View Policy Brief

06/2024

Hospitals face a growing threat from ransomware attacks that are designed to disrupt care delivery and may consequently threaten patient outcomes and hospital finances. While this overall phenomenon has received media and research attention, little is known about ransomware attacks on hospitals in rural areas. This policy brief presents findings from a novel database of hospital ransomware attacks, focusing on the frequency and characteristics of ransomware attacks on rural hospitals.

Key Findings:

• Rural hospitals experienced an increasing number of ransomware attacks from 2016 to 2021.
• From 2016 to 2021, 43 rural hospitals across 22 states experienced a ransomware attack.
• Ransomware attacks afflicted all types of rural hospitals, including Critical Access Hospitals (N=9), Sole Community Hospitals (N=13), Rural Referral Centers (N=3), and hospitals paid under Medicare's Inpatient Prospective Payment System (N=18).
• Eighty-four percent of ransomware attacks on rural hospitals resulted in operational disruptions. Common disruptions included electronic system downtime (81%), delays or cancellations in scheduled care (42%), and ambulance diversion (33%). Operational disruptions were similar in rural and urban hospital settings.

University of Minnesota Rural Health Research Center

Hannah Neprash, Claire McGlave, Katie Rydberg, Carrie Henning-Smith

Health information technology, Healthcare access, Hospitals and clinics, Telehealth