[Resilience against IT attacks in hospitals : Results from an exercise in a German university hospital]. / Resilienz gegen IT-Angriffe an Kliniken : Ergebnisse einer Stabsrahmenübung an einem Universitätsklinikum.

BACKGROUND: According to the legal definition healthcare systems and their components (e.g., hospitals) are part of the critical infrastructure of modern industrial nations. During the last few years hospitals increasingly became targets of cyber attacks causing severe impairment of their operability for weeks or even months. According to the German federal strategy for protection of critical infrastructures (KRITIS strategy), hospitals are obligated to take precautions against potential cyber attacks or other IT incidents. OBJECTIVE: This article describes the process of planning, execution and results of an advanced table-top exercise which took place in a university hospital in Germany and simulated the first 3 days after a cyber attack causing a total failure of highly critical IT systems. MATERIAL AND METHODS: During a first stage lasting about 8 months IT-dependent processes within the clinical routine were identified and analyzed. Then paper-based and off-line back-up processes and workarounds were developed and department-specific emergency plans were defined. Finally, selected central facilities such as pharmacy, laboratory, radiology, IT and the hospitals crisis management team took part in the actual disaster exercise. Afterwards the participants were asked to evaluate the exercise and the hospitals cyber security using a questionnaire. On this basis the authors visualized the hospital's resilience against cyber incidents and defined short-term, medium-term and long-term needs for action. RESULTS: Of the participants 85% assessed the exercise as beneficial, 97% indicated that they received adequate support during the preparations and 75% had received sufficient information; however, only 34% had the opinion that the hospital's and their own preparedness against critical IT failures were sufficient. Before the exercise took place, IT-specific emergency plans were present only in 1.7% of the hospital facilities but after the exercise in 86.7% of the clinical and technical departments. The highest resilience against cyber attacks was not surprisingly reported by facilities that still work routinely with paper-based or off-line processes, the IT department showed the lowest resilience as it would come to a complete shutdown in cases of a total IT failure. CONCLUSION: The authors concluded that the planning phase is the most important stage of developing the whole exercise, giving the best opportunity for working out fallback levels and workarounds and through this strengthen the hospitals resilience against cyber attacks and comparable incidents. A meticulous preparedness can minimize the severe effects a total IT failure can cause on patient care, staff and the hospital as a whole.

[Exit wave plan for structured secondary patient distribution : Logistic concept for mass victims of terrorist attacks]. / Exit-Wellenplan zur geordneten sekundären Patientenverteilung : Logistikkonzept bei Massenanfall von Terroropfern.

BACKGROUND: Following a terrorist attack a second hit is to be feared. The adequate reaction of the emergency services on site is to clear the scene. Since in such cases no treatment areas are set up at the scene of the incident, the injured are quickly admitted to the nearest hospital, either by themselves or by the emergency services and are largely untreated. Therefore, the hospital has to be ready to take in a significantly larger number of injured people in a very short period of time than after a conventional mass casualty incident. Due to the conceivably large number of wounded persons the emergency department can ensure primary medical care but nowhere near all casualties admitted to the hospital can be definitively treated. OBJECTIVE: In order to provide injured patients with individual medical care after initial treatment according to the criteria of damage control resuscitation, a concept should be developed that enables a well-organized secondary transfer to receiving hospitals with appropriate equipment. MATERIAL AND METHODS: Within a radius of 100 km from Ulm, all hospitals certified by the German Society for Trauma Surgery were contacted and asked to indicate how many emergency patients of the triage categories T1 (red), T2 (yellow) and T3 (green) could be admitted and treated around the clock (24/7). Special features such as a helicopter landing pad, neurosurgical care and pediatric traumatology care were considered. RESULTS: Of the 32 hospitals within a 100 km radius of Ulm 29 (91%) provided information on the admission capacity. In these hospitals 45 T1, 121 T2 and 333 T3 patients could be admitted around the clock (24/7). A helicopter landing pad is available at 26 of the 29 hospitals (90%), 11 hospitals (38%) can treat patients for emergency neurosurgery and 18 hospitals (62%) have the possibility of pediatric traumatological emergency care. Based on this information the structured exit wave plan was developed, which enables a secondary transfer of at least 100 patients to qualified trauma centers. CONCLUSION: The University Hospital of Ulm has made preparations to admit at least 100 injured patients for initial medical treatment following a terrorist attack. This corresponds to 10% of the hospital beds as required in the literature. Together with the neighboring Military Hospital and the University and Rehabilitation Hospital Ulm up to 300 injured patients can be treated; however, the number of available intensive care unit (ICU) beds and capacities in normal wards for definitive care is much lower, therefore, patients treated according to the principles of damage control resuscitation have to be relocated. By documenting the capacity of the hospitals within a 100 km radius around Ulm and taking their specific features into account, an exit wave plan could be created that enables patient distribution for definitive care without time-consuming procedures.