AIDA: A health informatics-oriented adaptive cybersecurity framework for clinically aware detection and response in healthcare

Healthcare organizations increasingly depend on integrated electronic health records, connected medical devices, and identity-aware clinical workflows, yet these health informatics systems remain vulnerable to ransomware, adversarial intrusion, and disruptive data exfiltration. This study positions AIDA (Awareness, Integration, Detection, and Adaptation) as a clinically aware security-analytics framework for healthcare information environments rather than as a purely technical intrusion-detection model. AIDA combines Random Forest, Autoencoder, and XGBoost models with multi-objective optimization and a Patient Care Disruption Index (PCDI) to support clinically informed response selection. The framework ingests EHR, IoMT, and access-control telemetry; correlates alerts across these streams; and was evaluated through temporally blocked validation, digital-twin simulation of a 300-bed hospital, breach backfitting, and comparative benchmarking against human-centric and machine-learning baselines. AIDA achieved an AUC of 0.961, an AUCPR of approximately 0.955, and an average detection latency of 18 s. In the simulated hospital environment, the framework reduced PCDI by approximately 37% relative to baseline conditions, retained strong interpretability through SHAP-supported explanations, and demonstrated broader scenario coverage than comparator frameworks. The results suggest that health informatics security can be improved when cyber defense is designed around multisource data fusion, workflow-aware decision support, and continuity-preserving intervention logic. AIDA therefore contributes not only a cybersecurity framework, but also an implementable model for protecting clinical information infrastructures without treating patient care continuity as a secondary concern. • AIDA is presented as a health informatics cybersecurity framework for EHR- and IoMT-enabled care environments. • The framework integrates multisource clinical and technical telemetry to support context-aware threat detection. • AIDA combines machine learning and multi-objective optimization to improve accuracy while limiting disruption. • The study introduces the Patient Care Disruption Index (PCDI) as a clinically meaningful evaluation metric. • In simulated hospital scenarios, AIDA achieved high discrimination performance and rapid detection response.