“CYBERSECURITY IN HEALTHCARE” (HealthSec’26)!
An IEEE ACSAC42 Workshop
(see HealthSec 2025, HealthSec 2024)

An interdisciplinary one-day workshop to be co-located with the Annual Computer Security Applications Conference (ACSAC42) <https://www.acsac.org/>

Archive of previous HealthSec Workshops:

===

HealthSec’26 Workshop – Tuesday December 8 th 2026

Hotel Location: Hilton Los Angeles/Universal City, (Los Angeles, CA USA)
555 Universal Hollywood Dr, Universal City, CA, 91608
telephone: +1-(818)-506-2500


WORKSHOP SCHEDULE – Workshop Hotel Room: TBA
(note – all times listed here are local times) [U.S. Pacific Time Zone (PST; UTC−8)


7:30AM â€“ REGISTRATION DESK (To Be Announced)

7:30AM â€“ LIGHT BREAKFAST (To Be Announced) [7:30am-8:30am]

8:30AM â€“ HealthSec’25 CHAIRS’ WELCOME {Warning – Starts Promptly!} & PAPER SESSION 1: “NO-CHAIR LIGHTNING PAPERS”
Presenters: William Yurcik/CMS, Maria Palombini/IEEE, Vishnu Bondalakunta/Kansas State University, Sean Tang/UCLA (respectively)

  • “The Y2K38 Timestamp Rollover – What it is and Why it is a Significant Patient Safety Problem” (paper01)
  • * “Unified Medical Device Cybersecurity: Global Regulatory Compliance through IEEE 2621
    Certification” (paper02)
  • “A Privacy-Preserving Framework for Sharing and Learning from Scarce Medical Video” (paper03)
  • “Robustness of Biomedical Foundation Models: Threats, Defenses, and Open Challenges” (paper04)

9:30AM â€“ PAPER SESSION 2 – “HIPAA”
Session Chair: to be announced

  • “Jurisdiction-Aware End-to-End Auditing of Mobile Health Privacy” (paper05) presented by: Indrakshi Ray/Colorado State University
  • “PHI Gap Analysis under HIPAA: A Norm Model Approach” (paper06) presented by: Sayonnha Mandal/Metro State University

10:00AM â€“ REFRESHMENTS BREAK

10:30AM â€“ PAPER SESSION 3 “Healthcare Threats/Safeguards”
Session Chair: to be announced

  • “Threat Modeling in the Healthcare Sector” (paper07) presented by: Isabelle Brown-Cantrell/University of Alabama in Huntsville
  • “Security of Biomedical Large Language Models: Threats, Defenses, and Open Challenges” (paper08) presented by: Sanjay Purushotham/University of Maryland Baltimore County (UMBC)
  • “A Tiered Access-Control Framework for Securing LLM Voice Agents on FHIR” (paper9) presented by: Abhinav Srivastava/Independent Researcher
  • “TwinGuard-Lite: A Rule-Based State-Admission Gateway for Generative Patient Digital Twins” (paper10)
    presented by: Wenhui Chu/University of Albany

12:00PM  â€“ LUNCH BUFFET (Hotel Room: TBD)

1:30PM â€“ KEYNOTE TALK
Ashish Kundu
Head of Cybersecurity Research, Cisco
“keynote talk title to be announced”

2:20PM â€“ PAPER SESSION 4 “Medical Device Cybersecurity”
Session Chair: to be announced

  • “SweetTooth: A Security Analysis of Regulated, Over-the-Counter Diabetes Monitoring Devices” (paper11) presented by: tba/Johns Hopkins University
  • “Oximoron: A Vulnerability Assessment of Regulated, Over-the-Counter Pulse Oximetry Devices” (paper12) presented by: tba/Johns Hopkins University

3:00PM â€“ REFRESHMENTS BREAK

3:30PM â€“ PAPER SESSION 5 – “Medical Images/Video & CyberBioSecurity”
Session Chair: to be announced

  • “Empirical Measurements of Internet-Exposed Unencrypted Medical Images: DICOM Detection Techniques and Analysis” (paper13) presented by: J. Malakai Bailey/Alyn
  • “Patched but Unreleased: A Coordinated Medical Imaging Disclosure Without a Fixed Version” (paper14) presented by: Abhinav Agarwal/Independent Researcher
  • “Physiological Linkage Attacks Against Visually Obfuscated Videos Using rPPG” (paper15) presented by: Ryo Iijima/Advanced Industrial Science and Technology
    …
  • “Cyberbiosecurity: Understanding the Multidimensional Paradigm Shift Presented by Internet-Accessible AI-Enabled Digital Biology Laboratories” (paper16)
    presented by: Gregory Pluta/University of Illinois & Healthcare Cybersecurity Foundation
  • “Cyberbiosecurity Threats to Internet-Exposed Portable Genome Sequencers” (paper17) presented by: Carson Stillman/University of Florida

