UC San Diego receives major grant to secure healthcare cybersecurity

The University of California San Diego Center for Healthcare Cybersecurity has received an award from the Advanced Research Projects Agency for Health (ARPA-H) to lead the Preventative Assessment and Network Analysis of Cyber Essential Abilities for Health (PANACEA-H) project in collaboration with the American Hospital Association (AHA), the University of Maryland and the University of Minnesota. The award totals up to $29.9 million over a maximum of four years.

PANACEA-H will develop innovative tools to map and monitor technology dependencies - systems, processes and infrastructure reliant on networked hardware, software and digital services - to identify critical linchpins whose failure could destabilize care delivery.

John M. Carethers, MD, vice chancellor for Health Sciences, UC San DiegoThis award underscores UC San Diego's unique ability to bring together world-class medical expertise and advanced computer science to solve critical national security challenges. The mapping tools developed by the Center for Healthcare Cybersecurity will transform how the entire health care sector defends itself, cementing UC San Diego's role as a driving force behind the nation's health IT infrastructure and patient safety."

The Change Healthcare breach of 2024, which triggered nationwide disruptions in health care operations and resulted in billions of lost revenue, brought into stark relief the need to reimagine how dependencies are mapped. In many cybersecurity attacks, including this one, the vulnerability goes unrecognized until it fails.

"When it comes to cyber resiliency, you can't protect what you don't see," said principal investigator Jeff Tully, MD, associate clinical professor and Sheldon Furst Endowed Chair of Anesthesiology at UC San Diego School of Medicine and co-director of the Center for Healthcare Cybersecurity.

"Hospitals don't work in isolation, they work in tandem with many different vendors, partners, software and medical devices - a very complicated, interconnected system with many different players all coming together to provide care," said co-principal investigator Deepak Kumar, PhD, assistant professor in the Department of Computer Science and Engineering at the UC San Diego Jacobs School of Engineering. "Any one lapse in service can actually cause a lot of disruption in the way that Americans get health care."

Tully says traditional approaches for identifying and mapping sector dependencies can be incomplete and error prone, leading to static snapshots of network vulnerabilities that can quickly lose relevance due to the emergence of new technologies, sector consolidation and regulatory developments.

"What PANACEA-H seeks to do is a very sophisticated version of what many people in the government and the public and private sector have been working on," he said.

The project has four central thrusts:

• ANALOG, led by John Riggi, National Advisor for Cybersecurity and Risk at the AHA, builds upon traditional methods of identifying and mapping critical dependencies by methodically sampling the expertise of subject-matter-experts from several hundred hospitals of various types, sizes and geographies.
• ANSWER, led by Stefan Savage, PhD, Geoff Voelker, PhD, and Alex Snoeren, PhD, professors in the Department of Computer Science and Engineering at the Jacobs School, collects and analyzes real-world internet data to build databases and visualizations of network relationships. "The internet is an incredibly dynamic ecosystem that changes week-to-week," said Savage. "ANSWER's goal is to automatically update these complex maps, allowing us to see emerging risks and structural weaknesses before they become a threat."
• AIRWAVE, led by Aaron Schulman, PhD, associate professor of computer science and engineering at the Jacobs School and Dave Levin, PhD, associate professor of computer science at University of Maryland, aims to monitor Bluetooth, Wi-Fi and other signals in hospitals to dynamically locate networked medical devices to aid hospitals and government stakeholders in understanding the potential impact when cyber vulnerabilities are discovered in legacy health care equipment.
• ANDMORE, led by Kumar and Hannah Neprash, PhD, associate professor at the University of Minnesota School of Public Health, mines human-readable public information from social media, online job postings, press releases, hospital websites, Medicare data and more to infer vendor relationships and software use.

Co-principal investigator Christian Dameff, MD, associate professor of emergency medicine at UC San Diego School of Medicine and co-director of the UC San Diego Center for Healthcare Cybersecurity, said initial maps will validate mapping techniques for broader adoption.

Validated mapping of hidden vulnerabilities will help prioritize which network dependencies to secure first. It will also identify linchpin companies, predict hospital impacts from device or IT service vulnerabilities and drive preventive steps to avoid another event like the Change Healthcare breach.

The mapping tools that PANACEA-H develops will be made available to stakeholders responsible for safeguarding cyber resiliency, including agencies in the federal government, state, regional, and local public health systems and health care delivery organizations.

"As the health care sector becomes more digitally dependent and interconnected, we are creating an environment where a cyberattack in one part of the sector can cascade across the entire sector," said Riggi. "Ultimately, this 'cyber blast radius' represents a systemic risk to patient safety and to national security. Understanding how health care and other critical infrastructure are digitally interconnected is imperative if we are to begin to defend key nodes and prepare for the disruptive impact that sophisticated criminal organizations and nation states are intent on delivering."

The tools could also be used to develop technologies to boost the long-term cyber resilience of critical infrastructure across other major sectors.

"What we're trying to do has never been done before - It's truly a moonshot idea," said Dameff. "Our motivation is safe digitally-connected patient care. But these tools could be extended far beyond health care and used to assess and strengthen the energy sector, finance, agriculture or manufacturing."

Source:

University of California - San Diego