AdventHealth, HonorHealth and Cleveland Clinic: Radiology vs. ransomware: How to defend imaging departments against cyberattacks

Cybersecurity Experts Outline Critical Steps for Healthcare Cyberattack Recovery

A recent discussion led by cybersecurity and healthcare IT experts including Po-Hao Chen (Cleveland Clinic), Benoît Desjardins (CHUM/University of Pennsylvania), Reza Forghani (AdventHealth), and James T. Whitfill (HonorHealth/Arizona State University) highlighted the urgent need for structured response plans in the event of a cyberattack on healthcare systems.

During the session, Prof. Whitfill emphasized that hospital incident command teams must prioritize operational continuity while technology response teams assess the attack’s scope. Key steps include:

• Tracing the attack’s origin by analyzing backups to identify a secure restoration point.
• Evaluating backup viability to ensure uncontaminated recovery options.
• Predefining restoration priorities, particularly for critical clinical systems like radiology, to minimize errors and manual reconciliation of reports and images.

The experts stressed the importance of proactive preparation, including:

• Cross-departmental leadership collaboration to assess risks (e.g., radiology network downtime).
• Simulation exercises to test and refine recovery plans, addressing discrepancies in downtime protocols.
• Repeated training to ensure teams can execute recovery procedures efficiently, even under piecemeal restoration conditions.

The discussion underscored that improvised responses during an attack increase the risk of errors, reinforcing the need for structured, scenario-based planning to safeguard patient care and data integrity. The insights align with broader industry guidance, such as the ACR/SIIM white paper on radiology cybersecurity, co-authored by Chen.

Source: https://healthcare-in-europe.com/en/news/radiology-ransomware-cyberattack.html

AdventHealth TPRM report: https://www.rankiteo.com/company/adventhealth

HonorHealth TPRM report: https://www.rankiteo.com/company/honorhealth

Cleveland Clinic TPRM report: https://www.rankiteo.com/company/clevelandclinic

"id": "honadvcle1788411543",
"linkid": "honorhealth, adventhealth, clevelandclinic",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Healthcare',
                        'name': 'Cleveland Clinic',
                        'type': 'Healthcare Provider'},
                       {'industry': 'Healthcare',
                        'name': 'CHUM',
                        'type': 'Healthcare Provider'},
                       {'industry': 'Healthcare/Education',
                        'name': 'University of Pennsylvania',
                        'type': 'Educational/Healthcare Institution'},
                       {'industry': 'Healthcare',
                        'name': 'AdventHealth',
                        'type': 'Healthcare Provider'},
                       {'industry': 'Healthcare',
                        'name': 'HonorHealth',
                        'type': 'Healthcare Provider'},
                       {'industry': 'Education',
                        'name': 'Arizona State University',
                        'type': 'Educational Institution'}],
 'description': 'Cybersecurity and healthcare IT experts outlined critical '
                'steps for healthcare cyberattack recovery, emphasizing '
                'structured response plans, operational continuity, and '
                'proactive preparation to safeguard patient care and data '
                'integrity.',
 'impact': {'operational_impact': 'Disruption to patient care and clinical '
                                  'operations, potential errors in manual '
                                  'reconciliation of reports and images',
            'systems_affected': ['radiology systems', 'clinical systems']},
 'lessons_learned': 'Improvised responses during an attack increase the risk '
                    'of errors; structured, scenario-based planning is '
                    'essential for safeguarding patient care and data '
                    'integrity.',
 'recommendations': ['Prioritize operational continuity during cyberattacks',
                     'Analyze backups to identify secure restoration points',
                     'Predefine restoration priorities for critical systems',
                     'Conduct cross-departmental risk assessments',
                     'Perform simulation exercises to test recovery plans',
                     'Provide repeated training for efficient execution of '
                     'recovery procedures'],
 'references': [{'source': 'ACR/SIIM white paper on radiology cybersecurity'}],
 'response': {'incident_response_plan_activated': 'Structured response plans '
                                                  'emphasized',
              'recovery_measures': ['Restoration of critical systems like '
                                    'radiology',
                                    'Cross-departmental leadership '
                                    'collaboration',
                                    'Simulation exercises and repeated '
                                    'training'],
              'remediation_measures': ['Tracing the attack’s origin by '
                                       'analyzing backups',
                                       'Evaluating backup viability for '
                                       'uncontaminated recovery',
                                       'Predefining restoration priorities for '
                                       'critical clinical systems']},
 'title': 'Healthcare Cyberattack Recovery Discussion',
 'type': 'Cyberattack Discussion/Framework'}