Ransomware Attacks on Hospitals and Their Effects on Emergency Department Operations and Patient Care: A Systematic Scoping Review

Abstract

Background: Ransomware attacks against hospitals differ from conventional health-data breaches because they are intentionally designed to render digital systems unavailable and disrupt organizational operations. Modern emergency departments depend on electronic health records, diagnostic imaging, laboratory systems, computerized prescribing, telecommunications, scheduling, and interconnected medical technologies. Loss of these systems may therefore affect both the attacked institution and the surrounding regional emergency-care network.
Objective: To systematically map high-quality evidence available through 2022 concerning the effects of hospital ransomware attacks on emergency department operations, clinical workflows, healthcare utilization, and patient safety.
Methods: A systematic scoping review was conducted using peer-reviewed literature published no later than 31 December 2022. Eligible references were restricted to first-quartile journals within health informatics, digital health, healthcare policy, medicine, and related disciplines. Evidence concerning ransomware events, unplanned digital downtime, healthcare cybersecurity, and consequences of health-information-system interruption was synthesized. Operational endpoints included electronic-system downtime, emergency department attendance, admissions, ambulance diversion, cancellation of care, manual documentation, and disruption duration. Clinical effects were examined separately from speculative or unverified harm.
Results: The strongest population-level evidence demonstrated substantial operational disruption. Analysis of the 2017 WannaCry attack showed approximately 6% fewer total admissions and 6% fewer emergency department attendances at infected NHS hospitals, with 1,100 fewer emergency admissions, 2,200 fewer elective admissions, approximately 3,800 fewer emergency attendances, and 13,500 cancelled outpatient appointments. No statistically significant increase in emergency-department mortality was identified. A subsequent US cohort documented 374 healthcare ransomware attacks between 2016 and 2021; 44.4% disrupted healthcare delivery, 41.7% caused electronic-system downtime, 10.2% caused scheduled-care delays or cancellations, and 4.3% resulted in ambulance diversion. Mean documented disruption duration was 15.8 days. Broader downtime evidence showed that cyberattacks constituted a substantial proportion of reported hospital downtime incidents and that digital unavailability forces rapid transition to manual workflows.
Conclusion: Hospital ransomware should be conceptualized as an operational and patient-safety emergency rather than solely an information-security breach. The clearest pre-2023 evidence demonstrates disruption of emergency access, clinical capacity, diagnostic and documentation workflows, and scheduled care. Direct mortality effects remained insufficiently established. Cyber resilience should therefore incorporate clinical downtime preparedness, regional surge planning, recoverable infrastructure, and cybersecurity measures designed around continuity of patient care.