Ransomware attacks significantly affect emergency department (ED) workflow, acute care delivery and the personal well-being of health care providers, a recent study on the health care impacts of ransomware attacks against hospitals’ EDs concluded.
In addition, hospital preparedness for such incidents is limited, and multiple challenges are encountered during the acute and recovery phases of attacks, said authors of the study published in the Annals of Emergency Medicine.[1]
“Most hospitals in this study were able to pursue acute care during the attacks; however, participants reported a major and immediate effect on acute care delivery and personal well-being,” the study said. “Participants were concerned about patient safety, and most hospitals were ill-equipped for prolonged downtime procedures.”
To conduct the study, the authors reached out to crisis coordinators, acute care department staff and information technology (IT) managers at hospitals in the United States and Europe that had experienced a ransomware attack. The researchers conducted interviews with those who agreed to participate in the study.
A total of 25 hospital institutions were invited to participate, but of those, 18 did not respond, and three did not wish to participate due to a lack of time, ongoing police investigations into the incident or concerns regarding the sensitivity of the subject and data privacy. In total, nine individuals were interviewed from four organizations that had a ransomware attack between 2018 and 2022.
Care Continuity Suffers
Ransomware badly impacts care continuity, the researchers found. “The most notable effect of the ransomware attacks was the loss of technology availability as a direct result of the attack or as a preventive measure taken by IT staff,” the study said.
“Three out of four incidents involved complete computer downtime,” the authors wrote. “In most cases, email and internal hospital telephone systems were unavailable. Emergency care protocols were unavailable during the attacks and had to be retrieved from the internet or borrowed from other hospitals. Hospital staff often felt lost without the availability of computers and described it to be crippling.”
All four hospitals included in the research had to switch to paper-based charting during the attack, and although some hospitals had paper charting forms available, staff often didn’t know where to find them. In addition, paper charting forms were basic and were not designed for users accustomed to electronic charting methods, the researchers said, adding, “most participants regarded paper charting as inefficient and reported decreased work productivity.”
Some of the biggest hurdles involved communications with other hospital departments, and staff members turned to alternative communication methods that included fax machines, the hospital’s pneumatic tube system, personal phones, walkie-talkies and pagers, the study said.
In addition, internal hospital communication surrounding the incident often was limited, and some staff members found out about the ransomware attacks via local media rather than from hospital administrators, the authors wrote.
