Cybersecurity of Patient Records in Healthcare: BACH Case Study
This paper presents a critical infrastructure risk assessment of the cybersecurity framework protecting patient records at Blanchfield Army Community Hospital (BACH) in Fort Campbell, Kentucky. The assessment focuses on the hospital's Internet-based TRICARE Online (TOL) patient portal, managed by the Medical Records Branch, which enables patients to access, review, and manage their personal health information. The paper identifies key vulnerabilities—including encryption blind spots, phishing attacks, cloud threats, and malware—and examines associated threat types such as ransomware, spamming, and Botnet malware. It further proposes mitigation strategies including cybersecurity training, access controls, and a dedicated security team, while situating these recommendations within current federal cybersecurity policy and emerging sector-wide trends.
- Introduction and Overview: Background on BACH cybersecurity risk assessment scope
- BACH Infrastructure and System Description: TRICARE Online system and Medical Records Branch functions
- Stakeholders and Historical Incidents: Key users and past breaches affecting similar systems
- Vulnerabilities and Types of Threats: Encryption gaps, phishing, malware, and cloud risks
- Jurisdictional Resilience and Mitigation Approaches: Policy frameworks and strategies to reduce cyber risk
- Emerging Trends and Current Cybersecurity Policies: New threats, identity theft, and federal cybersecurity law
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Uses a real hospital system (BACH's TRICARE Online portal) as a concrete case study, grounding abstract cybersecurity concepts in an identifiable organizational context.
- Systematically moves from system description through stakeholder analysis, historical incidents, vulnerability mapping, mitigation strategies, and policy alignment — creating a coherent risk assessment structure.
- Connects identified vulnerabilities directly to threat types, showing clear cause-and-effect reasoning rather than treating each topic in isolation.
- References actual historical incidents (the 2011 TRICARE breach, the 2019 Israeli malware research) to validate the real-world relevance of the vulnerabilities discussed.
Key academic technique demonstrated
The paper demonstrates applied risk assessment methodology: it defines the system and stakeholders, identifies vulnerabilities, maps them to threat types and potential impacts, proposes layered mitigations, and frames all recommendations within existing regulatory policy. This top-down analytical structure is characteristic of critical infrastructure assessments in the health IT and cybersecurity literature.
Structure breakdown
The paper opens with an executive-style summary, then provides an organizational overview of BACH and its TOL system. It proceeds through stakeholder roles, pertinent historical incidents, and a detailed vulnerability-threat analysis. The final sections address jurisdictional resilience, concrete mitigation strategies, emerging sector trends, and current federal and state cybersecurity policy, closing with a synthesizing conclusion.
Introduction and Overview
Technology is increasingly relied upon in the healthcare sector to improve organizational operations and contribute to better patient outcomes. Blanchfield Army Community Hospital (BACH), which provides healthcare services to communities in Fort Campbell, Kentucky, has adopted technology to improve its operations. Electronic health records are an example of a technological system adopted by the organization to enhance the documentation and management of patient records. The hospital utilizes an Internet-based system for its patients' records known as the TRICARE Online (TOL) system. TOL has played a critical role in promoting data integration, clinical support, and patient engagement. It is managed by the hospital's Medical Records Branch (MRB) and allows patients to carry out different activities such as reviewing, downloading, and printing their personal health information. The stakeholders utilizing this system include the MRB, patients, and physicians/clinicians.
Some of the vulnerabilities in this system include encryption blind spots, malware and ransomware, phishing attacks, and cloud threats. The types of threats associated with these vulnerabilities include phishing attacks, damage to a computer system, server or network, spamming, and Botnet malware. Such attacks could result in unauthorized access to patient health information, disrupt organizational operations, and interfere with the healthcare delivery process, resulting in poor health outcomes. The organization can mitigate these vulnerabilities and lessen risks through cyber training and education, controlling access to patient health data, establishing a dedicated cybersecurity team, and creating a comprehensive cybersecurity plan. Some of these measures align with emerging trends in cybersecurity in the healthcare sector. However, the hospital must ensure that measures adopted to enhance cybersecurity comply with existing federal, state, and local policies.
The healthcare industry is increasingly relying on technology for the management of operations and patient records. Healthcare organizations have continued to establish technology-based infrastructures to help improve their operations with a view to enhancing patient care services and outcomes. As these organizations continue to adopt technology, they face new challenges that could threaten patient care processes and outcomes. Cybersecurity has become a major issue for healthcare organizations since they maintain sensitive infrastructures that are central to enhancing patients' health, wellbeing, and safety (Bris & Asri, 2017). This critical infrastructure risk assessment examines the cybersecurity of Blanchfield Army Community Hospital (BACH) patient records, discussing existing vulnerabilities, their impacts, how to mitigate them, and emerging trends within the sector to address them.
