Hospital pharmacy services (HPS) face significant challenges in the event of a cyberattack, requiring the identification of key roles and standardised procedures to mitigate the effects of such security breaches. These services play a crucial role in assessing the affected systems and the impact on them, in estimating the duration of downtime, and in planning recovery times to best maintain the medication workflow4.

Some of the main effects of a cyberattack on HPSs include the following4:

• -

  Disruption of critical systems: loss of access to electronic medical records, admission systems, HPS management systems, electronic prescribing and clinical decision support tools, medication administration records, automated dispensing cabinets, dispensing software, and so on.

• -

  Increased manual work: the disruption of automation makes it necessary to carry out activities manually, which can be time-consuming and pose safety risks due to the increased likelihood of errors.

• -

  Impact on productivity and efficiency: the lack of functional systems hinders the availability of information and slows down the process of validating medical orders, which must be performed manually. This also affects the response time for medication delivery and the pharmacotherapeutic follow-up of patients.

• -

  Inventory management challenges: lists must be created manually, and coordination with suppliers for delivery to HPSs is required.

• -

  Communication problems: the disruption of everyday communication systems (e-mail, telephones, messaging apps, etc) can delay the transmission of critical information.

• -

  Documentation and record-keeping issues: the need to manually document medical orders increases the risk of errors and omissions, which can affect the quality of patient care.

• -

  Reorganisation of the work team: close collaboration between pharmacy, medical, nursing, administrative, and other services and departments is required, along with the redeployment of staff and adaptation to new responsibilities and temporary procedures.

In the event of a cyberattack, multidisciplinary collaboration is essential to ensure effective medication management in hospitals and safe pharmaceutical care for patients. To this end, HPSs should establish detailed, up-to-date protocols and develop contingency plans to mitigate risks and maintain high-quality patient care4,5. In addition, regular self-assessments of cybersecurity risks should be conducted, as well as drills to ensure that teams are always prepared to respond to potential attacks6. Although it is not feasible to conduct drills that simulate real attacks, a schedule of exercises could be established to simulate scenarios with a lower and therefore, more manageable level of impact.

In the world of healthcare, as in virtually all sectors, the adoption of artificial intelligence (AI) is having a huge impact, with significant implications (both positive and negative) for cybersecurity.

The positive impact of AI is diverse and significant:

• -

  It enables the detection of sophisticated threats through predictive analytics, analysing patterns of behaviour and anticipating them before they occur. It also improves the ability to respond quickly to threats in real time, reducing the impact of attacks.

• -

  Without the need for human intervention, it facilitates the automation of security tasks, including continuous monitoring, permanent surveillance of systems and networks, and the identification of anomalies and suspicious behaviour.

• -

  It automates security incidents management, including threat identification, classification, and mitigation.

• -

  Big data analytics. AI can handle and analyse data generated by healthcare systems, identifying patterns and trends that may signal security breaches. It also has the ability to correlate events from multiple sources, providing a holistic view of security.

• -

  It contributes significantly to improved data protection. Algorithms can be used to develop more robust encryption techniques to protect sensitive information. In addition, AI enhances the security of authentication and authorisation systems by using biometrics and behavioural analysis, thereby ensuring a higher level of security.

However, the adoption of AI also poses significant risks and challenges, including the risk of becoming dependent on AI itself. Algorithms are not infallible and can make mistakes in identifying threats, which could result in false positives or false negatives. In addition, the effectiveness of these algorithms depends on the training data. If this data is biased, the AI systems themselves could develop biases, thus affecting their accuracy and effectiveness.

Another challenge is the risk of cyberattacks specifically targeting AI systems. Attackers can manipulate data to deceive AI systems, preventing them from correctly detecting threats (adversarial attacks). If attackers discover vulnerabilities in AI systems, they can exploit them to infiltrate healthcare systems.

Privacy is also a critical issue. To be effective, AI requires access to vast amounts of data, which increases the risk of compromising sensitive data. It is crucial to comply with data protection regulations, which can be complex in the field of AI7.

Another challenge is that AI systems must be constantly maintained and upgraded to adapt to new threats, which involves additional resources and costs. Furthermore, highly trained personnel are required to manage and operate AI systems, which can be a challenge for many healthcare organisations.

Finally, it is vital that these systems are transparent and that their decisions can be explained and understood by healthcare professionals and security managers. Users need to be confident that AI systems will protect their data and not compromise their privacy8.

To address these challenges and risks associated with implementing AI in healthcare cybersecurity, comprehensive and rigorous strategies must be adopted. These include continuous risk assessment and conducting regular assessments to identify and mitigate potential vulnerabilities in systems. It is essential to conduct penetration tests and simulated attacks to assess the effectiveness of AI systems and strengthen defences against potential threats. In addition, algorithms should be regularly updated to adapt to new threats and minimise the risk of vulnerabilities being exploited. Establishing a continuous monitoring system to detect and respond to anomalies and threats in real time fulfils the need for constant vigilance9.

Moreover, continuous training should be provided on the capabilities and limitations of AI systems, as well as on good cybersecurity practices. This includes fostering threat awareness, informing users about threats and their impact on healthcare systems, and promoting a culture of security7,8.

Finally, the importance of compliance and collaboration cannot be overstated. We must ensure that all systems and processes comply with applicable privacy and security regulations, as well as collaborate with other institutions and regulatory bodies to share threat information and best practices, thereby strengthening our collective defences against cyberattacks7.

By implementing these strategies, healthcare organisations can significantly improve the security of their AI systems and better protect sensitive patient data.

Cayetano M. Hernández Marín: Writing – review & editing, Writing – original draft, Supervision, Project administration, Methodology, Investigation, Data curation, Conceptualization. Emilio Monte-Boquet: Writing – review & editing, Writing – original draft, Supervision, Project administration, Methodology, Investigation, Data curation, Conceptualization. José Luis Poveda Andrés: Validation, Supervision.