5:30PM â€“ HealthSec’26 Closes – Please Join Us for Further Discussions over Refreshments at the
ACSAC Welcome Reception! (Hotel Room: to be announced)

==========

CALL-FOR-PAPERS

In its most basic form, healthcare is gathering data, interpreting data into information, and transforming information into current human knowledge that can be acted upon, with each of these stages open to unintended errors and/or malicious subversion. These stages do not occur within a vacuum but rather within our existing infrastructures and social system with all their current limitations, systemic bias, and exploitable vulnerabilities. While a similar characterization can be made about security in other applied domains, healthcare is undergoing a dramatic transformation, arguably a technological revolution, presenting ground-breaking opportunities for improvement along with corresponding challenges in security.

Our desire is to bring together diverse researchers from academia, government, and the healthcare industry to report on the latest research efforts. As this is the third workshop, we want to continue momentum toward encouraging, jumpstarting, and growing excellent interdisciplinary contributions at the forefront of cybersecurity in healthcare research.  Papers with demonstrated results will be given priority.  We seek submissions from researchers and practitioners on a list of potential topics which includes, but is not limited to:

Cybersecurity issues (including risks, challenges, incidences, solutions, approaches)

  • Healthcare as critical national infrastructure
  • AI in healthcare (e.g. clinical decision support software, ambient clinical documentation)
  • Big data/high performance computing (HPC) in healthcare
  • Storage encryption, authentication, provenance in healthcare environments
  • Healthcare supply chain resilience
  • Cyberbiosecurity
  • Digital Twins
  • Online health communities and patient portals
  • Health information exchanges (HIEs)
  • Electronic health records (EHRs)
  • Hospital-at-Home, Telemedicine, Telehealth
  • Internet of (medical) Things (MIoT)
  • Medical devices, medical implants, and/or medical wearables
  • Wireless/mobile healthcare and/or remote patient monitoring
  • Digital healthcare tools and safety engineering to improve patient safety
  • Human factors safety engineering in clinical facility settings
  • Healthcare insider threats
  • Software-controlled robotic medical systems
  • Updating/patching software and re-certification of medical devices
  • Food Insecurity as a Healthcare concern
  • Applications of STAMP/CAST/STPA techniques to healthcare
  • Ransomware attacks on healthcare – especially hospitals (see Note 1 below)
  • Events resulting in (HIPAA/GDPR) healthcare privacy breaches (see Note 2 below)
  • Comparisons of IT infrastructure in different types of healthcare facilities/services
  • Empirical study of cybersecurity in a specific healthcare IT environment
  • Policy/Legal/Ethical position papers – addressing healthcare cybersecurity issues
  • Economics of healthcare cybersecurity
  • Technical efforts by governmental entities to improve cybersecurity in healthcare

Papers with the following as their only foci are discouraged and will be rejected a priori:

  • Cybersecurity best practice recommendations for healthcare
  • Note 1- Papers are discouraged which are longitudinal studies showing increasing cyberattacks on healthcare based on HHS/OCR or proprietary data sets – HHS/OCR data is poor quality and proprietary datasets are non-replicable artifacts
  • Note 2- Papers are discouraged which mix analysis of privacy breaches with ransomware outages

Questions about your paper topic, then please email the workshop chair in advance!

===

IMPORTANT HealthSec 2026 DATES:

  • Paper Submission Deadline {all paper categories}: Friday July 24 2026 Friday August 7, 2026
  • Paper Review Deadline for PC Members: Friday August 28 2026 Sunday, September 20, 2026
  • Paper Acceptance Notification to Authors: Saturday September 19 2026 Saturday September 26, 2026
  • Camera-Ready Accepted Paper Deadline: Sunday November 1, 2026 (no extensions)
  • HealthSec 2026 Workshop Date: Tuesday December 8, 2026

===

PAPER SUBMISSION GUIDELINES:

                Five (5) Paper Submission Categories

  1. Regular technical paper submissions between 7-12 pages including references
  2. Short technical paper submissions between 2-6 pages including references
  3. Lightning/Poster technical paper submissions between 1-2 pages including references
  4. Case Study paper submissions between 2-6 pages including references
  5. Position paper (opinion/invited paper) submissions between 2-12 pages [note – please email workshop chair in advance of the deadline to discuss your position paper ideas]
  • All submitted papers are required to be in the US Letter (not A4) double-column IEEE format which will be strictly enforced. IEEE format templates are available at: 

