Cyberattacks are the latest in a string of health care breaches
First, they went after Lurie Children’s Hospital in Chicago.
Next, cybercriminals attacked Ascension, a large nationwide health system with 14 hospitals in Illinois.
In both cases, the hospital systems kept providing care, but took down their electronic health record systems and MyChart online patient portals.
It took more than a month for Lurie to get all of its systems back online after the January cyberattack. Ascension – which rescheduled some nonemergency surgeries and temporarily diverted some ambulances as a result of a hack earlier this month – is still untangling the mess.
“We are focused on getting systems back up and running as safely and as quickly as possible,” Ascension said in a statement Wednesday. “Please be aware that it may still take some time to return to normal operations.”
Lurie and Ascension are hardly alone when it comes to battling increasingly sophisticated cybercriminals going after health care organizations. Last year, a record 725 large health care security breaches were reported to the U.S. Department of Health and Human Services Office for Civil Rights, according to the HIPAA Journal, which covers news related to the Health Insurance Portability and Accountability Act. The number of large, reported health care breaches increased by 93% between 2018 and 2022, according to the health and human services department.
“They keep coming,” said Ashraf Shehata, U.S. sector leader for health care for KPMG, an accounting and advisory firm. “When there’s a
successful attack, you’re going to see more and more and flow into that space.”
Cyberattacks have been a problem facing many industries for years. But health care systems are particularly attractive targets for cybercriminals because of their size, their dependence on technology and the large amounts of sensitive data they hold, according to the health and human services department.
Hospitals and health care systems have patients’ names, medical histories, billing information and addresses on file, among other things.
And when hospitals are hit with a cyberattack, the consequences can be dramatic.
In addition to postponing some appointments and surgeries, caring for hospital patients became more difficult for a time after the attack, said nurses at one Ascension Illinois hospital.
Hospitals typically take down some of their electronic systems following a cyberattack in order to isolate the problem, and to prevent hackers from doing any further damage, experts say. But that lack of access to electronic health records and systems
is challenging, nurses say.
For a day or so after the attack, nurses couldn’t automatically see when doctors entered orders for patients, such as for tests and medications, said Paula Koranda, a staff nurse at Ascension Saint Joseph-Joliet hospital. They only learned about an order if they spoke with the doctor, she said.
Also, normally, when administering medication, nurses scan barcodes on the medication containers and on patients’ hospital bracelets to make sure they’re giving the right medication to the right patient. They also temporarily lost the ability to do that after the attack, Koranda said.
Hospitals can also face serious financial consequences after a cyberattack. Last year, one rural Illinois hospital – St. Margaret’s Health-Spring Valley – closed its doors after a cyberattack. Hospital leaders blamed the facility’s demise partly on the COVID-19 pandemic, the cost of agency nurses and a “computer hacking” that damaged its ability to bill for its services, in a document submitted to the Illinois Health Facilities and Services Review Board.