Saira Ghafur

Background: Health care systems face escalating cyberattacks, including the UK Synnovis ransomware attack, which halted pathology services for 14 weeks; the Ascension Health breach affecting 5.6 million patients; and the Change Healthcare breach costing US $2.5 billion. Conventional cybersecurity measures in health care remain reactive and inadequate against evolving threats. Machine learning (ML) offers adaptive, predictive, real-time cyber defense; yet, there is limited clarity on how ML tools are applied across cybersecurity domains, their real-world effectiveness, and where gaps remain. Objective: This study aims to map ML applications in health care cybersecurity against the National Institute of Standards and Technology Cybersecurity Framework version 2.0, summarize ML performance, and identify research gaps and implementation considerations. Methods: A systematic search of Ovid MEDLINE, Embase, and Scopus was conducted on July 30, 2025, for studies between 2019 and 2025. Eligible studies applied ML-based approaches to organizational-level cybersecurity in health care settings, with outcomes related to data privacy or cybersecurity strengthening. Studies on smart devices, blockchain, or those lacking empirical data were excluded. Title and abstract and full-text screening were conducted independently by 2 (KR and SZ) reviewers following the Arksey and O’Malley framework and PRISMA-ScR (Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews) guidelines, with discrepancies resolved by consensus. Data were synthesized narratively and mapped against the 6 National Institute of Standards and Technology Cybersecurity Framework version 2.0 functions (Identify, Protect, Detect, Respond, Recover, and Govern). Results: From 10,348 articles identified, 45 studies across 18 countries were included, applying 80 ML models. Most studies addressed “Protect” (n=22, 48.9%), encompassing federated learning, homomorphic encryption, and deidentification pipelines. “Detect” (n=13, 28.9%) covered intrusion detection and anomaly-based threat detection. “Identify” (n=8, 17.8%) addressed risk assessment and vulnerability prediction. Only 2 studies addressed “Respond,” and none addressed “Recover” or “Govern.” Classical ML, deep learning, and natural language processing predominated, with intrusion detection being the most common application (n=29). Despite strong controlled performance, only one study demonstrated real-world deployment; most rely on synthetic or outdated benchmark datasets and inconsistent reporting metrics. Conclusions: To our knowledge, this is the first scoping review to map ML-driven cybersecurity solutions against all six National Institute of Standards and Technology Cybersecurity Framework version 2.0 functions, offering a structured, policy-relevant evidence base. ML applications remain concentrated in preincident functions, with gaps in response, recovery, and governance. This highlights systematic blind spots and priorities for researchers and implementers. The evidence supports a phased implementation approach: beginning with detection systems, where evidence is most established and integration is most feasible, progressing to privacy-preserving architectures, for which the literature currently offers no guidance. Implementation requires sustained investment in infrastructure, representative datasets, explainable AI, and real-world validation. Limitations include language bias, methodological heterogeneity, and exclusion of medical devices and proprietary solutions.

BACKGROUND Current cybersecurity practices in healthcare rely on conventional measures such as firewalls, antivirus software and access controls. These approaches are inadequate against sophisticated threats. Legacy systems, limited investment, and fragmented governance leave healthcare organisations vulnerable, highlighting the need for adaptive, predictive, and real-time solutions. Although Machine Learning (ML) methods exist for strengthening healthcare cyber-resilience, there is limited clarity on how these tools are applied across different cybersecurity domains, their relevance in real-world settings, and where critical gaps remain. OBJECTIVE This scoping review aimed to map and categorise current ML applications in healthcare cybersecurity against the National Institute of Standards and Technology Cybersecurity Framework, version 2.0 (NIST CSF), evaluate the effectiveness of existing approaches, and identify critical gaps and implementation priorities for healthcare organisations. METHODS A systematic search of Ovid MEDLINE, Embase, and Scopus was conducted on peer-reviewed studies published between 2019 to 2025. Search terms included “cybersecurity”, “healthcare”, “machine learning” and “artificial intelligence”. Inclusion criteria encompassed peer-reviewed studies applying PICOS criteria to organisational-level cybersecurity interventions in healthcare systems (hospitals, clinics, health networks) with outcomes related to data privacy, healthcare data protection, and cybersecurity practice strengthening. Study selection followed the Arksey and O’Malley framework and PRISMA-ScR (Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews), independently conducted by two reviewers. Following data extraction, synthesis and thematic domain mapping based on categorisation according to the NIST CSF. RESULTS Across 45 studies 80 ML models were applied to healthcare systems cybersecurity, reflecting the broad scale and diversity of ML applications in healthcare cybersecurity. Most studies aligned with the ‘Protect’, ‘Identify’, and ‘Detect’ functions of the NIST CSF, showing a strong emphasis on security techniques for privacy-preserving, intrusion detection and risk assessment. ML models based on classic machine learning, deep learning and NLP were preferred. Only one study demonstrated real-world implementation, with the remainder limited to proof-of-concept stages. Sustained research and investment are needed to validate ML in real-world healthcare environments. These were limited by reliance on synthetic datasets and methodological heterogeneity. Barriers to real-world implementation include regulatory and infrastructural challenges. Future research efforts should focus on the development of explainable AI and representative datasets, alongside governance-focused applications. CONCLUSIONS Current ML models in healthcare cybersecurity remain heavily skewed toward prevention, detection, and identification, with a notable paucity of research addressing response and governance functions, as categorised by the NIST CSF. Healthcare organisations should adopt a phased operational implementation approach beginning with high-accuracy detection systems (95-99% accuracy), progressing to privacy-preserving techniques, and ultimately developing governance frameworks. This requires sustained budgeting for infrastructure, training, and validation costs to ensure safe, reproducible deployment of ML cybersecurity solutions.

