How could the new PANACEA-H project boost healthcare cyber resilience?

Key takeaways

The UC San Diego Center for Healthcare Cybersecurity is leading PANACEA-H, a project that aims to map the network dependencies hospitals rely on so the sector can find critical points of failure before a cyberattack or outage disrupts care. ARPA-H awarded the project up to $29.9 million over four years, with the full amount tied to performance milestones. Four teams will combine expert input from hospitals, internet data analysis, wireless monitoring and public information mining to build dependency maps that stay current as the sector changes.

What if hospitals and health systems knew about critical network dependencies before a cyberattack or outage caused widespread disruption to patient care? The Preventative Assessment and Network Analysis of Cyber Essential Abilities for Health (PANACEA-H) project aims to make that a reality.

The UC San Diego Center for Healthcare Cybersecurity is leading the multidisciplinary initiative to identify and monitor health sector dependencies in a new way.

“We are seeking to enable the entire sector to have a better sense of the dependencies and the relationships and critical points of failure that currently exist,” Jeff Tully, MD, co-director of the UC San Diego Center for Healthcare Cybersecurity and Sheldon Furst Endowed Chair of Anesthesiology at UC San Diego School of Medicine, said.

Digital Health Insights spoke with Tully and Katherine Izhikevich, a PhD student in the UC San Diego computer science department, about this effort, which is funded in part by the Advanced Research Projects Agency for Health (ARPA-H), and how it could build the foundation for more cyber resilience in healthcare and other critical infrastructure sectors.

PANACEA-H seeks to prevent incidents like the Change Healthcare ransomware attack

Tully traces the impetus for the project back to the 2024 Change Healthcare ransomware attack. That watershed incident showed just how disruptive an attack on a single critical point of the interconnected healthcare ecosystem could be. And at the time, many stakeholders had no idea of that vendor’s critical nature.

“As a member of the Center for Healthcare Cybersecurity and a practicing physician, I had never heard about this company before, the infrastructure that supported it, the role for these types of systems within the larger healthcare ecosystem,” Tully said.

PANACEA-H seeks to find those kinds of vital dependencies, enabling an understanding of the risk they represent. Tully noted that prior initiatives have had the same intention, but this project’s goal is to develop more comprehensive, dynamic mapping.

“Can we start to understand these dependencies and anticipate this future risk in a way that is empiric and data-driven and dynamic?” he said. “When systems consolidate, when they merge, when they break apart, when there are new players in the space, we can update these maps so they’re a living thing, not a static thing.”

The project brings together a multidisciplinary team to work on four different pillars

The PANACEA-H project is divided into four core pillars, each led by experts from various organizations and fields.

The American Hospital Association (AHA) will be leading ANALOG. By leveraging its relationships with hospitals across the country, it will gather insights from subject matter experts and further develop traditional methods of finding and mapping dependencies. PANACEA-H participants will be able to interact with AHA members to compare traditional approaches to the new technical efforts that emerge from the project.

The ANSWER component of PANACEA-H, led by UC San Diego computer science and engineering experts, focuses on developing some of these new methods. These experts, including Izhikevich, are gathering and analyzing internet data rather than conducting manual interviews.

“That can help us reveal how these internet services are relying on each other, which can then help us extrapolate: It seems like this hospital could be relying on these different SaaS services,” Izhikevich shared.

The goal is for this map of dependencies to continuously update, revealing potential problems before they cause downtime.

Through the AIRWAVE piece of the project, computer science and engineering leaders with UC San Diego and the University of Maryland will develop ways to monitor wireless and Bluetooth connections.

“Say there’s a new vulnerability discovered for a medical device. We might have a very good understanding of where that medical device is in the United States, which hospitals need to be contacted by stakeholders,” Izhikevich said.

Public health experts from the University of Minnesota are leading the final piece of the project, ANDMORE. They are developing a technique to mine public information from a variety of sources, such as social media and job postings, at scale to infer software and network dependencies.

While each component of PANACEA-H has a different focus, the multidisciplinary experts involved in each are seeking to create a comprehensive way to understand and protect the interconnected healthcare ecosystem.

“It’s very necessary to have each of these components. Without the medical side, without the wireless side, without the measurement side, there are missing pieces,” Izhikevich said.

ARPA-H awarded the project up to $29.9 million over four years

PANACEA-H has support from the ARPA-H award, but Tully emphasized that receiving the full amount will be contingent on demonstrating tangible return on that investment.

“They [ARPA-H] are a high-risk, high-reward, moonshot-style agency. That comes with very rigorous performance milestones,” he said.

The stakeholders involved in the initiative will be hard at work validating the mapping techniques they develop and sharing updates along the way, according to Tully.

PANACEA-H has potential for cyber resilience in healthcare and beyond

The importance of cyber resilience for critical infrastructure is increasingly recognized, making projects like PANACEA-H possible.

“Five years ago, there would be no appetite for a large, ambitious, innovative, whole-ecosystem initiative like this,” Tully said.

If this ambitious project is successful, stakeholders across federal, state and local government agencies and health systems will have access to mapping tools that help them understand the dependencies that exist and better prepare for the risk of one of those dependencies failing.

Stakeholders in other critical infrastructure sectors could potentially apply these same tools and techniques to better understand their network dependencies and become more cyber resilient.

“[Our intention is] not to map out weaknesses or identify ways in which any individual institution may be less protected than it should be,” Tully said. “It’s to ensure that we are operating in the future in a much more resilient and aware environment.”

Carrie Pallardy, a Chicago-based freelance writer and editor, began her career covering healthcare more than a decade ago. Her work has taken her into many different industries, but covering healthcare delivery remains a constant focus. She can be reached at [email protected] or on LinkedIn.