Cybersecurity as Clinical Care:
Integrating Human Behavior, Systems
Design and Physician Well-Being
by Bhupendra Kishore Gupta, MD, DPM
Introduction
The digitization of healthcare has fundamentally altered the nature of clinical risk. Electronic health records( EHRs), e-prescribing systems and payer-integrated platforms now underpin nearly every aspect of care delivery. While these systems have improved efficiency and coordination, they have also introduced vulnerabilities that directly threaten patient safety. Cybersecurity incidents are no longer confined to data loss or financial consequences. Increasingly, they disrupt clinical operations, delay treatment and compromise access to essential medications. As a result, cybersecurity must be reframed, not as a technical issue, but as a core patient safety concern.
This reframing requires more than technical solutions. It demands a broader model of care, one that recognizes the clinician not only as a user of systems, but as an active determinant of system integrity.
The Scope of the Problem
Healthcare has become the most targeted industry for cyberattacks, with breach-related costs exceeding those of any other sector. In 2024,
the average cost of a healthcare data breach surpassed $ 10 million, reflecting not only financial loss but also operational disruption and patient harm. These costs exceed those seen in the finance, energy and government sectors.
Cybersecurity Events as Clinical Events
Recent large-scale cyber incidents have demonstrated the systemic consequences of digital infrastructure failure, including interruptions in pharmacy services, insurance verification and prior authorization workflows. These disruptions are not theoretical. Delays in medication access, interruptions in oncology treatments and barriers to behavioral health services have all been documented following major cyber events. In this context, cybersecurity failures should be recognized as clinical events with measurable patient impact.
A ransomware attack that prevents access to an EHR is not merely an operational inconvenience; it is functionally equivalent to the loss of a critical diagnostic tool. A compromised prescribing system is not simply an IT issue; it directly alters the clinician’ s ability to deliver care. The downstream consequences( missed doses, delayed diagnoses, fragmented
22 LOUISVILLE MEDICINE