Spence, Niharika Bhardwaj [11] conducted a literature review focusing on ransomware attacks in healthcare facilities; their study was limited to sources published in English from 2005 to 2017. They addressed the financial costs of surviving ransomware attacks, reputation damage leading to loss of future business, and techniques for protecting against Ransomware, such as employees’ awareness and data backup. Moreover, Neprash, McGlave [12] questioned how often healthcare delivery organizations encounter ransomware attacks and how the attacks’ characteristics change over time. They concluded that the current reporting efforts of Ransomware attacks provide limited information. Their findings acknowledged that ransomware attacks disrupt care delivery and jeopardize data integrity. In another study, Dameff, Tully [13] concluded the potential medical risks that may occur due to ransomware attacks on patients with acute stroke conditions inside hospitals. None of the papers cited in the related work section is directly relevant to the focus of our study.

However, this paper investigates the ransomware attacks in US healthcare over the last ten years, from 2014 to 2024. Specifically, our study focuses on identifying which covered entity was highly targeted by ransomware criminals and also defines the common types of security gaps for this type of attack in the US healthcare industry. In addition, this paper contributes to increasing awareness of security gap types in the covered entities. Our findings will help healthcare practitioners, engineers, and security developers better protect patient data against ransomware attacks, which will help reduce future ransomware attacks in the US healthcare industry.

Boadu [16] discussed the importance of using theme analysis from a lived experience in the context of phenomenological research. Hence, the researchers of this study relied on theme analysis, specifically represented the theme analysis by tables; they used Microsoft Excel to navigate the US Department of Health and Human Services, Office for Civil Rights archived report, which includes the field of “Web Description” that describes additional information about the experiences of each breach. However, the additional information in the “Web Description” field includes words that describe the type of attack (e.g., ransom or ransomware).

The authors looked in the “Web Description” field for the keyword “ransom” and showed the results of all the ransomware attacks from 2014 to 2024. Although the analysis involved counting the keyword “ransom” and organizing results in tables below, it adheres to thematic analysis standards. Thematic interpretation was guided by experienced US healthcare practitioners who had experienced the ransomware attacks, ensuring analytical depth beyond simple frequency [17] .

The filtration was formulated only to show the results for US healthcare entities (A Healthcare Provider, A Health Plan, and A Healthcare Clearinghouse). The researchers of this study represented each healthcare entity by a theme.

In addition, the researchers have also used charts to enhance the interpretation of data.

The results show 469 ransomware breaches out of 4312 total breaches. Moreover, 38,250,199 individuals were affected by these 469 breaches. Table 1 shows the details of these numbers with percentages.

In addition, this study calculated the number of breaches categorized by a unique Location of Breach categories (Desktop Computer, Paper/File, Other, Electronic Medical Record, Email, Laptop, and Network Server), submitted annually between 2014 and 2024 for healthcare provider and health plan entities. No ransomware attacks occurred against the Healthcare Clearinghouse entity during that period. However, Figure 1 shows the findings for the healthcare provider entity as follows:

Their peak experience of ransomware attacks was 60 in 2019, 57 in 2020, 96 in 2021, 85 in 2022, and 37 in 2023. Moreover, the Network Server category shows the highest peak among these years, as a common security gap that ransomware criminals use.

Figure 2 shows the findings for the Health Plan Entity. Their peak experience of ransomware attacks was 0 in 2019, 8 in 2020, 16 in 2021, 9 in 2022, and 3 in 2023. The Network Server category also shows the highest peak among the following years: 2020, 2021, and 2023, as a common security gap that ransomware criminals use.

As shown in Table 1 , it answered the first research question. Healthcare Providers have the highest number of breaches and affected individuals, followed by the Health Plan entity, while there is no Healthcare Clearinghouse. Figure 1 and Figure 2 show the findings for Healthcare Provider Health Plan Entities. Both findings visualized their high peak experience of ransomware attacks during the COVID-19 pandemic lockdown period, particularly during the following years: 2019, 2020, 2021, 2022, and 2023. Both figures also show network servers as the highest security gap for ransomware criminals, which answers the second research question. However, remote working was a well-known phenomenon as a common business practice during the COVID-19 pandemic [18] [19] . Typically, remote working occurs outside healthcare entities, such as at home via a home network (e.g., Wireless Fidelity (WiFi) enables devices like smartphones, tablets, and laptops), where the security setup differs from that of healthcare entities.

According to the findings of this study, the researchers concluded that remote work from home in healthcare entities is likely risky for network security breaches unless it is well supported with robust network security mechanisms, such as enforcing the implementation of the National Institute of Standards and Technology (NIST), including NIST Special Publication (SP) 800-66 Revision 2 “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide.” Typically, healthcare entities implement the NIST SP 800-66 in their work environment.

As a part of the NIST SP 800-66 purpose and scope, it “aims to help educate readers about the security standards included in the HIPAA Security Rule and assist regulated entities in their implementation of the Security Rule.” [20] Healthcare entities may also develop a comprehensive network security training program for remote workers, including reinforcement of learning, reminders, ongoing education, webinars, and workshops. Security awareness techniques can be employed through Artificial Intelligence (AI) technologies. However, these steps are essential to help mitigate the potential risk of ransomware attacks caused by work-from-home workers. For example, [21] investigated the use of generative AI to enhance cybersecurity awareness training in the healthcare sector. Their approach incorporates AI-driven simulations and interactive scenarios designed to improve user engagement and retention of critical security concepts. This method has shown promise in strengthening defenses against cyber threats, including ransomware attacks, by making training more relevant and effective. Together, these AI-driven awareness programs empower users to understand ransomware mechanics, recognize high-risk behaviors, and respond effectively.

Moreover, some other National Institute of Standards and Technology (NIST) guidelines and standards, such as the NIST Cybersecurity Framework, NIST Special Publication (SP) 800-171, NIST Special Publication (SP) 800-53 Rev. 5, NIST Special Publication (SP) 800-61 Rev. 2, and NIST SP 1800-11, can be highly efficient for protecting against ransomware attacks.

Lastly, our study’s findings establish ongoing research about the relationship between remote work from home in healthcare entities and network security breaches. Future detailed studies are needed to confirm this relationship.

Certain breaches resulting from ransomware attacks involved multiple breach locations, such as “Electronic Medical Record, Network Server, Other”. To ensure the accuracy and consistency of the analysis, these cases were excluded from the study. Figure 1 and Figure 2 are excluded from these cases.

Ransomware attacks are common in US healthcare data breaches and have many other harmful consequences. However, this study attempts to examine the behavior of ransomware criminals in the US healthcare industry over the past 10 years. The findings show that ransomware attacks occurred most frequently during the COVID-19 pandemic lockdown period (2020, 2021, 2022, and 2023), when work-from-home was a common business practice for healthcare entities. The findings also show that the network server category has the highest number of breaches during the COVID-19 pandemic. Therefore, this study concluded that healthcare entities need to employ security standards and additional security awareness for work-from-home workers to help protect their entities from potential ransomware attacks.

The researchers express gratitude to all peer reviewers for their comments and feedback.

The data supporting the findings of this study are available in the U.S. Department of Health and Human Services-Office for Civil Rights [15] . However, the researchers are not responsible for and have no control over any changes to the availability of data provided by the U.S. Department of Health and Human Services - Office for Civil Rights [15] .