AIDA:A health informatics-oriented adaptive cybersecurity framework for clinically aware detection and response in healthcareOA

Background:Healthcare organizations increasingly depend on integrated electronic health records,connected medical devices,and identity-aware clinical workflows,yet these health informatics systems remain vulnerable to ransomware,adversarial intrusion,and disruptive data exfiltration.This study positions AIDA(Awareness,Integration,Detection,and Adaptation)as a clinically aware security-analytics framework for healthcare in-formation environments rather than as a purely technical intrusion-detection model.Methods:AIDA combines Random Forest,Autoencoder,and XGBoost models with multi-objective optimization and a Patient Care Disruption Index(PCDI)to support clinically informed response selection.The framework ingests EHR,IoMT,and access-control telemetry;correlates alerts across these streams;and was evaluated through temporally blocked validation,digital-twin simulation of a 300-bed hospital,breach backfitting,and comparative benchmarking against human-centric and machine-learning baselines.Findings:AIDA achieved an AUC of 0.961,an AUCPR of approximately 0.955,and an average detection latency of 18 s.In the simulated hospital environment,the framework reduced PCDI by approximately 37%relative to baseline conditions,retained strong interpretability through SHAP-supported explanations,and demonstrated broader scenario coverage than comparator frameworks.Interpretation:The results suggest that health informatics security can be improved when cyber defense is designed around multisource data fusion,workflow-aware decision support,and continuity-preserving inter-vention logic.AIDA therefore contributes not only a cybersecurity framework,but also an implementable model for protecting clinical information infrastructures without treating patient care continuity as a secondary concern.