In a move to safeguard patient care during cyberattacks, Main Line Health has integrated chaos engineering as a central component of its cybersecurity strategy.
Aaron Weismann, chief information security officer for the Wayne, Pa.-based health system told Becker's that the adoption of chaos engineering was driven by the increasing frequency and severity of cyberattacks targeting healthcare institutions. With a clear understanding of the risks to patient care, the leadership at Main Line Health sought strategies to mitigate these threats and ensure continuity of care, even during prolonged system downtimes.
"We've seen cyberattacks in the environment at large, including incidents close to our region," Mr. Weismann said. "These attacks have a direct and detrimental impact on patient care. We needed a way to drill for these scenarios, to train on them and to identify potential system failures before they happen. Chaos engineering really spoke to us because it's designed to pressure-test our systems by intentionally injecting bad outcomes to reveal gaps that we can address proactively."
A key aspect of this approach involves simulating system downtimes by asking clinical staff to step away from their computers and revert to paper charting — a practice that many younger clinicians have never had to perform.
"Most of our clinicians under the age of 40 or 50 have only trained with electronic medical record systems," Mr. Weismann said. "We're essentially undoing that training for a couple of hours to ensure they know how to chart on paper and continue patient care in the event of a total system failure."
Main Line Health's chaos engineering initiative began as a pilot program in 2023 and is now moving toward a full rollout. The health system plans to conduct these drills twice a year across all inpatient care floors, excluding critical care units like ICUs and NICUs.
"We're also developing learning modules to make the training more educational and accessible for a wider range of providers," Mr. Weismann said.
One of the surprising outcomes of this initiative has been the discovery of vulnerabilities in the hospital's emergency infrastructure. For instance, issues were found with backup copper-line phones on some floors — phones that are crucial for communication during a system outage.
"These exercises allowed us to identify and fix those problems, ultimately strengthening our overall preparedness," Mr. Weismann said.
Mr. Weismann emphasized that, while the exercises are designed to simulate worst-case scenarios, the overarching goal is to improve patient safety.
"Our clinical operators are focused on providing excellent care, and these drills reinforce that commitment. We're preparing for the inevitable because, in healthcare, the stakes are simply too high to do otherwise."