UC San Diego’s Center for Healthcare Cybersecurity will lead PANACEA-H, a project funded by an Advanced Research Projects Agency for Health award of up to $29.9 million over a maximum of four years. The effort, whose full name is Preventative Assessment and Network Analysis of Cyber Essential Abilities for Health, brings together the American Hospital Association, the University of Maryland and the University of Minnesota to study technology dependencies in healthcare, according to UC San Diego.
Combining different ways to identify dependencies
The project’s four research teams will assemble information from different sources. ANDMORE, led by Deepak Kumar and Hannah Neprash, will examine public material—including hospital websites, Medicare data, social media, job listings and press releases—to infer hospitals’ vendor relationships and software use. AIRWAVE, led by Aaron Schulman and Dave Levin, will use Bluetooth, Wi-Fi and other signals in hospitals to locate network-connected medical devices. UC San Diego describes these as two parts of the project’s approach to finding technology connections that may not be apparent from a single source.
Other teams will focus on network-level information and hospital knowledge. ANSWER, led by Stefan Savage, Geoff Voelker and Alex Snoeren, will analyze real-world internet data to represent relationships among networks and update those maps as conditions change. ANALOG, led by John Riggi of the American Hospital Association, will collect expertise from people at several hundred hospitals of differing types, sizes and locations. These methods and team roles are described by UC San Diego.
What the maps are intended to support
The project plans to use initial maps to test whether its methods can be applied more broadly. UC San Diego says the resulting work is intended to help decision-makers rank dependencies for protection, identify companies whose disruption could affect multiple organizations, and estimate how a weakness in a device or IT service might affect particular hospitals. The university says the tools are intended for government agencies and public health and healthcare organizations at federal, state, regional and local levels; it also identifies energy, finance, agriculture and manufacturing as possible future areas of application.
Recent incidents show the stakes
The project’s rationale includes the 2024 Change Healthcare ransomware attack. UC San Diego reported that the incident disrupted healthcare operations nationwide and caused billions of dollars in lost revenue. In a survey of about 1,000 hospitals conducted shortly after the attack, 94% reported a financial impact and 74% said direct patient care had been affected, according to the American Hospital Association.
More recent figures also point to care disruptions. Healthcare IT News reported that 72% of healthcare organizations experiencing cyberattacks in 2025 said patient care was disrupted, compared with 69% the prior year; among organizations affected by supply-chain attacks, 87% reported care impacts. The outlet also reported Health-ISAC figures of 4,040 healthcare incidents in the first half of 2025 and 1,930 in the third quarter. See Healthcare IT News for its account of those findings.