                             <https://www.ieee.org/conferences/publishing/templates.html>  

In order to help peer review purposes, please make the title of your submitted paper to include a prefix indicating your selected paper submission category – this prefix will be removed when your paper is published!  For example:

“Regular Paper: Title“
“Short Paper: Title“
“Lightening Paper: Title“
“Poster Paper: Title“
“Case Study Paper: Title“
“Position Paper: Title “

LaTeX submissions must use the IEEEtran.cls version 1.8b template  with the \documentclass[conference,compsoc]{IEEEtran} documentclass option. 

Papers must be NON-BLINDED clearly listing each author’s organizational affiliation and contact information for one corresponding author.  Paper submissions not meeting these specified format guidelines risk rejection without consideration of paper merits.

  • All papers must be submitted through the HotCRP HealthSec-2026 paper submission system at this link:        <https://healthsec.submit.acsac.org>.
  • Accepted papers published in the IEEE Xplore Digital Library workshop proceedings!
  • Selected post-workshop revised papers will also be published by Springer Nature in a separate book workshop proceedings!
  • For each accepted paper – at least one author must register for the HealthSec Workshop â€“ and attend in-person â€“  with each accepted paper presented in-person at the workshop.  Unfortunately the HealthSec Workshop does not have funds for paper authors and we realize the workshop registration fee and travel cost (airfare + hotel) represents a significant cost barrier.  As a result, if you are not able to handle the cost for an author to register and physically attend and present your paper at the workshop then please do not submit a paper. Special cases may be handled on a case-by-case basis in coordination with the ASCAC42 Conference Organizers. Accepted papers not presented in-person at the HealthSec 2026 workshop may have their acceptance withdrawn and paper not published. This in-person attendance requirement is the current reality of research conference economic viability.

WORKSHOP PARTICIPATION VIA ATTENDANCE – REGISTRATION  DETAILS

If you are interested in attending, check the appropriate box on the ACSAC 2026 conference registration form and add “CYBERSECURITY IN HEALTHCARE” (HealthSec) Workshop fee.

We welcome all participants! – Including those newly attracted to this research space as well as those who live in this research space.  One of the unique things about our inclusive community is that our research space indeed touches everyone and each of us has some experience to share and/or expert knowledge to contribute. This research space is large enough for all of us so please join us – where everyone knows your name – and they’re always glad you came!  There are no strangers in our workshop community, only friends who have not met yet! 

A non-US citizen who seeks to travel to California, in the United States, generally must first obtain a U.S. visa. Visas are placed in the traveler’s passport, a travel document issued by the traveler’s country of citizenship. Certain international travelers may be eligible to travel to the United States without a visa if they meet the requirements for visa-free travel. For additional detailed information about the visa process, please check what the requirements are to travel from your country to the USA, and access this link on the ACSAC 2026 conference website <https://www.acsac.org/visa/>.  PLEASE PLAN AHEAD TO ALLOW ENOUGH TIME (WEEKS/MONTHS) FOR THE MULTI-STEP VISA PROCESS TO EXECUTE, THIS IS YOUR RESPONSIBILITY.  

===

“HealthSec” email list created for Workshop Communications!       

•  To subscribe, send an email to sympa@lists.ischool.illinois.edu and in the email subject line type:
           subscribe healthsec firstname lastname  {leaving message body blank}
 â€˘  To send email to list after you subscribe (must be subscribed before sending to list), send an email to:            

                     healthsec@ischool.illinois.edu

 â€˘  To see general information about UIUC iSchool mailing lists: 

https://lists.ischool.illinois.edu/lists/help/introduction.html
                     {if you create a local login at this URL above you can use a graphic interface to the healthsec email list} 
• Your subscriber options can be found here: 

              https://lists.ischool.illinois.edu/lists/help/user-suboptions.html
• To see member roster currently subscribed, send an email to:        

              sympa@ischool.illinois.edu   {and in the email subject line type:}
           review healthsec  {leaving the email message body blank}
• To unsubscribe from this list, send an email to: 

             sympa@lists.ischool.illinois.edu {and in the email subject line type:}
             unsubscribe healthsec  {leaving the email message body blank}

===

Workshop Chairs / Organizing Committee:

  • CHAIR – William (Bill) Yurcik, Centers for Medicare & Medicaid Services (CMS) [healthsec DOT chair AT gmail DOT com]
  • VICE-CHAIR – Gregory Pluta, Healthcare Cybersecurity Foundation [gpluta AT gmail DOT com]
  • VICE-CHAIR – Scott Kruse, University of Texas at El Paso [cskruse AT utep DOT edu]
  • VICE-CHAIR – Gregory Koenig, PhD/MBA & Independent Researcher [koenig AT acm DOT org]
  • VICE-CHAIR & LOCAL SITE COORDINATOR FOR Los Angeles– [to be announced!]