Background: Efforts are being made to integrate digital health technologies into clinical care for multiple sclerosis (MS) to improve patient monitoring. Efficiently probing how they might impact clinical care could streamline digital tool development. The Floodlight digital tool, comprising 5 smartphone sensor–based tests, was used to generate health-related data on patient function and symptoms in a clinical simulation. Objective: The study had 3 objectives: (1) assess the utility of simulated clinical encounters as a research methodology for exploring the introduction of digital health technologies into clinical practice in MS, (2) confirm the fidelity of the simulated environment and patient cases developed and understand what metrics (eg, workflow, comprehensive evaluation) could be generated, and (3) generate insights into the utility of digitally collected data, including usability, clinical decision contribution, and impact on workflows, in clinical practice. Methods: A total of 2 patient cases consisting of clinical, radiological, and digital health data were developed with clinician input. US-based neurologists prepared for and conducted 2 simulated teleconsultations each, with an actor briefed on case profiles. Floodlight data were available, via the Floodlight MS™ Health Care Professional Portal, for 1 of the 2 consultations. Participant neurologists completed interviews and surveys assessing the fidelity of the cases presented, user experience and workflow metrics, patient concerns identified, care decisions made, and confidence in making decisions. Results: All 10 neurologists indicated that the simulations were high-fidelity representations of real consultations. Using the Floodlight technology for the first time, median time taken to prepare for and conduct the consultation was ~1.7‐2 minutes longer, with slightly greater mental effort reported by participants, compared with not using the tool. The Floodlight MS Health Care Professional Portal scored an “above average” 79 on the System Usability Scale and an “acceptable” Net Promoter Score of 10. In total, 6 of the 10 neurologists “strongly agreed” that it was easier and quicker to identify patient concerns when they had access to the patient-generated Floodlight data to prepare for their encounters than when they did not. Overall, more care and management decisions were taken when the digital tool was used (37 vs 29). Of those 37 decisions, Floodlight data were reported as a trigger for 20 decisions, always in combination with other elements including patient history (20/20) and clinical exam findings (9/20). Conclusions: These findings advance our understanding of clinical simulation as a method for evaluating digital tools and other innovative technologies for MS care. High-fidelity patient cases could be provided for the mock teleconsultations, and the simulated clinical environment was useful for evaluating usability and utility of a new digital tool—yielding preliminary evidence on how digital data could be accessed and utilized by neurologists to support routine MS care.

Expanding access to self-management via Digital Health Technologies may supplement traditional care, mitigating pressures on primary care through self-management. Primary Care Physicians (PCP) can play a critical role in the integration of digital health technologies into patient care, but it is unclear what factors influence PCPs' recommendation of such technologies. To identify the factors associated with PCPs recommending digital health technologies to patients for self-management before and during the pandemic. PCPs across 20 countries completed an online questionnaire between June and September 2020. The outcome was a self-report of recommending patients to at least one of six listed forms of digital health technologies. Univariable logistic regression models were performed to explore factors associated with recommending digital health technologies to patients before and during the pandemic. 1,592 PCPs were included. Before the pandemic, the odds of recommending digital health technologies for self-management were lower for PCPs not involved in teaching, or practising in Turkey, Australia, Chile, Colombia, France, Italy, Poland, Portugal, Slovenia, and Spain. During the pandemic, PCPs practising in rural settings had higher odds of starting to recommend digital health technologies, as well as those from Brazil, Colombia, and Italy. There was no significant difference in recommending digital health technologies before and during the pandemic. Involvement in teaching (pre-pandemic) and practising in a rural setting (during the pandemic) positively influenced the recommendation of digital health technologies. Significant variation in recommending digital health technologies was present across countries.

