National Security and Strategic Planning National Security and Strategic Planning Национальная безопасность и стратегическое планирование 2307-1400 100902 10.37468/2307-1400-2024-4-60-76 Экономическая безопасность Economic security Экономическая безопасность The relationship between information, economic and social security in the healthcare system Взаимосвязь информационной, экономической и социальной безопасности в системе здравоохранения https://orcid.org/0000-0003-4437-7603 Варзин Сергей Александрович Varzin Sergey A. drvarzin@mail.ru

доктор медицинских наук;

doctor of medical sciences;

 Матвеев Владимир Владимирович Matveev Vladimir V. 070355mvv@gmail.com

доктор технических наук;кандидат экономических наук;

doctor of technical sciences;candidate of economic sciences;

 Санкт-Петербургский государственный университет Россия Saint Petersburg State University Russian Federation Санкт-Петербургский медико-социальный институт Санкт-Петербург Россия St. Petersburg Medical and Social Institute St. Petersburg Russian Federation Санкт-Петербургский филиал Финансового университета при Правительстве РФ Financial University under the Government of the Russian Federation, St. Petersburg branch 31 12 2024 31 12 2024 2024 4 60 76 16 11 2024 21 12 2024 https://futurepubl.ru/en/nauka/article/100902/view

Актуальность настоящего исследования обусловлена значительным ростом киберугроз в сфере здравоохранения, усилившимся после пандемии COVID-19, и высокой уязвимостью медицинских учреждений перед атаками, как со стороны внешних злоумышленников, так и внутренних нарушителей. Утечки конфиденциальной информации в здравоохранении несут не только экономический и имиджевый ущерб, но и прямую угрозу здоровью и жизни пациентов. В статье представлен всесторонний анализ состояния информационной безопасности в системе здравоохранения на основе статистики инцидентов за 2023–2024 годы. Авторы выделяют основные источники угроз – хакерские атаки, небрежность и злонамеренные действия персонала, а также недостаточную цифровую зрелость учреждений, проявляющуюся в устаревшем программном обеспечении и нехватке специалистов по информационной безопасности. Особое внимание уделено экономическим последствиям инцидентов информационной безопасности и международной практике регулирования, включая сравнительный анализ санкционных механизмов в России и за рубежом. Научная новизна исследования заключается в комплексном подходе к оценке взаимосвязи информационной, экономической и социальной безопасности в контексте цифровизации системы здравоохранения. Практическая значимость работы заключается в формировании основ для разработки эффективных стратегий управления рисками в области информационной безопасности медицинских организаций, включая обучение персонала, внедрение мониторинга действий сотрудников и повышение штрафных санкций за нарушения.

The relevance of this study is due to the significant increase in cyber threats in the healthcare sector, which has intensified after the COVID-19 pandemic, and the high vulnerability of medical institutions to attacks from both external and internal attackers. Leaks of confidential information in healthcare not only cause economic and image damage, but also pose a direct threat to the health and lives of patients. The article presents a comprehensive analysis of the state of information security in the healthcare system based on incident statistics for 2023-2024. The authors highlight the main sources of threats - hacker attacks, negligence and malicious actions of personnel, as well as insufficient digital maturity of institutions, manifested in outdated software and a shortage of information security specialists. Particular attention is paid to the economic consequences of information security incidents and international regulatory practices, including a comparative analysis of sanctions mechanisms in Russia and abroad. The scientific novelty of the study lies in the integrated approach to assessing the relationship between information, economic and social security in the context of the digitalization of the healthcare system. The practical significance of the work lies in the formation of the basis for the development of effective risk management strategies in the field of information security of medical organizations, including staff training, the introduction of monitoring of employee actions and increasing penalties for violations.

