The US Advanced Research Projects Agency for Health (Arpa-H) plans to invest more than $50m to protect hospitals from cyber attacks.

The Universal PatchinG and Remediation for Autonomous DEfense (Upgrade) programme is a cyber-security effort to create tools for IT teams to defend the hospital environments they are tasked with securing.

Cyber attacks that hamper hospital operations can impact patient care while critical systems are down and can even lead to facility closure. A major hurdle in advancing cyber-security tools in the health sector is the number and variety of internet-connected devices unique to each facility. While consumer products are patched regularly and rapidly, taking a critical piece of hospital infrastructure offline for updates can be very disruptive. Delayed development and deployment of software fixes can leave actively supported devices vulnerable for over a year and unsupported legacy devices vulnerable far longer.

“We continue to see how interconnected our nation’s health care ecosystem is and how critical it is for our patients and clinical operations to be protected from cyber attacks,” said US Departments of Health & Human Services (HHS) deputy secretary Andrea Palm. “This launch is yet another example of HHS’s continued commitment to improving cyber resiliency across our health care system. Arpa-H’s Upgrade will help build on HHS’s healthcare sector cyber-security strategy to ensure that all hospital systems, large and small, are able to operate more securely and adapt to the evolving landscape.”

Upgrade programme manager Andrew Carney added: “It’s particularly challenging to model all the complexities of the software systems used in a given healthcare facility, and this limitation can leave hospitals and clinics uniquely open to ransomware attacks. With Upgrade, we want to reduce the effort it takes to secure hospital equipment and guarantee that devices are safe and functional so that healthcare providers can focus on patient care.”

Filling this gap in digital health security will take expertise from IT staff, medical device manufacturers and vendors, healthcare providers, human factors engineers, and cyber-security experts to create tailored and scalable software for hospital cyber resilience. The Upgrade platform should enable proactive evaluation of potential vulnerabilities by probing models of digital hospital environments for weaknesses in software. Once a threat is detected, a remediation, or patch, can be automatically procured or developed, tested in the model environment, and deployed with little interruption to the devices in use in a hospital.

“Health isn’t just something that impacts an individual, and Arpa-H is investing in ways to build stronger, healthier, and more resilient healthcare systems that can sustain themselves between crises,” said Arpa-H director Renee Wegrzyn. “Upgrade will speed the time from detecting a device vulnerability to safe, automated patch deployment down to a matter of days, providing confidence to hospital staff and peace of mind to the people in their care.”

Addressing vulnerabilities in healthcare and data security is a challenge Arpa-H can address. Its Digiheals digital health security initiative (arpa-h.gov/research-and-funding/programs/digiheals) launched last summer is focused on securing individual applications and devices. The agency has also recently partnered with Defense Advanced Research Projects Agency for the Artificial Intelligence Cyber Challenge, or AixCC, a prize competition to secure open-source software used in critical infrastructure. Upgrade aims to secure whole systems and networks of medical devices in ways that can be employed at scale.

Through a forthcoming solicitation, Upgrade seeks performer teams to submit proposals on four technical areas: creating a vulnerability mitigation software platform; developing high-fidelity digital twins of hospital equipment; auto-detecting vulnerabilities; and auto-developing custom defences.

Multiple awards under this solicitation are anticipated. To learn more about Upgrade, including information about the draft solicitation, virtual proposers’ day registration, and how to state interest in forming an applicant team, visit the Upgrade programme page at arpa-h.gov/research-and-funding/programs/upgrade.

For more information on HHS’s cyber-security performance goals and work, visit the HHS Cybersecurity Gateway at hphcyber.hhs.gov.