Health Care is in Intensive Care

The talk starts with the speaker's path from emergency medicine into healthcare security, using cardiac arrest as a frame. Minutes matter for blood flow to the brain, so delays sharply cut the chance of recovery. The talk argues that hospitals now depend heavily on connected devices, electronic records, cloud services and outside vendors. It traces recent attacks, including incidents at Change Healthcare and Ascension, where clinicians reported paper charts and lost monitoring.

The core evidence is a study of a 2021 ransomware attack on San Diego hospitals. At one hospital across the street from the affected systems, the attack drove up ambulance arrivals, longer waits, and more patients leaving before being seen. County-wide, hospitals spent record hours on ambulance diversion. Cardiac arrest patients who recovered with favorable neurologic function reportedly fell from about 40 percent to roughly 4.5 percent during the attack month. Lost records also made outcomes hard to measure afterward.

The closing argument treats restoration as the CPR of hospital cyber response, where speed matters most. Proposed steps include mapping critical vendors and technologies, joint planning with emergency managers and continuity staff, and replacement systems that can bridge care during an outage. Economic incentives and consolidation are presented as hard problems without easy fixes. The question-and-answer session returned to the lack of good data on hospital attacks and the financial pressures behind them.