Cyberattack of Mississippi health system closes clinics, delays surgeries

Like other health systems, the University of Mississippi Medical Center has discovered just how disruptive cyberattacks can be.

The medical center confirmed Thursday that it has suffered a cyberattack. The attack could be a multi-day event, the system said.

All of the medical center’s clinics across the state were closed Thursday, and the system said the clinics would be closed again Friday. The health system also postponed outpatient and ambulatory surgeries Thursday, and said elective procedures would be delayed again Friday. Other appointments are being rescheduled as well.

The academic health system said its hospitals and emergency departments are still open and serving patients.

“UMMC hospitals and Emergency Departments will remain open the duration of this incident unless we communicate otherwise,” the medical center said in a Facebook post Thursday night.

“We continue to work with federal authorities and national experts in cyberattack response as we evaluate the extent of the attack and our next steps,” the medical center said in its post. “We expect this to be a multi-day event and will communicate helpful information, when available.”

Many of the health system’s information technology systems are down, including UMMC’s electronic health records. The system uses Epic for its health records.

LouAnn Woodward, the medical center’s vice chancellor for health affairs, said at a news conference that the attack was discovered early in the morning, the Clarion-Ledger reported.

"There are a lot of questions that I have, that we all have, that you have, that we don't know the exact answers to at this point. There's a lot we don't know," Woodward said.

UMMC is Mississippi’s only academic health system. The system operates five hospitals and more than 30 clinics.

Nearly 500 hacking incidents affecting healthcare organizations were reported to the federal government last year.

John Riggi, national adviser for cybersecurity and risk at the American Hospital Association, told Chief Healthcare Executive in a December interview that hospitals are generally doing a better job in defending against attacks. But he says hospitals remain the targets of ransomware gangs, since attackers know health data is highly valuable.

As Riggi says, “The question, we always say, is not if you will be attacked, but how prepared are you?”

ECRI, a patient safety organization, ranked computer outages among the biggest threats to patient safety. The group ranked “digital darkness” as the second leading threat in its annual list of the 10 biggest risks to patient safety.

Schabacker told Chief Healthcare Executive in an interview that hospitals should view outages - tied to cyberattacks or natural disasters - as an inevitability.

“These things can happen and they will happen,” Schabacker says. “It's not a question of if they happen. The question is, when it's going to hit you. And if you are woefully unprepared, then you put patient lives at risk.”

Schabacker said that hospitals face big problems when their computers are down. Without electronic health systems, hospitals have to rely on paper to keep records of patient care, and clinicians don’t have easy access to patients’ medications or allergies.

And cyberattacks carry substantial financial costs to systems, with delays in services and the upheaval to business functions.

“There's lots of reasons why you wouldn't want to have a prolonged outage,” Schabacker says.

The Joint Commission has published guidance for hospitals in maintaining operations due to a cyberattack and the outage of systems.

Health systems should be prepared to have life-saving technology offline for four weeks or longer. Health systems also need contingency plans if they manage electronic records from a central location, and if disruptions are occurring at multiple hospitals.

Experts also caution that cyberattacks have a “blast radius” extending beyond the targeted facilities. Other hospitals end up seeing greater patient volume, and some patients with more serious conditions often must be transferred.