The rapid advancement of artificial intelligence (AI)–driven diagnostics and wearable health technologies is transforming health care delivery by enabling real-time health monitoring and early disease detection. These innovations are catalyzing a shift toward personalized medicine, with interventions tailored to individual patient profiles with unprecedented precision. This paper examines the current National Institute for Health and Care Excellence (NICE) evidence standards framework (ESF) for digital health technologies (DHTs) and evaluates the challenges associated with integrating DHTs into existing health and care systems. A comprehensive review of the NICE ESF guidelines was conducted, alongside an evaluation of their applicability to emerging AI and wearable technologies. Key limitations and barriers were identified, with particular focus on the framework’s responsiveness to technologies that evolve through machine learning and real-world data integration. Our findings indicate that while the NICE ESF provides a structured approach for evaluating DHTs, it lacks the adaptability required for rapidly evolving innovations. The framework does not sufficiently incorporate real-world evidence or support continuous learning models, which are critical for the safe and effective deployment of AI-based diagnostics and wearables. To remain effective and relevant, the NICE ESF should transition to a dynamic, adaptive model co-designed with industry stakeholders. By embedding real-world evidence-based strategies and promoting transparency, efficiency, and collaborative innovation, the updated framework would better facilitate the integration of AI-driven diagnostics and wearables into health care systems, ultimately enhancing patient outcomes and optimizing health care delivery.

Background: Digital health solutions (DHS) are technologies with the potential to improve patient outcomes as well as change the way care is delivered. The value of DHS for people with diabetes is not well understood, nor is it clear how to quantify this value. Objective: We aimed to summarize current literature on the use of patient-reported outcome measures (PROMs) in diabetes as well as in selected guidelines for Health Technology Assessment (HTA) of DHS to highlight gaps, needs, and opportunities for the use of PROMs to evaluate DHS. Methods: We searched PubMed and ClinicalTrials.gov to establish which PROMs were most used in diabetes clinical trials and research between 1995 and May 2024. HTA guidelines on DHS evaluation from France, Germany, and the United Kingdom were also assessed to identify PROMs for DHS evaluation in general. Results: A total of 46 diabetes-specific PROMs and 16 nondiabetes-specific PROMs were identified. The most used diabetes-specific PROMs were (1) Diabetes Distress Scale, (2) Problem Areas in Diabetes, (3) Diabetes Empowerment Scale, (4) Diabetes Quality of Life, and (5) Diabetes Treatment Satisfaction Questionnaire. The most used nondiabetes-specific PROMs were Beck Depression Inventory, Sickness Impact Profile, EuroQol 5-Dimension, and Short Form 36-Item Health Survey. In HTA guidelines, the most prominent domain was health-related quality of life, for whose assessment there are well-established measures (Short Form 36-Item Health Survey and EuroQol 5-Dimension). Conclusions: Of the many PROMs used in diabetes care, few are currently used to evaluate DHS, and certain domains of value in diabetes are not mentioned in HTA guidelines. A common, comprehensive DHS-specific HTA framework could facilitate and accelerate the evaluation of DHS.

Background: Health care organizations globally have seen a significant increase in the frequency of cyberattacks in recent years. Cyberattacks cause massive disruptions to health service delivery and directly impact patient safety through disruption and treatment delays. Given the increasing number of cyberattacks in low- and middle-income countries (LMICs), there is a need to explore the interventions put in place to plan for cyberattacks and develop cyber resilience. Objective: This study aimed to describe cybersecurity interventions, defined as any intervention to improve cybersecurity in a health care organization, including but not limited to organizational strategy(ies); policy(ies); protocol(s), incident plan(s), or assessment process(es); framework(s) or guidelines; and emergency planning, implemented in LMICs to date and to evaluate their impact on the likelihood and impact of attacks. The secondary objective was to describe the main barriers and facilitators for the implementation of such interventions, where reported. Methods: A systematic search of the literature published between January 2017 and July 2024 was performed on Ovid Medline, Embase, Global Health, and Scopus using a combination of controlled terms and free text. A search of the gray literature within the same time parameters was undertaken on the websites of relevant stakeholder organizations to identify possible additional studies that met the inclusion criteria. Findings from included papers were mapped against the dimensions of the Essentials of Cybersecurity in Health Care Organizations (ECHO) framework and presented as a narrative synthesis. Results: We included 20 studies in this review. The sample size of the majority of studies (13/20, 65%) was 1 facility to 5 facilities, and the studies were conducted in 14 countries. Studies were categorized into the thematic dimensions of the ECHO framework, including context; governance; organizational strategy; risk management; awareness, education, and training; and technical capabilities. Few studies (6/20, 30%) discussed cybersecurity intervention(s) as the primary focus of the paper; therefore, information on intervention(s) implemented had to be deduced. There was no attempt to report on the impact and outcomes in all papers except one. Facilitators and barriers identified were grouped and presented across national or regional, organizational, and individual staff levels. Conclusions: This scoping review’s findings highlight the limited body of research published on cybersecurity interventions implemented in health care organizations in LMICs and large heterogeneity across existing studies in interventions, research objectives, methods, and outcome measures used. Although complex and challenging, future research should specifically focus on the evaluation of cybersecurity interventions and their impact in order to build a robust evidence base to inform evidence-based policy and practice.