BACH Infrastructure and System Description
Blanchfield Army Community Hospital (BACH), located at Fort Campbell, Kentucky, is a healthcare organization that serves the surrounding community through a patient-centered healthcare model. The organization remains committed to operational readiness, excellent customer service, and world-class healthcare delivery. As a result, BACH adopts a healthcare delivery process in which patients' families are considered integral parts of achieving desired healthcare goals and objectives. To serve the surrounding community effectively and efficiently, the organization provides a wide range of healthcare services. Since its inception, BACH has continued to adopt new approaches to healthcare delivery in order to improve processes and patient outcomes. Technology plays a critical role in the organization's operations, helping improve healthcare delivery processes toward better patient outcomes and improved satisfaction.
As part of its measures to enhance healthcare delivery processes and outcomes, BACH has established an electronic health record system. This is a critical infrastructure for the documentation and management of patient data. BACH has established a Medical Records Branch (MRB) whose mission is to provide accurate, consistent, and timely medical information used to deliver quality healthcare services (Blanchfield Army Community Hospital, 2020). In addition, information provided by MRB is used to protect patients' confidentiality and privacy and to support administrative functions. MRB manages patients' records through TRICARE Online (TOL), a secure patient portal designed to help patients manage their individual or family healthcare online. Using this system, BACH's patients can easily make appointments, cancel or reschedule appointments, and manage their health data.
In essence, TOL gives the hospital's registered users access to online healthcare data and services. Through the system, patients can review, print, or download personal health information from their military electronic health record (Blanchfield Army Community Hospital, 2020). The system is linked to the Health Artifact and Image Management Solution (HAIMS), which is an enterprise-wide data sharing and content management platform for various kinds of images and artifacts.
Stakeholders and Historical Incidents
One of the important stakeholders managing this electronic health record system is the Medical Records Branch (MRB). MRB is organized into four sections: the Inpatient Treatment Record Section, the Outpatient Treatment Record Section, the Medical Transcription Section, and the Correspondence Section. MRB views the system as a suitable portal for the documentation and management of patient data to support administrative functions and healthcare delivery processes. Through different offices located across the hospital, this stakeholder assists patients in uploading their demographic information and submitting personal health data requests, among other functions.
The second important stakeholder is patients, who can easily access their health information through the portal. Patients view the system as a user-friendly platform through which they can schedule, reschedule, and cancel appointments, as well as review, download, and print their health information. As a user-friendly platform, the system improves efficiency in healthcare delivery processes. The third stakeholder is hospital staff and physicians/clinicians. Hospital staff utilize the system for administrative functions to ensure the hospital achieves its objectives relating to healthcare delivery and better patient outcomes. They also use the system to maintain the healthcare organization's fiscal soundness, accountability, and ability to meet patients' needs. Physicians and clinicians use the system for decision-making in healthcare delivery, with patient health information serving as the foundation for decisions on diagnosis and treatment approaches.
While the TRICARE Online system has played a critical role in the management of patient health information at BACH, there are pertinent historical incidents affecting similar systems. These include cloud threats, malware and ransomware, phishing attacks, and encryption blind spots — all of which are common among electronic health records connected to the Internet. The attacks are typically carried out by adversaries seeking to siphon patient data or shut down the operations of an entire healthcare organization until a ransom is paid. For example, in 2019, researchers in Israel announced they had developed a virus capable of adding tumors into MRI or CT scans (Wetsman, 2019). This malware was designed to fool doctors into making incorrect diagnoses of high-profile patients and represents the kind of threat that poses significant risks to Internet-based electronic health record systems like TOL. Additionally, in 2011, TOL experienced a health information breach involving the theft of backup tapes for electronic health records, affecting 4.9 million patients in the San Antonio area (Anderson, 2011).
Vulnerabilities and Types of Threats
Cybersecurity vulnerabilities and threats have become common in the healthcare sector as hospitals and other organizations adopt technology to enhance their processes and patient outcomes. While these organizations continue to adopt protective measures, growing vulnerabilities and threats pose significant challenges to overall effectiveness and efficiency. BACH's patient records system is an Internet-based platform for the documentation and management of personal health data. The online platform facilitates patient engagement, data integration, and clinical support. Despite these benefits, the system has several vulnerabilities that adversaries or accidental actors could exploit, causing significant interruptions to patient care delivery.
One of the vulnerabilities in the TRICARE Online system is encryption blind spots. Encryption is used as a primary means of protecting patients' health data in order to ensure the patient portal remains secure. However, encryption blind spots provide avenues for hackers to evade protection tools designed to detect data breaches. For example, in the 2011 TRICARE breach, the operating system used to back up data onto tape was unable to encrypt data in a manner that complied with a specific federal standard (Anderson, 2011). The backup tapes were stolen while the facility was searching for a compliant encryption solution compatible with its operating system. This situation created an encryption blind spot and illustrates how it remains one of the major vulnerabilities in patient records systems. Even though BACH does not rely on backup tapes or physical media for backup purposes, encryption blind spots remain a significant vulnerability in an Internet-based or cloud computing model for managing electronic health records.
