In a recent statement, Luis Taveras, Executive Vice President and Chief Digital and Information Officer of Jefferson Health, a large non-profit cross-state healthcare system in the United States, emphasized the importance of hospitals practicing treating patients without computer systems in preparation for potential damage from future cyberattacks.
In recent years, American healthcare institutions have faced severe cyberattacks. In response to this serious challenge, many experts in healthcare cybersecurity and management strongly recommend that healthcare facilities regularly test their complete shutdown “no-computer operation” contingency plans. This includes training healthcare personnel to maintain clinical operations and patient care independently in extreme environments without electronic records or networks for weeks.
Taveras pointed out that hospitals’ excessive reliance on technology could hinder clinical practitioners from carrying out their work when computer systems suddenly fail. A recent computer system failure at Jefferson Health caused “panic,” highlighting the vulnerability of depending too heavily on technology.
He mentioned that his team used to install security patches monthly, but due to the increasing frequency of attacks, they now have to patch the computer systems daily.
During the AI Health Summit hosted by Newsweek in New York City, Taveras emphasized the need to acknowledge the reality that cybercriminals will attack, actively seeking ways to infiltrate systems with their financial resources and cunning tactics on a daily basis.
In February, the University of Mississippi Medical Center fell victim to a ransomware attack, resulting in interruptions in its electronic health record system, temporary closure of around 36 clinics, and the cancellation of elective procedures, forcing the hospital to resort to manual operations.
A study published in February in the American Economic Journal’s sub-journal Economic Policy found that patients admitted at the onset of an attack had a 34% to 38% higher in-hospital mortality rate compared to other patients.
Taveras stressed that Jefferson Health not only focuses on preventing attacks but also is committed to enhancing its resilience. Acknowledging their excellent business continuity planning, Taveras noted the need to improve clinical continuity planning, which is a key area of focus for the organization.
He emphasized the importance of developing plans to establish a “minimal viable hospital,” identifying the minimum services and systems required to maintain operations, and training doctors to continue treating patients without common technologies, ensuring service provision during crises.
In the weeks leading up to the summit, Jefferson Health experienced a three-hour power outage that highlighted the severity of the challenges. Taveras recalled the chaos during the outage, underscoring the necessity of treating network security measures as fire drills to be prepared for such scenarios proactively.
He proposed conducting such exercises every quarter, shutting down systems for two to three hours to acclimate people to operating without computer systems.
The ultimate goal is not just preventing cyberattacks but also ensuring swift recovery post-security breach, avoiding prolonged disruptions. Safeguarding against potential life-threatening consequences of hospital network attacks remains a critical imperative.
Dr. Nabil Chehade, Chief Clinical Transformation, Innovation, and Strategy Officer at MetroHealth in Ohio, shared a similar incident prior to the summit, where a system shutdown occurred due to data center temperature control issues during the day, causing no harm from a cyberattack but leading to clinic closures and uncertain medical practices.
The attack by the ransomware group ALPHV BlackCat on Change Healthcare, a major US healthcare technology and payment services company in 2024, resulted in nationwide interruptions in claims, prescriptions, and insurance eligibility verification operations.
The American Hospital Association stated that “all hospitals nationwide have been directly or indirectly impacted” by such cyberattacks. In a survey involving nearly 1,000 hospitals, 74% reported patient care disruptions, 94% faced financial impacts, with one-third indicating over half of their income affected.
As the healthcare industry continues to battle cybersecurity threats, prioritizing cybersecurity protocols and contingency plans has become paramount to mitigate risks and ensure seamless continuity of healthcare services for patients.