 информационная безопасность здравоохранение кибератаки утечки данных персональные данные экономический ущерб information security healthcare cyber attacks data leaks personal data economic damage

Галлезе-Нобиле К. Правовые аспекты использования искусственного интеллекта в телемедицине // Journal of Digital Technologies and Law. – 2023. – Т. 1, № 2. – С. 314-336. – DOI 10.21202/jdtl.2023.13. – EDN VSKCFB. Gallese-Nobile K. Legal aspects of using artificial intelligence in telemedicine // Journal of Digital Technologies and Law. – 2023. – Vol. 1, No. 2. – Pp. 314-336. – DOI 10.21202/jdtl.2023.13. – EDN VSKCFB. Харченко Е.Б., Шейдаков Н.Е. Об опасности кибератак на ис учреждений здравоохранения // Информационные системы, экономика и управление : Ученые записки. Том Выпуск 23. – Ростов-на-Дону: Ростовский государственный экономический университет "РИНХ", 2021. – С. 76-79. – EDN YNZFOW. Kharchenko E.B., Sheydakov N.E. On the danger of cyberattacks on the information systems of healthcare institutions // Information systems, economics and management: Scientific notes. Volume Issue 23. – Rostov-on-Don: Rostov State University of Economics "RINH", 2021. - Pp. 76-79. - EDN YNZFOW. Зайцев А.К., Матвеев В.В. Экономические преступления с использованием цифровых технологий // Национальная безопасность и стратегическое планирование. – 2022. – № 1(37). – С. 63-81. – DOI 10.37468/2307-1400-2022-1-63-81. – EDN WFNIFZ. Zaitsev A.K., Matveev V.V. Economic crimes using digital technologies // National security and strategic planning. – 2022. – No. 1(37). – P. 63-81. – DOI 10.37468/2307-1400-2022-1-63-81. – EDN WFNIFZ. Антонов А.Е., Матвеев В.В. Обеспечение экономической безопасности с использованием DLP системы (искусственного интеллекта) // Теоретические и прикладные вопросы комплексной безопасности: Материалы V Международной научно-практической конференции, Санкт-Петербург, 23 марта 2022 года. – СПб: Санкт-Петербургский институт природопользования, промышленной безопасности и охраны окружающей среды, 2022. – С. 251-257. – EDN DEOZZA. Antonov A.E., Matveev V.V. Ensuring economic security using a DLP system (artificial intelligence) // Theoretical and applied issues of integrated security: Proceedings of the V International scientific and practical conference, St. Petersburg, March 23, 2022. – SPb: St. Petersburg Institute of Nature Management, Industrial Safety and Environmental Protection, 2022. – P. 251-257. – EDN DEOZZA. Shekokar N. M. et al. (ed.). Cyber Security Threats and Challenges Facing Human Life. – CRC Press, 2022. Shekokar N. M. et al. (ed.). Cyber Security Threats and Challenges Facing Human Life. – CRC Press, 2022. Аналитика в сфере утечки информации [Электронный ресурс]. – Режим доступа: https://www.infowatch.ru/analytics Analytics in the field of information leakage [Electronic resource]. – Access mode: https://www.infowatch.ru/analytics Трусов Ю.А., Антипов А.В. Право на забвение: опыт практического анализа // Цифровые технологии и право: Сборник научных трудов I Международной научно-практической конференции. В 6-ти томах, Казань, 23 сентября 2022 года. – Казань: Издательство "Познание", 2022. – С. 362-366. – EDN HAUILR. Trusov Yu.A., Antipov A.V. The right to be forgotten: experience of practical analysis // Digital technologies and law: Collection of scientific papers of the I International scientific and practical conference. In 6 volumes, Kazan, September 23, 2022. – Kazan: Publishing house "Poznanie", 2022. – P. 362-366. – EDN HAUILR. Moore W., Frye S. Review of HIPAA, part 1: history, protected health information, and privacy and security rules // Journal of nuclear medicine technology. – 2019. – V. 47. – No 4. – P. 269-272. – DOI: https://doi.org/10.2967/jnmt.119.227819 Moore W., Frye S. Review of HIPAA, part 1: history, protected health information, and privacy and security rules // Journal of nuclear medicine technology. – 2019. – V. 47. – No 4. – P. 269-272. – DOI: https://doi.org/10.2967/jnmt.119.227819 Kiel J. M., Ciamacco F. A., Steines