From public health to cyber hygiene: Cybersecurity and Canada’s healthcare sector

Abstract

The COVID-19 pandemic has ushered in a wave of cyberattacks targeting the healthcare sector, including against hospitals, doctors, patients, medical companies, supply chains, universities, research laboratories, and public health organizations at different levels of jurisdiction and across the public and private sectors. Despite these concerns, cybersecurity in Canadian healthcare is significantly understudied. This article uses a series of illustrative examples to highlight the challenges, outcomes, and solutions Canada might consider in addressing healthcare cybersecurity. The article explores the various rationales by which Canadian healthcare may be targeted, unpacks several prominent types of cyberattack used against the healthcare sector, identifies the different malicious actors motivated to conduct such attacks, provides insights derived from three empirical cases of healthcare cyberattack (Boston Children’s Hospital [2014], Anthem [2015], National Health Service [2017]), and concludes with lessons for a Canadian response to healthcare cybersecurity from several international perspectives (e.g., Australia, New Zealand, the UK, Norway, and the Netherlands).