lee, 2021). O cou se, keeping he
echnologies upda ed oge he wi h an o e iew o hei ulne abili ies is essen ial he e as
well. Da a also alls unde his laye , nowadays being he p ima y a ge o he cybe a acks
in heal hca e and ou side o i (Lee, 2021).
Cybe isk assessmen laye is whe e his e iew can ge inspi ed by s anda d isk
managemen app oaches, h ough isk iden i ica ion, i s quan i ica ion and cybe in es men
analysis (Lee, 2021). Iden i ica ion o cybe isks can be done by lea ning om success ul
cybe a acks ca ied ou on simila o ganiza ions (o cou se, he de ails o which he ic ims
usually wan o keep p i a e because o he damage done o hei co po a e epu a ion). This
is whe e expe ienced cybe secu i y consul ing specialis s can p o e e y use ul since hey
usually o e look a numbe o somewha simila o ganiza ions. Once again, isk
quan i ica ion is necessa y o e iciency o in es men s in o secu i y (Chen e al., 2011).
While he me hod o cybe laye s analyzed abo e, being one o he sca ce numbe o
me hods published in scien i ic ci cles in ecen yea s, desc ibes he cybe isk managemen
om all he di e en pe spec i es ha need o be aken in o conside a ion, i lacks a speci ic
quan i ica ion me hod ha could be used in he heal hca e sec o . The eason o
quan i ica ion is as ollows: secu i y can ne e be es ablished up o he poin o elimina ion
o all isks, bo h om echnological poin o iew, whe e all isks can ne e be o eseen, and
om he cos -bene i poin o iew, whe e cos o some measu es exceeds he cos o damage
done by ce ain isks.
The e o e, he ealis ic secu i y app oach mus be o educe he isk as long as
implemen a ion o measu es agains his isk has he same alue as addi ional sa ings om
possible inciden s caused by i . Indeed, he p ocess o es ima ing his alue is whe e
quan i a i e me hods a e needed, he issue wi h hem being he lack o a s anda d ha would
382
help de e mine he cos s o secu i y measu es as well as cos s o asse s ha a e being
p o ec ed by hem (Bojanc & Je man-Blažič, 2008).
Some o he a iables ha he pape s analyzed o he pu poses o his e iew men ioned
as app op ia e o quan i ica ion we e namely equencies o cybe a acks as well as inancial
losses esul ing om each o hem (Lee, 2021). Na u ally, s a is ical me hods (such as he
p obabili y densi y unc ion) can also be used, al hough da a om a SCADA moni o ing
sys em may be conside ably mo e accu a e.
Abo e all, he cos o acybe b eachshall include ines, cos s o lawye s and consul an s hi ed
o se le he p oblem and he alue o da a eleased (Lee, 2021),in case o heal hca e ex ended by
he ansom, eloca ion o pa ien s o o he si es, he cos o go e nmen penal ies, eco e ing da a
and eplacing equipmen oge he wi h damage o epu a ion (Ab aham e al., 2019).
While scien i ically discussing di e en possible a iables ha could be included in a
quan i a i e model, we canno o ge o ake he eali y in p ac ice in o accoun . I is possible
ha a gi en cybe secu i y manage migh no ha e access o all inance- ela ed in o ma ion
in he o ganiza ion. Be o e designing a easible quan i a i e cybe isk model, i is he e o e
necessa y o in e iew he p o essionals ho oughly.
The mo e p ecisely he isk is quan i ied, he easie i should be o ad oca e o he
in es men in he secu i y measu es h ough an elabo a e cos -bene i analysis. Ano he
app oach men ioned in he analyzed pape s desc ibes compa ing inancial loss in case o a
cybe b each o he cybe in es men cos , meaning he expenses o cybe secu i y (Lee, 2021),
sugges ing a a he b oad and unspeci ied a iable.
4. Discussion
The e iew p o ed ha he e is a scien i ic gap in he sense o a quan i a i e cybe isk
model ha is cu en ly missing. A numbe o scien i ic pape s published in espec able
jou nals was analyzed in o de o con i m he need o a quan i a i e app oach in he
de ined opic. A ew o hem indica ed sui able a iables o be included in such a
quan i a i e model, hough o en wi hou a p ope conside a ion o whe he he alues o
hese a iables a e accessible o he cybe secu i y expe s wi hin he o ganiza ion which is
applying he model in p ac ice.
The appa en ecommenda ion o he au ho s o his e iew conce ns consul ing an
ex e nal cybe secu i y specialis a he han assigning he cybe secu i y ole o a andomly
selec ed membe o he IT depa men . While lea ning om p e ious cybe a acks in simila
acili ies migh be di icul due o hei will o keep he de ails o he inciden s p i a e,
cybe secu i y expe s a e he ones able o sha e he lessons lea ned since hey we e o en he
ones wi nessing i happen.