B. T. Privacy and data security: HIPAA and HITECH // Healthcare information management systems: Cases, strategies, and solutions. – 2016. – P. 437-449. – DOI: https://doi.org/10.1007/978-3-319-20765-0_25 Kiel J. M., Ciamacco F. A., Steines B. T. Privacy and data security: HIPAA and HITECH // Healthcare information management systems: Cases, strategies, and solutions. – 2016. – P. 437-449. – DOI: https://doi.org/10.1007/978-3-319-20765-0_25 EyeMed agrees $600,000 settlement over 2020 data breach [Электронный ресурс]. – Режим доступа: https://www.zdnet.com/article/eyemed-us-attorney-agree-600000-settlement-over-2020-data-breach/ EyeMed agrees $600,000 settlement over 2020 data breach URL: https://www.zdnet.com/article/eyemed-us-attorney-agree-600000-settlement-over-2020-data-breach/ Swasey K. Insufficient healthcare cybersecurity invites ransomware attacks and sale of phi on the dark web // Center for Anticipatory Intelligence Student Research Reports. – 2020. URL: https://www.usu.edu/cai/files/studentpaper-swasey.pdf Swasey K. Insufficient healthcare cybersecurity invites ransomware attacks and sale of phi on the dark web // Center for Anticipatory Intelligence Student Research Reports. – 2020. URL: https://www.usu.edu/cai/files/studentpaper-swasey.pdf Reeves K. Cyberattacks: Not a Matter of If, but When // Applied Radiology. – 2024. – V. 53. – No 2. – P. 38-41. URL: https://cdn.agilitycms.com/applied-radiology/PDFs/Issues/AR_03-24_radmatters.pdf Reeves K. Cyberattacks: Not a Matter of If, but When // Applied Radiology. – 2024. – V. 53. – No 2. – P. 38-41. URL: https://cdn.agilitycms.com/applied-radiology/PDFs/Issues/AR_03-24_radmatters.pdf Оренбургские хакеры передавали данные скорой помощи ритуальным агентствам [Электронный ресурс]. – Режим доступа: https://www.securitylab.ru/news/532648.php Orenburg hackers transferred ambulance data to funeral agencies URL: https://www.securitylab.ru/news/532648.php Исследование утечек конфиденциальной информации из медицинских учреждений в 2017 году [Электронный ресурс]. – Режим доступа: https://www.infowatch.ru/sites/default/files/report/analytics/russ/InfoWatch_med2017.pdf Study of leaks of confidential information from medical institutions in 2017 URL: https://www.infowatch.ru/sites/default/files/report/analytics/russ/InfoWatch_med2017.pdf COVID-19: утечки периода пандемии (1 полугодие 2020) [Электронный ресурс]. – Режим доступа: https://www.infowatch.ru/analytics/analitika/covid-19-utechki-perioda-pandemii-1-polugodie-2020 COVID-19: leaks during the pandemic (1st half of 2020) URL: https://www.infowatch.ru/analytics/analitika/covid-19-utechki-perioda-pandemii-1-polugodie-2020More than 4,000 individuals’ medical data left exposed for 16 years. URL: https://portswigger.net/daily-swig/more-than-4-000-individuals-medical-data-left-exposed-for-16-years More than 4,000 individuals’ medical data left exposed for 16 years. URL: https://portswigger.net/daily-swig/more-than-4-000-individuals-medical-data-left-exposed-for-16-years More than 4,000 individuals’ medical data left exposed for 16 years. URL: https://portswigger.net/daily-swig/more-than-4-000-individuals-medical-data-left-exposed-for-16-years Rawat R. et al. Organ trafficking on the dark web—The data security and privacy concern in healthcare systems // Internet of Healthcare Things: Machine Learning for Security and Privacy. – 2022. – P. 189-216. – DOI: https://doi.org/10.1002/9781119792468.ch9 Rawat R. et al. Organ trafficking on the dark web—The data security and privacy concern in healthcare systems // Internet of Healthcare Things: Machine Learning for Security and Privacy. – 2022. – P. 189-216. – DOI: https://doi.org/10.1002/9781119792468.ch9 Gaming firm Razer wins lawsuit against IT vendor over data leak, awarded $8.7m in damages. URL: https://www.straitstimes.com/singapore/courts-crime/gaming-firm-razer-wins-lawsuit-against-it-vendor-over-data-leak-awarded-87m-in-damages Gaming firm Razer wins lawsuit against IT vendor over data leak, awarded $8.7m in damages. URL: https://www.straitstimes.com/singapore/courts-crime/gaming-firm-razer-wins-lawsuit-against-it-vendor-over-data-leak-awarded-87m-in-damages Mrežar F. Analysis of fines under GDPR. – University of Zagreb. Faculty of Law. Information Technology Law and Informatics, 2023. URL: https://repozitorij.pravo.unizg.hr/en/islandora/object/pravo:5002 Mrežar F. Analysis of fines under GDPR. – University of Zagreb. Faculty of Law. Information Technology Law and Informatics, 2023. URL: https://repozitorij.pravo.unizg.hr/en/islandora/object/pravo:5002 Meta fined €265m over data protection breach that hit more than 500m users. URL: https://www.theguardian.com/technology/2022/nov/28/meta-fined-265m-over-data-breach-affecting-more-than-500m-users Meta fined €265m over data protection breach that hit more than 500m users. URL: https://www.theguardian.com/technology/2022/nov/28/meta-fined-265m-over-data-breach-affecting-more-than-500m-users Heath M., Porter T. H., Silvera G. Hospital characteristics associated with HIPAA breaches // International Journal of Healthcare Management. – 2022. – V. 15. – No 2. – P. 171-180. – DOI: https://doi.org/10.1080/20479700.2020.1870349 Heath M., Porter T. H., Silvera G. Hospital characteristics associated with HIPAA breaches // International Journal of Healthcare Management. – 2022. – V. 15. – No 2. – P. 171-180. – DOI: https://doi.org/10.1080/20479700.2020.1870349 Five former Methodist Hospital employees charged with HIPAA violations. URL: https://www.databreaches.net/five-former-methodist-hospital-employees-charged-with-hipaa-violations/ Five former Methodist Hospital employees charged with HIPAA violations. URL: https://www.databreaches.net/five-former-methodist-hospital-employees-charged-with-hipaa-violations/ AstraZeneca password lapse exposed patient data. URL: https://techcrunch.com/2022/11/03/astrazeneca-passwords-exposed-patient-data/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZGF0YWJyZWFjaGVzLm5ldC8&guce_referrer_sig=AQAAAAE8Y-wn6fo1Qi-8AU_fm0vQeRXNT33dCZm9xadXJu-GZWz74n7EcPfHE32674LobeN4v1ZqAtZSv0juf8txbWO4h84jFb0rLKorSpG0Uv514Oa95_LvoJVpkDniwzWwBy_PjdW8N1rfJTEQdOr_XzjK0b69LDt9eP2nAzyO9o72 AstraZeneca password lapse exposed patient data. URL: https://techcrunch.com/2022/11/03/astrazeneca-passwords-exposed-patient-data/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZGF0YWJyZWFjaGVzLm5ldC8&guce_referrer_sig=AQAAAAE8Y-wn6fo1Qi-8AU_fm0vQeRXNT33dCZm9xadXJu-GZWz74n7EcPfHE32674LobeN4v1ZqAtZSv0juf8txbWO4h84jFb0rLKorSpG0Uv514Oa95_LvoJVpkDniwzWwBy_PjdW8N1rfJTEQdOr_XzjK0b69LDt9eP2nAzyO9o72 Besenyő J. Security Science Journal Healthcare Cybersecurity Threat Context and Mitigation Opportunities (Vol. 4 No. 1, 2023. Security Science Journal). – DOI: https://doi.org/10.37458/ssj.4.1.6 Besenyő J. Security Science Journal Healthcare Cybersecurity Threat Context and Mitigation Opportunities (Vol. 4 No. 1, 2023. Security Science Journal). – DOI: https://doi.org/10.37458/ssj.4.1.6 Oops, web trackers may have leaked 3 million patients' info. URL: https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/ Oops, web trackers may have leaked 3 million patients' info. URL: https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/ 300K Patients' Data Compromised In Ransomware Attack On Yonkers-Based Empress EMS. URL: https://patch.com/new-york/newrochelle/300k-patients-compromised-ransomware-attack-empress-ems 300K Patients' Data Compromised In Ransomware Attack On Yonkers-Based Empress EMS. URL: https://patch.com/new-york/newrochelle/300k-patients-compromised-ransomware-attack-empress-ems Kayes A. S. M. et al. Safeguarding Individuals and Organisations from Privacy Breaches: A Comprehensive Review of Problem Domains, Solution Strategies, and Prospective Research Directions // IEEE Internet of Things Journal. – 2024. – DOI: https://doi.org/10.1109/JIOT.2024.3481316 Kayes A. S. M. et al. Safeguarding Individuals and Organisations from Privacy Breaches: A Comprehensive Review of Problem Domains, Solution Strategies, and Prospective