In this edition of The Way Ahead: The Convergence of Technology and Cancer Care, Waqas Haque, MD, MPH, examines why cybersecurity has become inseparable from patient safety in modern oncology. Drawing on national breach data, the real-world fallout of large-scale IT outages such as the 2024 CrowdStrike disruption, and emerging guidance from safety authorities and regulators, Dr. Haque argues that cyber resilience is now a core clinical priority, not an IT afterthought.

Cybersecurity: A Patient Safety Issue

Take a moment to picture a day where your electronic gadgets fail without warning: your phone produces nothing but an empty black screen, the world-wide-web is now a world apart, and you sit silently in the dimly lit halls of your home.

Now imagine this same scenario playing out inside your hospital: for those in oncology, this could show up as delayed chemotherapy orders, disrupted imaging review, missing pathology information, broken scheduling, and chaotic triage. Increasingly, the evidence supports a reality many oncologists experience firsthand: cybersecurity is not just a checklist for IT to solve, it’s a patient safety issue.

What’s changing now is the scale. Over the past decade, healthcare has become one of the most targeted—and most disrupted—sectors in the U.S. And as artificial intelligence (AI) becomes embedded in oncology workflows, the clinical stakes get higher, because failures not only impair documentation, they impair decision making and care coordination.

The Scale of the Problem Is No Longer Theoretical

A major JAMA Network Open cross-sectional analysis of healthcare breaches from 2010 to 2024 quantified the scope in a way that’s hard to ignore: 732 million patient records were affected during that period. Most exposure came from hacking or IT incidents (88%, or 643 million records), and a major share was linked to ransomware (39%, or 285 million records) Since 2020, ransomware has affected more than half of US patients annually, reaching 69% in 2024 (Jiang et al, 2025).

These numbers likely underestimate the true burden due to underreporting, reluctance to disclose ransom payments, and federal reporting thresholds that exclude breaches involving fewer than 500 individuals (Jiang et al, 2025). But the evidence is clear that cybersecurity incidents in healthcare are frequent, large, and increasingly national in scale.

IT Failure as Healthcare Failure: The CrowdStrike Example

Cyber risk isn’t only about attackers trying to hack through a Wi-Fi portal or computer system. On July 19, 2024, a non-malicious vendor error due to a faulty CrowdStrike software update caused mass Windows crashes and one of the most widespread hospital IT disruptions in memory.

UC San Diego researchers published a JAMA Network Open study estimating that at least 759 US hospitals experienced network disruptions that day (Haley et al, 2025). Among 2,232 hospital networks scanned, disruptions were detected in 34%. More than 200 hospitals appeared to have outages in services directly linked to patient care, including portals for accessing records, imaging systems, fetal monitoring, remote monitoring tools, and inter-facility transfer systems (Haley et al, 2025; Greenberg, 2025). While many outages were short, with about 58% recovered within six hours, a small fraction of hospitals had extended issues beyond two days.

From Tully et al (JAMA Network Open, 2025)

Safety Authorities Are Explicitly Naming Cyber and AI as Hazards

Clinicians often face skepticism when raising cyber resilience as a safety issue (“Isn’t that IT’s problem?”). Credible safety authorities are now making the framing explicit. ECRI’s Top 10 Health Technology Hazards for 2025 placed AI-enabled health technologies at the top of its hazard list and explicitly included vulnerable technology vendors and cybersecurity threats among major risks (ECRI, 2025). This is a significant signal: cybersecurity and AI governance are being elevated alongside other safety-critical clinical technology concerns.

AI Is Changing the Threat Model

AI in oncology is often discussed in terms of accuracy (such as area under the curve [AUC] for model performance), bias, hallucination risk, and explainability. Those are real issues. But AI also changes cybersecurity and resilience because it introduces new dependencies:

More data movement: AI tools pull from imaging, pathology, and electronic health record (EHR) feeds, expanding exposure points and integration risk.
More vendors and supply chain dependence: model providers, cloud hosts, and third-party APIs now sit inside the clinical workflow (see the Epic Showroom).
More reliance on automation: triage prioritization, imaging support, and operational scheduling tools scale decisions, so downtime hits workflow harder.
Updates behave like safety-relevant changes: model updates can introduce performance drift or unexpected behavior.
AI can fail silently: the riskiest scenario is not just “AI is down,” but “AI is wrong and still looks plausible.”

Regulators are increasingly signaling lifecycle expectations aligned with these risks. The FDA’s final guidance on Cybersecurity in Medical Devices emphasizes a total product lifecycle approach, including secure design, secure updates, vulnerability monitoring, and mitigation planning—all of which map naturally onto AI-enabled tools in clinical use (FDA, 2025).

A Practical Clinician Lens: Resilience Beats Perfection

Oncology practices don’t need to solve cybersecurity alone, but clinicians should absolutely push for one thing: resilience, or the ability to keep care safe when systems fail.

The Bottom Line

Cybersecurity incidents and large-scale outages now occur at the national scale, and they affect clinical workflows. While the duration of outages is often measured in hours or days, clinicians know that even minutes of delayed care can translate to inferior patient outcomes. AI makes the stakes higher by increasing integration points, vendor dependencies, and reliance on automation. The most clinically mature stance is to treat digital forbearance as part of patient safety: downtime planning, fallback workflows, human override, and governance around updates and monitoring.

Because in oncology, care continuity is safety—and in modern cancer care, cybersecurity is the foundation of continuity.

About Dr. Haque

Waqas Haque, MD, MPH, is a second-year Hematology/Oncology Fellow at the University of Chicago. He recently completed his Internal Medicine Residency at New York University (NYU) in a Clinical Investigator Track. Dr. Haque has balanced his patient care work with a variety of research projects. During his fellowship training at the University of Chicago, he plans to further his work in innovative clinical trial design, value-based care delivery to cancer patients, and clinical investigation.

Cybersecurity = Patient Safety: How This Plays Out in Oncology