Clea ly, he e is space o u u e esea ch in his a ea. One o he appa en di ec ions
includes coope a ion among di e en depa men s o a heal hca e acili y. As desc ibed in
mo e de ail abo e, cybe a acks a e no jus he issue o one depa men since hey e ec he
en i e acili y. The e o e, i is only logical o suppo coope a ion o mul iple pa s o he
acili y o p e en hem. Wha he au ho s o he e iew ind especially po en ially ui ul is
he coope a ion o cybe secu i y manage s and accoun an s who may be mo e compe en o
383
quan i y ce ain isks and cos s associa ed wi h cybe a acks. Accoun an s, being expe s in
his ield, shall o e hei ad iso y and/o assu ance capaci ies (Ea on e al., 2019). Only wi h
speci ic and measu able impac o cybe a acks se ing as p oo can cybe secu i y manage s
ob ain be e inancial suppo o he p o ec ion o he ne wo ks om he side o he senio
managemen . And ha is why a quan i a i e cybe isk model is needed.
Fu he mo e, ano he esea ch di ec ion is a hand: du ing he design o he new model,
au ho s mus no o ge o consul he cybe secu i y expe s in p ac ice in o de o include
a iables ha hey ha e access o and ensu e he model’s easibili y and use ulness. Thus, ase
o in e iews o ques ionnai es shall be conduc ed and analyzed o u u e s eps o he esea ch.
The au ho s o he e iew would, among all else, like o s a is ically e i y hei assump ion
ha cybe secu i y s a in heal hca e may bene i om ad anced le el o go e nmen suppo
in he o m o o icial ecommenda ions ega ding ne wo k esilience e c. A ool whose
applicabili y in he ield o cybe secu i y in heal hca e shall beexamined om he poin o iew
o scien i ic esea ch is also he a i icial in elligence. Many a e discussing i s secu i y isks,
bu o ge ing ha i migh be used as a pa o secu i y i sel , especially in he con ex o
sho age o s a and expe s in cybe secu i y, namely isible in heal hca e.
The e iew de ined a need o a easible quan i a i e cybe isk model usable in
heal hca e which he p ac ice is now lacking, esul ing in low secu i y o e all. While de ining
he new model, no only shall he expe s in p ac ice be in e iewed, bu emphasis on
con inuous imp o emen shall be emembe ed since e e y model becomes less accu a e wi h
ime passed, especially when i conce ns he apidly de eloping ield o IT.
One does no need o be a cybe secu i y expe o no ice he ac ha cybe a acks on
hospi als ha e been ising in he pas yea s. By being able o measu e he cos s and bene i s
o secu i y as well as he cos s o damage done, hospi als (as well as o he o ganiza ions) will
be able o make in o med and s a egic decisions conce ning hei secu i y and hei pa ien s
will be able o eco e in a sa e space. By building esilien ne wo ks suppo ed by e i ied
p o ide s, he cybe a acks shall become less and less success ul, e en ually making
heal hca e sec o unappealing o hacke s o whom i will be ha d o a ec i and hospi als
shall once again become he places whe e ci izens in hei g ea es need will come wi h ull
us in he ins i u ions o heal hca e as well as he s a e i sel .
Con lic o in e es : none.
Re e ences
[Czech] Go e nmen app o ed he s a e budge o 2024, decided o pu chase F-35 supe sonic ai c a and ook
ano he s ep o s eng hen ene gy secu i y. (2023). Vláda České epubliky. Re ie ed Janua y 10, 2024, om
h ps:// lada.go .cz/cz/media-cen um/ak ualne/ lada-sch alila-s a ni- ozpoce -na- ok-2024-- ozhodla-o-
nakupu-nadz uko ych-le ounu- -35-a-ucinila-dalsi-k ok-k-posileni-ene ge icke-bezpecnos i-208775/
Ab aham, C., Cha e jee, D., & Sims, R. R. (2019). Muddling h ough cybe secu i y: Insigh s om he U.S.
heal hca e indus y. Business Ho izons,62(4), 539-548. h ps://doi.o g/10.1016/j.busho .2019.03.010
Bojanc, R., & Je man-Blažič, B. (2008). An economic modelling app oach o in o ma ion secu i y isk managemen .
In e na ional Jou nal o In o ma ion Managemen ,28(5), 413-422. h ps://doi.o g/10.1016/j.ijin omg .2008.02.002
B anley-Bell, D., Co en y, L., & Sillence, E. (2021). P omo ing Cybe secu i y Cul u e Change in Heal hca e. In
P oceedings o he 14 h PE asi e Technologies Rela ed o Assis i e En i onmen s Con e ence (pp. 544-549).
h ps://doi.o g/10.1145/3453892.3461622
384