Redundancy Strategies for Cyber Resilience in Radiation Oncology

Abstract

In modern radiation oncology departments, safe and accurate delivery of prescribed radiation doses relies on a tightly integrated clinical workflow that spans imaging systems, treatment planning systems, electronic medical record systems, oncology information system, hospital information systems, quality assurance tools, treatment delivery systems, and IT infrastructures. To maintain efficiency, the radiation oncology workflow is intentionally streamlined with minimal redundancy, reducing complexity in clinical decision-making. However, this necessary simplicity also creates vulnerabilities: cyberattacks can exploit interdependencies and linear processes to disrupt operations, jeopardizing the timely and safe administration of radiation therapy. This paper proposes a multi-level redundancy framework designed to enhance the resilience of radiation oncology workflows against cyberattacks. The framework introduces redundancy at 4 different levels: inter-institution, inter-department, inter-system/-component, and inter-function. Practical guidance is provided for implementing workflow redundancy through data redundancy, system (hardware and software) redundancy, operation and human redundancy, infrastructure redundancy, and communication redundancy tailored to the needs of individual practices. This paper further examines methods for identifying the operational and financial costs associated with redundancy, and strategies for integrating redundancy seamlessly into existing clinical operations. This paper aims to offer a practical roadmap for radiation oncology departments seeking to strengthen operational continuity and cybersecurity readiness through a comprehensive redundancy strategy that integrates layered defenses, data protection, system hardening, and human-factor preparedness. Moreover, the redundancy strategies outlined here should also apply to disasters other than cyberattack.