Research Directions // IEEE Internet of Things Journal. – 2024. – DOI: https://doi.org/10.1109/JIOT.2024.3481316 How a massive data breach has exposed Australia. URL: https://www.saudigazette.com.sa/article/625539/World/Asia/How-a-massive-data-breach-has-exposed-Australia How a massive data breach has exposed Australia. URL: https://www.saudigazette.com.sa/article/625539/World/Asia/How-a-massive-data-breach-has-exposed-Australia Alleged Optus hacker apologises for data breach and drops ransom threat. URL: https://www.theguardian.com/business/2022/sep/27/alleged-optus-hacker-apologises-for-data-breach-and-drops-ransom-threat Alleged Optus hacker apologises for data breach and drops ransom threat. URL: https://www.theguardian.com/business/2022/sep/27/alleged-optus-hacker-apologises-for-data-breach-and-drops-ransom-threat Thomas J. Individual cyber security: Empowering employees to resist spear phishing to prevent identity theft and ransomware attacks // Thomas, JE (2018). Individual cyber security: Empowering employees to resist spear phishing to prevent identity theft and ransomware attacks. International Journal of Business Management. – 2018. – V. 12. – No 3. – P. 1-23. – DOI: 10.5539/ijbm.v13n6p1 Thomas J. Individual cyber security: Empowering employees to resist spear phishing to prevent identity theft and ransomware attacks // Thomas, JE (2018). Individual cyber security: Empowering employees to resist spear phishing to prevent identity theft and ransomware attacks. International Journal of Business Management. – 2018. – V. 12. – No 3. – P. 1-23. – DOI: 10.5539/ijbm.v13n6p1 SCOOP: Glenn County Office of Education Pays $400K Ransom After Ransomware Attack. URL: https://www.databreaches.net/scoop-glenn-county-office-of-education-paid-400k-ransom-after-ransomware-attack/ SCOOP: Glenn County Office of Education Pays $400K Ransom After Ransomware Attack. URL: https://www.databreaches.net/scoop-glenn-county-office-of-education-paid-400k-ransom-after-ransomware-attack/ LockBit Publishes Stolen Data as Hospital Rejects Extortion. URL: https://www.bankinfosecurity.com/lockbit-publishes-stolen-data-as-hospital-rejects-extortion-a-20155 LockBit Publishes Stolen Data as Hospital Rejects Extortion. URL: https://www.bankinfosecurity.com/lockbit-publishes-stolen-data-as-hospital-rejects-extortion-a-20155 BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2,5M in Demands. URL: https://resecurity.com/blog/article/blackcat-aka-alphv-ransomware-is-increasing-stakes-up-to-25m-in-demands BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2,5M in Demands. URL: https://resecurity.com/blog/article/blackcat-aka-alphv-ransomware-is-increasing-stakes-up-to-25m-in-demands Варзин С.А., Матвеев В.В. Обеспечение информационной безопасности в системе здравоохранения // Национальная безопасность и стратегическое планирование. – 2023. – № 3(43). – С. 19-56. – DOI 10.37468/2307-1400-2024-2023-3-19-56. – EDN ONKEFE. Varzin S.A., Matveev V.V. Ensuring information security in the healthcare system // National security and strategic planning. – 2023. – No. 3 (43). – P. 19-56. – DOI 10.37468/2307-1400-2024-2023-3-19-56. – EDN ONKEFE. Ige T. O., Frimpong A. A., Akinbobola B. A. Mitigating Cybersecurity Threats in the Healthcare Sector: An Analysis of Challenges and Solutions in the USA // Journal of Energy Technologies and Policy. – 2024. – V. 14. – No 2. – P. 66-76. – DOI: 10.7176/JETP/14-2-05 Ige T. O., Frimpong A. A., Akinbobola B. A. Mitigating Cybersecurity Threats in the Healthcare Sector: An Analysis of Challenges and Solutions in the USA // Journal of Energy Technologies and Policy. – 2024. – V. 14. – No 2. – P. 66-76. – DOI: 10.7176/JETP/14-2-05 Campbell R. J. Cybersecurity Vulnerabilities and Considerations in US Healthcare Facilities: A Scoping Review. – 2024. URL: https://digitalcommons.unmc.edu/coph_slce/352 Campbell R. J. Cybersecurity Vulnerabilities and Considerations in US Healthcare Facilities: A Scoping Review. – 2024. URL: https://digitalcommons.unmc.edu/coph_slce/352