Phishing attacks represent the second major vulnerability to BACH's electronic health record system. Phishing is a significant cybersecurity vulnerability for Internet-based systems within and outside the healthcare sector. The most common type is email phishing, used to obtain email addresses and passwords. TOL is vulnerable to this type of attack because it enables patients to manage aspects of their personal health information. Unsuspecting patients, particularly those who are not tech-savvy, could become victims of such attacks.
Additional vulnerabilities include cloud threats, since patients' protected health information for this facility is stored in the cloud. While cloud computing provides a suitable framework for data integration within the hospital, insufficient encryption could prove detrimental to its operation. Inadequate encryption creates a weak point through which hackers or other adversaries could compromise protected personal health information. The system is also vulnerable to malware and ransomware, which are commonly used by cybercriminals to interfere with servers, devices, or networks.
Encryption blind spots, cloud threats, and insufficient encryption could be exploited by adversaries to carry out phishing attacks and other types of cyberattacks. One resulting threat type is damage to a computer system or network. This can be carried out through malware — software designed to damage a computer, network, or server (Gaffney, 2019). Malware ranges from viruses to worms and can significantly disrupt system operations. Such damage could prevent patients, hospital staff, and physicians or clinicians from carrying out their respective functions at BACH. Patients would be unable to access or manage their personal health information; hospital staff would be unable to perform administrative functions; and physicians' healthcare delivery processes would be impaired.
The second threat type is spamming, which involves unsolicited messages sent to an email inbox. Through spamming, patients, hospital staff, and physicians could receive links containing malicious software or misleading information that could damage their computer systems or devices, disrupting healthcare delivery and resulting in poor patient outcomes. Phishing attacks are a third threat likely to occur in BACH's electronic health record system. Through phishing, cybercriminals could solicit and access sensitive, confidential information that can then be used for other purposes, including demanding a ransom. Phishing schemes are regarded as the foundation of all successful cyberattacks (Gaffney, 2019) and could contribute to health information data breaches or unauthorized access to secure records.
The fourth threat type is Botnet malware — a network of compromised or hijacked computers that gives hackers the capability to control infected devices remotely. Cybercriminals could use this access to alter a patient's health information, resulting in misdiagnosis and ineffective treatment.
References
Aboujaoude, C. (2018, December 4). Top three 2019 healthcare cybersecurity trends. Retrieved June 23, 2020, from https://www.hcinnovationgroup.com/cybersecurity/article/13030931/top-three-2019-healthcare-cybersecurity-trends
Anderson, H. (2011, September 29). TRICARE breach affects 4.9 million. Retrieved June 23, 2020, from https://www.inforisktoday.com/tricare-breach-affects-49-million-a-4105
Blanchfield Army Community Hospital. (2020). FAQ — BACH healthcare services. Retrieved June 23, 2020, from https://blanchfield.amedd.army.mil/Patient-Resources/Access-to-Care/FAQ/
Blanchfield Army Community Hospital. (2020). Medical Records Branch. Retrieved June 23, 2020, from https://blanchfield.amedd.army.mil/Plan-A-Visit/Patient-Administrations/Medical-Records-Branch/
Bris, A. L., & Asri, W. E. (2017, January). State of cybersecurity & cyber threats in healthcare organizations — applied cybersecurity strategy for managers. Retrieved from
Fischer, E. A. (2014, December 12). Federal laws relating to cybersecurity: Overview of major issues, current laws, and proposed legislation. Retrieved June 23, 2020, from https://fas.org/sgp/crs/natsec/R42114.pdf
Gaffney, M. (2019, April 10). 5 most common types of threats you need to know about. Retrieved June 23, 2020, from https://www.mcafee.com/blogs/enterprise/5-most-common-types-of-threats-you-need-to-know-about/
Health Informatics. (n.d.). Cybersecurity: How can it be improved in health care? Retrieved from
Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25, 1–10.
Public Health Emergency. (2017, June). Report on improving cybersecurity in the healthcare industry. U.S. Department of Health and Human Services. Retrieved from https://www.phe.gov/Preparedness/planning/CyberTF/Documents/report2017.pdf
Wetsman, N. (2019, April 4). Health care's huge cybersecurity problem. Retrieved June 23, 2020, from https://www.theverge.com/2019/4/4/18293817/cybersecurity-hospitals-health-care-scan-simulation
Create your account
Always verify citation format against your institution’s current style guide requirements.