UC San Diego Wins Up to $29.9 Million ARPA-H Award to Map Hidden Hospital Cyber Dependencies

The University of California San Diego Center for Healthcare Cybersecurity has received an award of up to $29.9 million over a maximum of four years from the Advanced Research Projects Agency for Health (ARPA-H) to lead a project that aims to map and continuously monitor the technology dependencies that hospitals rely on to deliver care. The project, known as PANACEA-H — short for Preventative Assessment and Network Analysis of Cyber Essential Abilities for Health — will be carried out in collaboration with the American Hospital Association (AHA), the University of Maryland and the University of Minnesota. According to the announcement released on 27 October 2026, the effort is designed to identify the critical linchpins within hospital networks whose failure could destabilize care delivery, a goal that has taken on new urgency following recent large-scale cyberattacks on the health care sector.

PANACEA-H will develop innovative tools to map and monitor technology dependencies — systems, processes and infrastructure that are reliant on networked hardware, software and digital services. The central premise of the project is that many of these dependencies remain invisible to hospital administrators and even to cybersecurity specialists until something goes wrong. In many cybersecurity attacks, the vulnerability goes unrecognized until it fails. The Change Healthcare breach of 2024, which triggered nationwide disruptions in health care operations and resulted in billions in lost revenue, brought into stark relief the need to reimagine how dependencies are mapped, the university said in its announcement.

“When it comes to cyber resiliency, you can’t protect what you don’t see,” said principal investigator Jeff Tully, MD, associate clinical professor and Sheldon Furst Endowed Chair of Anesthesiology at UC San Diego School of Medicine and co-director of the Center for Healthcare Cybersecurity. Tully noted that traditional approaches for identifying and mapping sector dependencies can be incomplete and error prone, leading to static snapshots of network vulnerabilities that can quickly lose relevance as new technologies emerge, as sector consolidation proceeds and as regulatory developments reshape the landscape. “What PANACEA-H seeks to do is a very sophisticated version of what many people in the government and the public and private sector have been working on,” he said.

The interconnected nature of modern hospital operations is central to the project’s rationale. “Hospitals don’t work in isolation, they work in tandem with many different vendors, partners, software and medical devices — a very complicated, interconnected system with many different players all coming together to provide care,” said co-principal investigator Deepak Kumar, PhD, assistant professor in the Department of Computer Science and Engineering at the UC San Diego Jacobs School of Engineering. “Any one lapse in service can actually cause a lot of disruption in the way that Americans get health care.” The project’s organizers argue that this complexity makes manual mapping efforts insufficient, and that only continuously updated, data-driven approaches can keep pace with the changing structure of the health care technology ecosystem.

To that end, the project is organized around four central thrusts, each led by a different team of investigators. The first, called ANALOG, is led by John Riggi, National Advisor for Cybersecurity and Risk at the American Hospital Association. It builds upon traditional methods of identifying and mapping critical dependencies by methodically sampling the expertise of subject-matter experts drawn from several hundred hospitals of various types, sizes and geographies. This human-expertise component is intended to capture institutional knowledge about which systems and vendors matter most for care delivery, building upon traditional methods of identifying and mapping critical dependencies.

The second thrust, ANSWER, is led by Stefan Savage, PhD, Geoff Voelker, PhD, and Alex Snoeren, PhD, professors in the Department of Computer Science and Engineering at the Jacobs School. ANSWER will collect and analyze real-world internet data to build databases and visualizations of network relationships. “The internet is an incredibly dynamic ecosystem that changes week-to-week,” said Savage. “ANSWER’s goal is to automatically update these complex maps, allowing us to see emerging risks and structural weaknesses before they become a threat.” By grounding the maps in observed internet traffic and infrastructure data rather than in one-time surveys, the team hopes to produce a living picture of the sector’s dependencies rather than a static snapshot.

The third component, AIRWAVE, is led by Aaron Schulman, PhD, associate professor of computer science and engineering at the Jacobs School, together with Dave Levin, PhD, associate professor of computer science at the University of Maryland. AIRWAVE aims to monitor Bluetooth, Wi-Fi and other wireless signals inside hospitals in order to dynamically locate networked medical devices. By locating where such devices actually operate within a hospital’s network environment, the tool is intended to make the consequences of a newly disclosed vulnerability concrete and actionable.

The fourth thrust, ANDMORE, is led by Kumar together with Hannah Neprash, PhD, associate professor at the University of Minnesota School of Public Health. ANDMORE will mine human-readable public information — including social media posts, online job postings, press releases, hospital websites, Medicare data and more — to infer vendor relationships and software use across the sector. This approach acknowledges that much of the information needed to understand who supplies what to whom is publicly available but dispersed and unstructured. Combining it with the other data streams could reveal dependencies that no single hospital, regulator or vendor currently sees in full.

Co-principal investigator Christian Dameff, MD, associate professor of emergency medicine at UC San Diego School of Medicine and co-director of the UC San Diego Center for Healthcare Cybersecurity, said that initial maps produced by the project will be used to validate the mapping techniques for broader adoption. Once validated, the mapping of hidden vulnerabilities is expected to help prioritize which network dependencies should be secured first, identify linchpin companies whose failure would have outsized effects, predict hospital impacts from device or IT service vulnerabilities, and drive preventive steps aimed at avoiding another event like the Change Healthcare breach. The mapping tools that PANACEA-H develops will be made available to the stakeholders responsible for safeguarding cyber resiliency, including agencies in the federal government, state, regional and local public health systems, and health care delivery organizations.

Project leaders frame the stakes in systemic terms. “As the health care sector becomes more digitally dependent and interconnected, we are creating an environment where a cyberattack in one part of the sector can cascade across the entire sector,” said Riggi. “Ultimately, this ‘cyber blast radius’ represents a systemic risk to patient safety and to national security. Understanding how health care and other critical infrastructure are digitally interconnected is imperative if we are to begin to defend key nodes and prepare for the disruptive impact that sophisticated criminal organizations and nation states are intent on delivering.” The tools could also be used to develop technologies to boost the long-term cyber resilience of critical infrastructure across other major sectors. “What we’re trying to do has never been done before — it’s truly a moonshot idea,” said Dameff. “Our motivation is safe digitally-connected patient care. But these tools could be extended far beyond health care and used to assess and strengthen the energy sector, finance, agriculture or manufacturing.”

University leadership emphasized the institutional significance of the award. “This award underscores UC San Diego’s unique ability to bring together world-class medical expertise and advanced computer science to solve critical national security challenges,” said John M. Carethers, MD, vice chancellor for Health Sciences at UC San Diego. “The mapping tools developed by the Center for Healthcare Cybersecurity will transform how the entire health care sector defends itself, cementing UC San Diego’s role as a driving force behind the nation’s health IT infrastructure and patient safety.” It is worth noting that the project is at its outset: the award funds the development of these mapping tools over the coming years, and their effectiveness in preventing disruptions will only become clear as the work proceeds. The research is funded in part by ARPA-H, and the views expressed in the announcement are those of the authors and should not be interpreted as representing the official policies of the United States Government.

Subject of Research: Cybersecurity mapping of hospital technology dependencies and networked medical infrastructure

Article Title: UC San Diego receives major ARPA-H Award to map key hospital network dependencies critical to care

Article References: UC San Diego receives major ARPA-H Award to map key hospital network dependencies critical to care. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: ARPA-H, UC San Diego, healthcare cybersecurity, PANACEA-H, hospital networks, Change Healthcare breach, medical devices, network dependencies, American Hospital Association, cyber resilience, patient safety, health IT