UC San Diego has secured up to $29.9 million in federal funding to build tools that map hidden cybersecurity weak points in hospital networks across the country.
The university's Center for Healthcare Cybersecurity will lead the project, called PANACEA-H, under an award from the Advanced Research Projects Agency for Health (ARPA-H), according to UC San Diego. The effort spans up to four years and includes partners at the American Hospital Association (AHA), the University of Maryland and the University of Minnesota.
The project is a direct response to the February 2024 ransomware attack on Change Healthcare, which halted payment and claims processing systems for about two months. That breach affected an estimated 192.7 million people, according to HIPAA Journal, and cost the health care sector billions in lost revenue.
"When it comes to cyber resiliency, you can't protect what you don't see," said Jeff Tully, an associate clinical professor of anesthesiology at UC San Diego School of Medicine and co-director of the Center for Healthcare Cybersecurity. Tully is the project's principal investigator.
He said traditional methods for identifying network vulnerabilities produce static snapshots that quickly lose relevance as new technologies emerge and companies consolidate.
PANACEA-H has four research tracks. ANALOG, led by AHA National Advisor for Cybersecurity and Risk John Riggi, will survey subject-matter experts at several hundred hospitals of varying sizes and locations. ANSWER, led by UC San Diego Jacobs School of Engineering professors Stefan Savage, Geoff Voelker and Alex Snoeren, will collect real-world internet data to build maps of network relationships. AIRWAVE will monitor Bluetooth, Wi-Fi and other signals inside hospitals to locate networked medical devices. ANDMORE will mine public information to identify vendor relationships and software use.
Co-principal investigator Christian Dameff, an associate professor of emergency medicine at UC San Diego School of Medicine and co-director of the cybersecurity center, said initial maps will validate mapping techniques for broader adoption. Co-principal investigator Deepak Kumar, an assistant professor of computer science and engineering at the Jacobs School, is also part of the leadership team.
The finished tools will be shared with federal agencies, state and local public health systems and health care organizations, according to UC San Diego. The university said the mapping technology could also extend beyond health care to sectors like energy, finance and agriculture.
The ARPA-H award page describes the project as seeking to automate the identification of how technology is used to provide patient care, filling a gap where no reliable method currently exists to collect the data needed to prevent disruptions.
