Hospitals should practice treating patients without their computer systems to prepare for potentially disruptive cyberattacks, health leaders have said.
Luis Taveras, executive vice president and chief digital and information officer at Jefferson Health, said hospitals’ reliance on technology can leave clinicians struggling to operate when systems suddenly go down – an experience he said caused “panic” during a recent outage at Jefferson.
Taveras said his teams, which once installed batches of security patches monthly, now have to patch systems every day as attacks become more frequent.
“We have to think about the fact that we’re going to get hit by cyber criminals,” Taveras said at Newsweek’s AI Health Summit in New York City. “They’re well funded, right? They’re very smart people, and they’re looking for ways to attack us every single day.”
In February, a ransomware attack forced the University of Mississippi Medical Center to temporarily close roughly three dozen clinics, cancel elective procedures and switch to manual operations after its electronic health record system was disrupted.
Cyberattacks on hospitals can have deadly consequences. A study published in February in the American Economic Journal: Economic Policy found in-hospital mortality was 34% to 38% higher among patients already admitted when an attack began.
Rather than focusing solely on preventing attacks, Taveras said Jefferson is putting greater emphasis on resilience.
“We've done really well with business continuity plans for a long time,” he said. “But what we haven't done well is clinical continuity plans, and that's what I have the organization focusing on now.”
Taveras said hospitals need plans for how they would continue treating patients without their usual technology, including identifying the minimum services and systems needed to keep operating – what he called the “minimal viable hospital.”
The challenge became clear during a roughly three-hour outage at Jefferson several weeks before the summit.
“It was panic,” Taveras said. “These young clinicians didn’t know what to do.”
The experience prompted Jefferson to consider treating cyber preparedness more like a fire drill.
“Should we do at least once a quarter an exercise where we take the system down for two, three hours, and get people used to operating without the system?” Taveras asked.
Taveras said the goal is not only to prevent cyberattacks, but to ensure hospitals can recover quickly when defenses fail.
“I have to make sure that when that happens, that we are not down for six weeks, for eight weeks,” he said.
Dr. Nabil Chehade, chief clinical transformation, innovation and strategy officer at The MetroHealth System, described a similar disruption just a week before the summit. The outage was not caused by a cyberattack, but by a data-center temperature-control problem that unexpectedly shut down systems in the middle of the day.
“It was, as you said, panic,” Chehade said. “Actually, we did close our outpatient setting.”
He said some doctors began leaving because they did not know how to continue practicing without the systems they normally relied upon.
The 2024 ransomware attack on Change Healthcare by Russian ransomware group ALPHV BlackCat disrupted claims, prescriptions and insurance eligibility nationwide. The American Hospital Association said “every hospital in the country felt the impact, either directly or indirectly.” In its survey of nearly 1,000 hospitals, 74 percent reported impacts on patient care, 94 percent reported financial disruption and a third said more than half their revenue was affected.