What happens to rural hospitals during a ransomware attack? Evidence from Medicare data.

PURPOSE: Hospitals are increasingly the target of cybersecurity threats, including ransomware attacks. Little is known about how ransomware attacks affect care at rural hospitals. METHODS: We used data on hospital ransomware attacks from the Tracking Healthcare Ransomware Events and Traits database, linked to American Hospital Association survey data and Medicare fee-for-service (FFS) claims data from 2016 to 2021. We measured Medicare FFS volume and revenue in the inpatient, outpatient, and emergency room setting-at the hospital-week level. We then conducted a stacked event study analysis, comparing hospital volume and revenue at ransomware-attacked and nonattacked hospitals before and after attacks. FINDINGS: Ransomware attacks severely disrupted hospital operations-with comparable effects observed at rural versus urban hospitals. During the first week of the attack, inpatient admissions volume fell by 14.7% at rural hospitals (P = .04) and 16.9% at urban hospitals (P = .01)-recovering to preattack levels within 2-3 weeks. Outpatient visits fell by 35.3% at rural hospitals (P<.01) and 22.0% at urban hospitals (P = .03) during the first week. Emergency room visits fell by 10.0% at rural hospitals (P = .04) and 19.3% at urban hospitals (P = .01). Travel time and distance to the closest nonattacked hospital was 4-7 times greater for rural ransomware-attacked hospitals than for urban ransomware-attacked hospitals. CONCLUSIONS: Ransomware attacks disrupted hospital operations in rural and urban areas. Disruptions of similar magnitudes may be more detrimental in rural areas, given the greater distances patients must travel to receive care and the outsized impact that lost revenue may have on rural hospital finances.

Rural/urban differences in receipt of governmental rental assistance: Relationship to health and disability.

PURPOSE: Housing is essential to health. Governmental rental assistance is one way to increase access to affordable housing, but little is known about how it varies by rural/urban location. This paper seeks to address that gap by examining rural/urban and within-rural differences in receipt of rental assistance, with particular attention differences by health and disability. METHODS: We used data from the 2021 National Health Interview Survey (n = 28,254) to conduct bivariate analyses to identify significant differences in receipt of rental assistance by rural/urban location. We then conducted logistic regression analyses to generate odds ratios of receiving rental assistance, adjusting for self-rated health, disability, sociodemographic characteristics, and the US Census region. FINDINGS: When limiting the sample to those who rent (20.6% of rural residents and 29.6% of urban residents), rural residents were nearly 5 percentage points more likely to receive rental assistance (13.1% vs 8.2%, P<.001). Rural recipients of rental assistance were more likely to have a disability than urban residents (27.9% vs 20.3%, P<.05) and were more likely to report fair/poor health (41.6% vs 31.4%, P<.05). CONCLUSIONS: Rural residents are less likely to rent their homes, but, among those who rent, they are more likely to receive governmental rental assistance. This may be reflective of the greater need for rental assistance among rural residents, who were in poorer health and of lower socioeconomic status than urban renters. As housing is essential to good health, policy attention must prioritize addressing a persistent and growing need for affordable housing in rural and urban areas alike.

Characteristics of short-term acute care hospitals that experienced a ransomware attack from 2016 to 2021.

As cybercrime increasingly targets the health care sector, hospitals face the growing threat of ransomware attacks. Ransomware is a type of malicious software that prevents users from accessing their electronic systems-demanding payment to restore access. In response, momentum is gathering to enact policy that will help hospitals strengthen their cybersecurity defenses. However, to design effective policy, it is crucial to understand the characteristics of hospitals associated with the risk of ransomware attack. In this paper, we compare the characteristics of ransomware-attacked and non-attacked short-term acute care hospitals in the United States. Using data from the American Hospital Association's Annual Survey and the Healthcare Cost Report Information System, we found that ransomware-attacked hospitals were larger, had higher net operating revenue, were more likely to be financially profitable, and more likely to provide trauma, emergency, and obstetric care than non-attacked hospitals. Measures of information technology sophistication did not vary between ransomware-attacked and non-attacked hospitals. These results can be used to tailor policy interventions in order to most effectively respond to and prevent cybercrime in health care.