Fighting health-care hackers and measles vaccine woes

Sponsored by:

PPF’s report The Next One: Preparing Canada for another health emergency outlines the lessons learned from the pandemic and how Canada can safeguard against future health emergencies. To keep the discussion going — and to keep Canadians informed — this newsletter looks at what’s happening in the world of health security each week. Here’s what we’re following:

Cyber contest

A new U.S. government agency has joined the fight against critical infrastructure hackers, including those that target health care and biotech. The Advanced Research Projects Agency for Health (ARPA-H) is the latest partner to support a tech challenge launched last year by DARPA, the Pentagon’s research arm. That challenge — the Artificial Intelligence Cyber Challenge (AIxCC) — asks teams to build AI-based tools that automatically secure code used in critical infrastructure.

The idea is to design AI-based tech that will find and fix vulnerabilities in medical devices, biotech and hospital IT systems. ARPA-H’s involvement will contribute $20 million in additional rewards to the challenge. “Health care is both acutely being targeted, and it’s been more and more targeted over the last few years,” ARPA-H program manager Andrew Carney said in an interview with The Register.

Meanwhile, in the fallout from the Change Healthcare hack, critics are asking what the U.S. government plans to do to prevent another similar incident. The Biden administration has supported voluntary industry cybersecurity performance goals, but has held off making anything mandatory.

The American Hospital Association has said mandatory requirements would be unworkable. “Imposing fines or cutting Medicare payments would diminish hospital resources needed to combat cybercrime and would be counterproductive to our shared goal of preventing cyberattacks,” it said in December — a message it’s repeating now. The White House has put forward a budget request that would set aside $800 million to help hospitals cover the cost of meeting minimum federal cybersecurity standards.

The threat continues. Recently, the Washington Post spoke to Marc Rogers, a member of the Cyber Threat Intelligence League, a group of security industry experts who volunteer time to help alert hospital networks of vulnerabilities. “When you talk to a hospital in the small hours of the morning and they have no way to access patient medical history records and use more advanced systems, you know that’s going to cost lives,” Rogers told the paper.

UPCOMING ON 11 APRIL: Annual Testimonial Dinner Honour Roll 2024

Join more than 1,200 leaders and policy wonks as PPF pays tribute to Canadians who have made outstanding contributions to public policy and good governance. This year’s dinner takes place at the Metro Toronto Convention Centre — in the biggest dining room you’ve ever seen! Be in the room where it happens.

Hacker triage

The system threat may be quickly escalating into a crisis: A group of hackers said last week that an attack on NHS Scotland in March allowed them to access three terabytes worth of NHS patient and staff data. They are now holding it ransom. As proof, the hacker group, which calls itself INC Ransom, posted some personal letters and medical reports online as proof of what they say was a successful breach of NHS security systems. So far, INC Ransom has not set a deadline for payment, nor has an amount been made public. Last year the U.K. government released data revealing that nearly 12,000 NHS computers may be vulnerable to cyberattacks because they’re running on outdated software. The computers are running Windows XP and Windows 7, neither of which receive cybersecurity updates any longer from Microsoft.

READ MORE: Canada’s outdated health data systems need an urgent update

The U.K. is no stranger to ransomware attacks on its health-care network. The 2017 WannaCry attack crippled systems for a week and cost the NHS £92 million. In 2022, a cyberattack on Advanced, an NHS software supplier, impacted emergency call lines and patient bookings with doctors and pharmacies.

Last year, a ransomware attack on the University of Manchester affected an NHS dataset with information on over a million patients across 200 hospitals. Just a few weeks later, an NHS trust that runs five hospitals in London serving more than 2.5 million patients had 70 terabytes of sensitive data stolen by the ALPHV ransomware group (aka BlackCat) — the biggest breach of health-care data ever in the U.K.

