UCSD - University of California - San Diego

10/27/2026 | Press release | Distributed by Public on 10/27/2026 12:00

UC San Diego Receives Major ARPA-H Award to Map Key Hospital Network Dependencies Critical to Care

Published Date

October 27, 2026

Article Content

Key Takeaways

  • UC San Diego Center for Healthcare Cybersecurity will lead the PANACEA-H project to build tools that map and monitor critical health care network dependencies that can impact patient safety and national security.
  • PANACEA-H will proactively identify critical vulnerabilities to prevent disruptions like the 2024 Change Healthcare ransomware incident.
  • The mapping tools could have applications beyond the health care sector for bolstering cyber resilience infrastructure.

The University of California San Diego Center for Healthcare Cybersecurity has received an award from the Advanced Research Projects Agency for Health (ARPA-H) to lead the Preventative Assessment and Network Analysis of Cyber Essential Abilities for Health (PANACEA-H) project in collaboration with the American Hospital Association (AHA), the University of Maryland and the University of Minnesota. The award totals up to $29.9 million over a maximum of four years.

"This award underscores UC San Diego's unique ability to bring together world-class medical expertise and advanced computer science to solve critical national security challenges," said John M. Carethers, MD, vice chancellor for Health Sciences at UC San Diego. "The mapping tools developed by the Center for Healthcare Cybersecurity will transform how the entire health care sector defends itself, cementing UC San Diego's role as a driving force behind the nation's health IT infrastructure and patient safety."

The Change Healthcare breach of 2024, which triggered nationwide disruptions in health care operations and resulted in billions of lost revenue, brought into stark relief the need to reimagine how dependencies are mapped. In many cybersecurity attacks, including this one, the vulnerability goes unrecognized until it fails.

"When it comes to cyber resiliency, you can't protect what you don't see," said principal investigator Jeff Tully, MD, associate clinical professor and Sheldon Furst Endowed Chair of Anesthesiology at UC San Diego School of Medicine and co-director of the Center for Healthcare Cybersecurity.

"Hospitals don't work in isolation, they work in tandem with many different vendors, partners, software and medical devices - a very complicated, interconnected system with many different players all coming together to provide care," said co-principal investigator Deepak Kumar, PhD, assistant professor in the Department of Computer Science and Engineering at the UC San Diego Jacobs School of Engineering. "Any one lapse in service can actually cause a lot of disruption in the way that Americans get health care."

Principal investigator Jeff Tully, MD, left, co-PI Deepak Kumar, PhD, center, and co-PI Christian Dameff, MD, right. Kyle Dykes/UC San Diego Health Sciences and David Baillot/UC San Diego Jacobs School of Engineering

Tully says traditional approaches for identifying and mapping sector dependencies can be incomplete and error prone, leading to static snapshots of network vulnerabilities that can quickly lose relevance due to the emergence of new technologies, sector consolidation and regulatory developments.

"What PANACEA-H seeks to do is a very sophisticated version of what many people in the government and the public and private sector have been working on," he said.

The project has four central thrusts:

  • ANALOG, led by John Riggi, National Advisor for Cybersecurity and Risk at the AHA, builds upon traditional methods of identifying and mapping critical dependencies by methodically sampling the expertise of subject-matter-experts from several hundred hospitals of various types, sizes and geographies.
  • ANSWER, led by Stefan Savage, PhD, Geoff Voelker, PhD, and Alex Snoeren, PhD, professors in the Department of Computer Science and Engineering at the Jacobs School, collects and analyzes real-world internet data to build databases and visualizations of network relationships. "The internet is an incredibly dynamic ecosystem that changes week-to-week," said Savage. "ANSWER's goal is to automatically update these complex maps, allowing us to see emerging risks and structural weaknesses before they become a threat."
  • AIRWAVE, led by Aaron Schulman, PhD, associate professor of computer science and engineering at the Jacobs School and Dave Levin, PhD, associate professor of computer science at University of Maryland, aims to monitor Bluetooth, Wi-Fi and other signals in hospitals to dynamically locate networked medical devices to aid hospitals and government stakeholders in understanding the potential impact when cyber vulnerabilities are discovered in legacy health care equipment.
  • ANDMORE, led by Kumar and Hannah Neprash, PhD, associate professor at the University of Minnesota School of Public Health, mines human-readable public information from social media, online job postings, press releases, hospital websites, Medicare data and more to infer vendor relationships and software use.

Co-principal investigator Christian Dameff, MD, associate professor of emergency medicine at UC San Diego School of Medicine and co-director of the UC San Diego Center for Healthcare Cybersecurity, said initial maps will validate mapping techniques for broader adoption.

Validated mapping of hidden vulnerabilities will help prioritize which network dependencies to secure first. It will also identify linchpin companies, predict hospital impacts from device or IT service vulnerabilities and drive preventive steps to avoid another event like the Change Healthcare breach.

The mapping tools that PANACEA-H develops will be made available to stakeholders responsible for safeguarding cyber resiliency, including agencies in the federal government, state, regional, and local public health systems and health care delivery organizations.

"As the health care sector becomes more digitally dependent and interconnected, we are creating an environment where a cyberattack in one part of the sector can cascade across the entire sector," said Riggi. "Ultimately, this 'cyber blast radius' represents a systemic risk to patient safety and to national security. Understanding how health care and other critical infrastructure are digitally interconnected is imperative if we are to begin to defend key nodes and prepare for the disruptive impact that sophisticated criminal organizations and nation states are intent on delivering."

"Hospitals don't work in isolation, they work in tandem with many different vendors, partners, software and medical devices - a very complicated, interconnected system with many different players all coming together to provide care. Any one lapse in service can actually cause a lot of disruption in the way that Americans get health care." - Deepak Kumar, PhD

The tools could also be used to develop technologies to boost the long-term cyber resilience of critical infrastructure across other major sectors.

"What we're trying to do has never been done before - It's truly a moonshot idea," said Dameff. "Our motivation is safe digitally-connected patient care. But these tools could be extended far beyond health care and used to assess and strengthen the energy sector, finance, agriculture or manufacturing."

This research was, in part, funded by the Advanced Research Projects Agency for Health (ARPA-H). The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the United States Government.

Read more news about: School of Medicine, Health Sciences

UCSD - University of California - San Diego published this content on October 27, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on October 27, 2026 at 18:00 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]