How to get prepared for the worst-case scenario
Prof. Whitfill explained that a hospital incident command will have the goal of maintaining operations and prioritising needs. Technology response teams will start by assessing the extent of the attack. They go to backup copies and work backwards to try to identify where and when the attack began – to find a safe space to start the restoration. It is imperative to evaluate the viability of backups. Restoration plans for different scenarios, such as bare metal restore and file restoration, are needed because it may be necessary to replace contaminated hardware as well as reinstall software.
The expert provided his audience with a comprehensive list on how to prepare: ‘Bring every potentially impacted leadership team into the same room to hear the consequences that radiology network downtime would cause. Get feedback. Develop and play simulation exercises. Compare simulated downtime events for discrepancies with downtime plans. Make corrections.’
‘Recovery may be very piecemeal. System restoration versus system recovery are different. Predefine which clinical systems are restored first. Improvised work introduces errors which need to be identified. Reports and images have to be reconciled, and critical findings may have to be added manually. All this needs to be planned for. Educate, educate, educate. Practice simulations regularly and repeatedly’, Prof. Whitfill concluded.
Profiles:
Po-Hao Chen, MD, is Vice Chair of Artificial Intelligence and Medical Director for Enterprise Radiology Informatics at the Enterprise Diagnostics Institute of Cleveland Clinic in Ohio, USA. He chairs SIIM’s security subcommittee and is the lead author of the ACR/SIIM white paper on protecting radiology data and devices against cybersecurity threats.
Benoît Desjardins, MD, PhD, is Professor of Radiology at the Centre Hospitalier de l’Université de Montréal (CHUM) in Quebec, Canada, and Professor of Radiology and Medicine at the University of Pennsylvania, USA.
Reza Forghani, MD, PhD, is Chief Medical Information Officer for Imaging at AdventHealth, a large US non-profit healthcare system with 57 hospital campuses in nine states. A neuroradiologist and medical AI expert, he also serves as Chief of Imaging Informatics at AdventHealth Medical Group Central Florida Division.
James T. Whitfill, MD, is Professor of Medicine at the John Shufeldt School of Medicine and Medical Engineering of Arizona State University in Phoenix, USA. He is also Senior Vice President and Chief Transformation Officer at HonorHealth, a non-profit Arizona-based health system.
References:
- Annual report NIS Directive incidents 2024. CG Publication. August 2025. https://ec.europa.eu/newsroom/repository/document/2025-31/Annual_Report_NISD_Security_Incidents_2024_lLl8Yt8at5UKGOymYgsc0rxZrpQ_118680.pdf
- Goodger S, Kuiper E. From ransomware to statecraft: Protecting EU healthcare in the new threat landscape. Policy Brief. European Policy Centre. 21 November 2025. https://d1xp398qalq39s.cloudfront.net/uploads/ckeditor/2025/11/21/healthcybersecurity-policybrief-21112025.pdf
- Federal Bureau of Investigation. Internet Crime Complaint Center. Internet Crime Report 2025. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Chen P-H, Desjardins B, Strassner B, Forghani R, et al. Protecting Radiology Data and Devices Against Cyber Security Threats: a Joint White Paper of the ACR and Society for Imaging Informatics and Medicine. J Am Coll Radiol 2025;22:1160-1172. (Open Access)