In healthcare, novel AI solutions are being created to address some of the biggest challenges in the prognosis, diagnosis, and treatment of disease, as well as clinician workflows and service improvement. The emergence of generative AI presents a compelling opportunity to revolutionize diagnostics, treatment planning, medical research, and patient engagement. The hypothesized uses of generative AI are broad, ranging from medical education, providing information to patients, generating synthetic patient data for the validation of AI tools, to the analysis of continuous data from wearables to detect early signs of disease. Adoption of digital solutions and AI in healthcare is slower than in other industries. The majority of clinicians don’t have direct experience with AI technologies, only a quarter have recommended a digital therapeutic, and less than a fifth have prescribed one. Safety, quality and confidence can be built through appropriate governance, testing, careful implementation and appropriate clinical use. There is a responsibility for AI developers, health systems and providers, as well as regulators, to create clear expectations for evidence and solutions. AI solutions require unique model evidence (evidence for the underlying algorithm) and solution evidence (evidence for the product in which the algorithm is embedded). Models will need validation first on internal and then on external datasets (internal and external validation). This will indicate how accurate and reliable the model is, but will be limited to the dataset that a client has access to. By examining ways to evaluate evidence for AI in healthcare, we can develop a better understanding of how best to use AI to its most appropriate advantages.

Background: Accelerated digitalization in the health sector requires the development of appropriate evaluation methods to ensure that digital health technologies (DHTs) are safe and effective. Software as a medical device (SaMD) is a commonly used DHT by clinicians to provide care to patients. Traditional research methods for evaluating health care products, such as randomized clinical trials, may not be suitable for DHTs, such as SaMD. However, evidence to show their safety and efficacy is needed by regulators before they can be used in practice. Clinical simulation can be used by researchers to test SaMD in an agile and low-cost way; yet, there is limited research on criteria to assess the robustness of simulations and, subsequently, their relevance for a regulatory decision. Objective: The objective of this study was to gain consensus on the criteria that should be used to assess clinical simulation from a regulatory perspective when it is used to generate evidence for SaMD. Methods: An eDelphi study approach was chosen to develop a set of criteria to assess clinical simulation when used to evaluate SaMD. Participants were recruited through purposive and snowball sampling based on their experience and knowledge in relevant sectors. They were guided through an initial scoping questionnaire with key themes identified from the literature to obtain a comprehensive list of criteria. Participants voted upon these criteria in 2 Delphi rounds, with criteria being excluded if consensus was not met. Participants were invited to add qualitative comments during rounds and qualitative analysis was performed on the comments gathered during the first round. Consensus was predefined by 2 criteria: if 60% “important” or “very important.” Results: In total, 33 international experts in the digital health field, including academics, regulators, policy makers, and industry representatives, completed both Delphi rounds, and 43 criteria gained consensus from the participants. The research team grouped these criteria into 7 domains—background and context, overall study design, study population, delivery of the simulation, fidelity, software and artificial intelligence, and study analysis. These 7 domains were formulated into the simulation for regulation of SaMD framework. There were key areas of concern identified by participants regarding the framework criteria, such as the importance of how simulation fidelity is achieved and reported and the avoidance of bias throughout all stages. Conclusions: This study proposes the simulation for regulation of SaMD framework, developed through an eDelphi consensus process, to evaluate clinical simulation when used to assess SaMD. Future research should prioritize the development of safe and effective SaMD, while implementing and refining the framework criteria to adapt to new challenges.