===

HealthSec 2026 WORKSHOP PROGRAM COMMITTEE:

  1. Homa Alemzadeh, University of Virginia
  2. Jenny Amos, University of Illinois at Urbana-Champaign
  3. Prashant Anantharaman, Narf Industries
  4. Spiros Antonatos, Cymph
  5. J. Malakai Bailey, Alyn
  6. Elizabeth White Baker, Virginia Commonwealth University
  7. Adam Bates, University of Illinois at Urbana-Champaign
  8. Whitney Bowman-Zatzkin, Bioeconomy Information Sharing Analysis Center
  9. Roy H. Campbell, University of Illinois at Urbana-Champaign
  10. Jorge Castillo, University of Texas, Rio Grande Valley
  11. Benoit Desjardins, UniversitĂŠ de MontrĂŠal & University of Pennsylvania
  12. Diane Dolezel, Texas State University
  13. Josiah Dykstra, RTX BBN Technologies
  14. Kevin Farinholt, Caretaker Medical
  15. Luis Garcia, University of Utah
  16. Judy Wawira Gichoya, Emory University School of Medicine
  17. Dan Harkness, Argonne National Laboratory
  18. Ragib Hasan, University of Alabama at Birmingham
  19. Michelle Holko, Intl Computer Science Institute at University of California, Berkeley
  20. Cynthia Irvine, Naval Postgraduate School
  21. M. Eric Johnson, Vanderbilt University
  22. Latifur Khan, University of Texas at Dallas
  23. Kevin T. Kornegay, Morgan State University
  24. Veena Krish, Snowflake
  25. Insup Lee, University of Pennsylvania
  26. Bruce Leff, Johns Hopkins University Hospital
  27. David M. Levine, Harvard Medical School & Brigham and Women’s Home Hospital
  28. Xiaojing Liao, University of Illinois at Urbana-Champaign
  29. Johannes LohmĂśller, RWTH Aachen University
  30. Bradley Malin, Vanderbilt University Medical Center
  31. Patricia McGaffigan, Institute for Healthcare Improvement (IHI)
  32. John McHugh, AssuranceLabs
  33. Gargi Mitra, University of British Columbia
  34. Monique Monsoura, Global Health Security & Biotechnology, Strategic Advisor
  35. Stephen North, Infovisible
  36. Maria Palombini, IEEE Standards Association – Healthcare & Life Sciences
  37. Jan Pennekamp, RWTH Aachen University
  38. Zachary Peterson, Cal Poly, San Luis Obispo
  39. Sanjay Purushotham, University of Maryland, Baltimore County
  40. Raj Rajagopalan, Resideo
  41. Ben Ransford, Stripe
  42. Sanjoy Ray, PexMachina
  43. Nirmalya Roy, University of Maryland, Baltimore County
  44. Michael Rushanan, ARMATYR
  45. Marcus Sachs, Center for Internet Security
  46. Rami Saydjari, Ronin Institute for Independent Scholarship 2.0
  47. Cigdem Sengul, Brunel University of London
  48. Aashish Sharma, Lawrence Berkeley National Laboratory
  49. Swati Sharma, Indore Institute of Management and Research
  50. Sean Smith, Dartmouth College
  51. Luciano Pereira Soares, Insper Institute of Education and Research
  52. Natalie Sullivan, George Washington University Hospital
  53. Luis Vargas, ARMATYR
  54. Eugene Vasserman, Kansas State University
  55. Nalini Venkatasubramanian, University of California, Irvine
  56. Gang Wang, University of Illinois at Urbana-Champaign
  57. Guoxi Wang, Amazon
  58. Beau Wood, I am The Cavalry
  59. Christopher Worsham, Harvard Medical School & Mass General Hospital
  60. Luyi Xing, University of Illinois at Urbana-Champaign
  61. Daphne Yao, North Carolina State University
  62. Xiaoxin (Aaron) Yin, Meta
  63. Yifan Zhang, San Diego State University

presently being formed….

If you would like to volunteer to be on the HealthSec 2026 program committee and peer review workshop paper submissions then please email the workshop chair! 

===

…..

HealthSec2026
Email: gpluta@illinois.edu