Assessing the impact of technology partners on the level of cyberattack damage in hospitals

• Our study uses an operational research technique in the form of a discrete event simulation to comprehensively demonstrate the benefits of a technology partnership in reducing downtime costs, length of stay, staffing and missed patient arrivals in the event of an incident. • Our study provides a novel approach to economically evaluate a safety concept prior to its implementation in a hospital so that limited financial resources in healthcare can be better utilised. • Our study provides a practical and strategic approach for hospitals and medical device manufacturers to increase the security level of medical devices in joint co-operation and responsibility through the concept of technology partnership. Reliable performance of medical devices is crucial for hospitals. However, these devices are increasingly connected with the internet and, thus, prone to cyberattacks resulting in risks for patient safety and financial loss. As the number of specialists in this field is limited in most hospitals, technology partnerships with medical technology manufacturers can be a suitable concept for increasing the level of security or limiting damage in the event of a cyberattack. Based on a discrete event simulation model (DES), the effects of security incidents with different degrees of impact on downtime costs, length of stay, staff utilization and lost arrivals in an emergency department of a general hospital were modelled and simulated. The effects of a technology partnership were simulated using what-if scenarios in order to be able to draw conclusions about the benefits by comparing the avoidable damage effects and the investment costs incurred for a technology partnership. Depending on the scenario, the resulting savings range from €245,579 to €315,768, with a cost-benefit ratio between 4 and 5 over a 21-day period. Non-financial benefit (e.g. shorter lengths of stay or reduction IT resources) can also be achieved. Our analysis demonstrates that the level of security for hospitals and their medical devices as well as the operational functionality in the event of damage can be increased if such a concept it applied, i.e., patient safety can be increased while costs can be cut.