WONK PODCAST: Halifax Mayor Mike Savage on how a big city keeps up with growth

Measles vaccination woes

The number of measles cases confirmed in 2024 in the U.S. has now surpassed the total confirmed in all of 2023, according to the Centers for Disease Control (CDC). As of March 21, the CDC said it had confirmed 64 cases across 17 jurisdictions, six more cases than the 58 confirmed last year. Canada also continues to see a rise in measles cases, albeit a slower one for now. A third case was confirmed in the Toronto area last week.

According to a 2023 report from Public Health Ontario, the GTA has very low rates of vaccinations among children. In Toronto, 80.2 percent of seven year-olds were fully vaccinated against measles in the 2019-2020 school year, but just 38.9 percent were in the 2021-2022 school year. In Peel Region, measles vaccination rates fell from 77.7 percent in 2019-2020 to 37.2 percent in 2021-2022. York region reported just 31.9 percent of seven year-olds were fully vaccinated in the 2021-2022 school year.

Canada’s total number of confirmed measles cases as of March 27 was 40, with the bulk (28) having been confirmed in Quebec. The majority of people who’ve had measles in Canada this year have been unvaccinated, and most of them have been children.

Last week, Dr. Theresa Tam, Canada’s Chief Public Health Officer, urged Canadians to have their children vaccinated.

Some pharmacists in Alberta are worried that unless the province allows them to administer the measles vaccine, the potential for outbreaks will only worsen. “It would be very, very easy for us to increase access to these vaccines … and take some of the load off other parts of the health system,” Randy Howden, president of the Alberta Pharmacists’ Association told the CBC this week. “We have the scope to provide these vaccinations and we’ve shown that we’re able to roll out effective vaccine systems and processes in the past.”

The Association has asked the province to add the measles vaccine to the list of publicly funded shots pharmacists can provide, but the government has said it has no plans to launch such a program.

WHO CoViNet

The World Health Organization (WHO) launched CoViNet last week, a network of global laboratories with expertise in human, animal and environmental coronavirus surveillance. Linking 36 labs in 21 countries, CoViNet builds on the WHO’s reference laboratory network developed during the early days of the pandemic, but will now expand its scope to focus on all types of coronaviruses, including MERS-CoV.

Elsewhere, negotiators on the WHO’s new pandemic agreement have agreed to another round of talks from April 29 to May 10. The draft agreement remains contentious — specifically Article 12, which outlines pathogen access and benefit sharing (PABS), and has potential implications for pharmaceutical intellectual property rights.

Without a breakthrough in negotiations later this spring, the agreement may not fulfill the original intentions, which included ensuring greater international information and resource sharing to create a more equitable response to future pandemics.

Dengue emergency

Puerto Rico has declared a dengue epidemic, with 549 reported cases so far this year — nearly half as many as the total reported in 2023. So far in 2024, there have been 3.5 million cases of dengue reported in the Americas, with Brazil reporting the majority of cases. But the illness, which is spread by mosquitoes and kills 40,000 people a year, is spreading, including to areas where there has historically been less transmission, such as Argentina and Paraguay. Argentina has so far seen a 200 percent increase this year in the number of reported cases compared to the start of 2023.

Events

April

• April 1-4: World Vaccine Congress. Washington, D.C.
• April 3: Advancing U.S.-Canada Life Sciences Cooperation. Washington, D.C.
• April 8-13: Global Health Week. Charletson, SC.
• April 15-17: Festival of Biologics. San Diego, CA.
• April 15-17: Bio-IT World Conference & Expo. Boston, MA.
• April 17-18: CMO Summit 360. Boston, MA.
• April 23-24: Public Health 2024. Halifax, NS.
• April 23-29: Intergovernmental Negotiating Committee (4th session). Ottawa, ON.

May

• May 12-14: Bio€quity Europe. San Sebastián, Spain.
• May 13-16: AAPS 2024 National Biotechnology Conference. San Francisco, CA.
• May 13-17: PEGS Boston. Boston, MA

Did someone forward you this newsletter? Subscribe to PPF: Health Security newsletter

This newsletter is produced by journalists at PPF Media. It maintains complete editorial independence.