Jeff Tully

Jeff Tully is a medical cybersecurity researcher whose works have been published in JAMA Internal Medicine, JAMA Network Open, The Journal of Emergency Medicine, the Journal of the American College of Cardiology and the Journal of Medical Internet Research, among others.^[1][2][3] He has spoken internationally about these topics at conferences like DEF CON, the RSA Conference and DerbyCon.^{[4][5][6][7][8]} He is also co-director of The UCSD Center for Healthcare Cybersecurity at the University of California-San Diego and co-principal investigator of the Healthcare Ransomware Resiliency and Response Program (H-R3P).^[9][10] Tully is also a board-certified anaesthesiologist and pediatrician, as well as an associate clinical professor at the University of California-San Diego.^[11][12]

Jeff Tully
Alma mater	University of Arizona College of Medicine – Phoenix
Known for	Medical infrastructure security Medical device security
Scientific career
Fields	Cybersecurity Medicine
Institutions	University of California-San Diego School of Medicine UCSD Center for Healthcare Cybersecurity Healthcare Ransomware Resiliency and Response Program

Early life and career

While attending the University of Arizona College of Medicine – Phoenix, Tully showed an interest in biohacking, presenting at DEF CON 20 in 2013.^[4] Tully graduated and specialized in anesthesiology and pediatrics.^[8]

Following the WannaCry ransomware attacks in 2017, Tully shifted his attention to improving the cybersecurity of emergency medical services, hospitals, critical medical infrastructure, and medical devices. He organized the CyberMed Summit, a medical cybersecurity conference. The CyberMed Summit offered practical, hands-on clinical simulations  of cybersecurity breaches in hospital environments and included medical professionals, cybersecurity experts, law-enforcement officials, policymakers and hackers.^[13][14][15] During the COVID-19 pandemic, Tully brought attention to the security issues of telemedicine and the increased possibility of cyberattacks.^[16]

Tully advocates securing access to hospital and healthcare networks, hardening emergency services against cyberattacks and securing medical devices.^{[17][18][19][20][21]} In addition to those duties, Tully is also an associate clinical professor at the University of California-San Diego School of Medicine where he teaches medical students, residents and fellows and contributes to medical and cybersecurity academic research.^[12]

In October of 2023, Tully was named co-principal investigator for the Healthcare Ransomware Resiliency and Response Program (H-R3P) at the University of California-San Diego, which secured a $9.5 million Advanced Research Projects Agency for Health grant.^[9][17][10]

Selected academic research

• C Dameff, J Selzer, J Fisher, J Killeen, J Tully (2018). “Clinical Cybersecurity Training Through Novel High-Fidelity Simulations.” The Journal of Emergency Medicine.^[22]
• J Tully, M Jarrett, S Savage, J Corman, C Dameff (2018). “Digital Defenses for Hacked Hearts: Why Software Patching Can Save Lives.” Journal of the American College of Cardiology.^[23]
• M Goebel, C Dameff, J Tully (2019). “Hacking 9-1-1: Infrastructure Vulnerabilities and Attack Vectors”. Journal of Medical Internet Research.^[24]
• J Tully, A Coravos, M Doerr, C, Dameff. “Connected Medical Technology and Cybersecurity Informed Consent: A New Paradigm”. Journal of Medical Internet Research.^[25]
• J Tully, J Selzer, J Phillips, P O’Connor, C Dameff (2020). “Healthcare Challenges in the Era of Cybersecurity.” Health Security. ^[26]
• L Maggio, C Dameff, S Kanter, B Woods, J Tully (2021). “Cybersecurity Challenges and the Academic Health Center: An Interactive Tabletop Simulation for Executives”. Academic Medicine : Journal of the Association of American Medical Colleges. ^[27]
• N Sullivan, J Tully, C Dameff, C Opara, M Snead, J Selzer (2023). “A National Survey of Hospital Cyber Attack Emergency Operation Preparedness”. Disaster Medicine and Public  Health Preparedness. ^[28]
• C Dameff, J Tully, T Chan, E Castillo, S Savage, P Maysent, T Hemmen, B Clay, C Longhurst (2023). “Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US”. JAMA Network Open. ^[29]
• H Neprash, C Dameff, J Tully (2024). Cybersecurity Lessons from the Change Healthcare Attack. JAMA Internal Medicine. ^[30]