I'm Irene Pulpaseki, Executive Editor of Information Security Media Group. Today I'm speaking with Rahi Abouk, PhD, and researcher at William Patterson University in William, New Jersey, and David Powell, also a PhD and a senior economist at Research Institute Rand in Arlington, Virginia. We're going to be speaking about new research they conducted that was published in the Journal of the American Medical Association, or JAMA, about ransomware attacks, emergency department visits, inpatient admissions in both targeted and nearby hospitals. So Rahi for starters, can you briefly describe what it was that you examined for your study?
How many hospitals did you examine? I understand they were in California. What were you looking at? In this study, we look at the effect of Rand's number of attacks on hospitals in the state of California between 2014 and 2020, and on two major outcomes.
Our outcomes were emergency department visits, number of emergency department visits, and also number of inpatient admissions. Those visits that take longer than one day, basically it necessitates an overnight to stay in the hospital. So in terms of the number of incidents or ransomware attacks, we identified eight incidents or eight attacks, and overall these attacks targeted 15 hospitals, meaning that in some cases in some of these attacks, more than one hospital were targeted, and the reason is that basically sometimes attacks are on a healthcare system, meaning that the networks that are more than only one hospital. So that's why we have eight attacks affecting nearly 15 hospitals, and overall we were looking about maybe around 370, 374 hospitals in total in the state of California.
So David, I understand that for hospitals that were targeted with ransomware, there was a temporary drop in the number of patient emergency department visits for a certain length of time during an attack, and then arise in emergency department visits at nearby hospitals that were not targeted by the ransomware. How much of an impact did you see on emergency room visits at the attack hospitals, and then on the emergency departments of the nearby hospitals, and why? That's right. We really, in favor of the focus on just the numbers that we've all been coming in to understand how we like in the pathway by the passing hospitals, some of you are finding a really large discussion, so if we're seeing the funding of the facility going, you know, at the peak, it was reducing the number of visits by about 16 percent, so there's no extremely large reductions in just going into some of these patients, and I thought kind of the more interesting result was that nearby hospitals have been coming in, as you might expect, so I can please stand on the number of patients anyway, equivalent to about six or seven percent in three percent of the levels, so that suggests that there are kinds of major spillover cities using the biostatists, I'm not expecting their capacity, they're going to have to do that in a few patients that weren't in the already nearby hospitals anyway, that were already in the hospital.
So Rahi, for how long did these temporary changes in emergency department visits last? For instance, did they last for as long as ambulances, and then patients were being diverted away from the attack hospitals? What was the average? So the duration of the effect on average basically was somewhere around up to four weeks, while we observed the largest effect up to two weeks following each attack, and after the two weeks we see some sort of decline, but the decline takes time to be effective to get basically to the pre-attack level of ED visits, so basically what you see is right after the attack we see an increasing decline, and after two weeks we see an basically fading of the effect the effect starts to just disappear, and the hospital is usually getting back to the normal operation because these hospitals usually try to address the issue as soon as they can, but sometimes it takes time to basically negotiate or to address the inaccessibility of the computer networks and everything, so that's basically very in line with anecdotal evidence about the potential procedure and time it takes that hospital management to negotiate with the ransomware attackers basically.
David, in terms of the inpatient admissions at attacked hospitals, and then at nearby hospitals, what did you see there? Was there a drop in admissions, an inpatient admissions at attacked hospitals, did they go up at the nearby hospitals, and why do you think that was the case of whatever you did see? Right, so inpatient admissions they also dropped to say actually at the attack hospitals, so they dropped out to get on the order of about 16 to 70% of that and speak, but they didn't get to suggest that the hospital, the hospital was really adversely affected by these attacks, and that led to a inability to settle in a lot of different cases. Inpatient admissions we saw less of an impact on nearby hospitals, but just to suggest that there's less kind of ability for the small amount of energy, and so we used to be losing the evidence of nearby hospitals, and they came back and gone back to Michigan, so we saw part of that, so mercifully funded, but not so much on completion.
So, Rahi, your study did not examine the potential adverse outcomes among patients at the hospitals that are targeted by ransomware attacks, but any anecdotal evidence that you gathered along the way that might provide a picture of the patient safety issues that can result in these attacks? Actually, this was basically our first investigation of a series of investigations that we're planning to do, and basically the extended data that includes hospitalization for 2021 and 2021, potentially 2023, and however we were looking at some health outcome in particular, for example, in hospital death, and some overall death in the county in which those targeted hospitals are located, and we do believe that there are some evidence of decline in health outcomes, such as mortality, but in order to pinpoint the exact estimates and numbers, we need to do more rigorous follow-up studies on this topic using either this data or other similar data that is available to us in the future. David, is there any other findings, were there any other findings that kind of stood out about the research that we haven't touched upon that are worth mentioning? I think the syllabus on the hospital is really kind of what's coming from my missing findings here.
I'm just, you know, putting the task in my opinion, I think that's just the one, but I think I possibly the only one that's impacted it, but the idea that, you know, just the nearby hospital, we're going to also be impacted by this attack, just out of an important finding, that's just the one that had the one problem with patients, whereas how to think about like the cybersecurity, you think that's what I said. And finally, Rahi, what are the lessons that are emerging from your research that hospitals should be paying attention to in case they are hit by a ransomware attack, or if one of their nearby hospitals are hit? Actually, there are several points that could be taken out of this research, and the first issue is that probably policymakers need to be very careful and basically responsive to this sort of attacks, because these attacks has become very popular, and very popular in the United States during the past 10 years, let's say. However, we haven't had much activities in the policy landscape to address these attacks and try to reduce or prevent these attacks.
So the first policy lesson or lessons for hospitals in the area or other hospitals is that, okay, if the hospital is subject to these attacks, probably informing the management of nearby hospitals about the incident would be basically beneficial, so that those hospitals would basically mobilize in terms of providing services to potentially incoming patients who are supposed to go to the targeted hospital. We know that usually these attacks go unreported, at least for a couple of months after the attack because of several considerations, but based on our study, basically, and especially the results that we have for ED visits, we do believe that publicizing these events or these attacks by hospitals, at least to a certain restricted network of hospital management would probably be beneficial, would have basically beneficial health impact on patients in terms of because if those nearby hospitals are mobilized, then they can better serve incoming patients, and this way we can reduce the potential health impacts of these attacks. The other thing about the inpatient admission is that we don't see any effect or any spillover effect on nearby hospitals, this needs to, this result basically deserves more attention and more investigation because one reason we don't see any effect might be that people postpone receiving care and due to this postponing, we might have some adverse health impact in the future. So this is something that needs to be basically taken care of by either hospital management or policy makers to basically to get to the bottom of that effect.
So the other thing about these attacks is that what happens to the mix of payers mix, basically, meaning that our current paper reports decline in overall visits, either it's ED visits or inpatient admissions. So one important question is that, okay, do we see a heterogeneous effect of these attacks, depending on the type of health care coverage individuals have or no, we see a basically a consistent decline in all types of care, meaning that what happens to a patient who's a Medicare enrollee after these attacks, and what happens to a patient who is a Medicaid enrollee after these. So are these two groups of patients treated differentially by the target hospitals in the weeks following the attacks, or basically no, we don't see any heterogeneity or disparities? So these are all important points and questions that you're trying to address in the follow up research that you're doing on this topic.
Thank you so much, David and Rahi. I've been speaking to David Powell and Rahi Abuq. I'm Mary Ann Coba-Sakmagi of Information Security Media Group. Thanks for joining us.