Sutter started racing to review patient records looking for life-threatening issues. The team succeeded in tracking down urgent cases and ensuring that records were updated. “Fortunately, because of how proactive we were, we didn’t have any patient safety issues,” she said.

To recover data, some facilities relied on files that were offline or in other formats, such as audio files
At a different, unnamed U.S. hospital, IT workers turned to a frantic — but successful — review hours of audio files to find physician updates in a pair of critical cases. They succeeded, barely.

Windows machines are an integral part of most healthcare networks, often integrating with imaging and diagnostic devices — and can be a weak link

And at Heritage Valley Health System in Pennsylvania, which had actually been logged into a Nuance server when the worm hit and had its servers directly infected as a result, 2,000 computers and hundreds of servers were infected.

Even though imaging machines weren't running Windows and were not infected, this was crippling. “The MR didn’t get touched. But the computer that has the software to get the MR image off the machine, that got hit,” said a staffer. “Tests are no good if you can’t see the damn things.”

Heroic as these IT efforts were, there were still delays that could prove costly to the health of patients, noted Atlantic Council security researcher Joshua Corman, citing a New England Journal of Medicine study showing a 4 percent rise in mortality linked to traffic delays under 5 minutes.

“Think of every hospital in the U.S. that uses Nuance. Think about how many days it was down, multiplied by the number of lab results, transfers, discharges, and how many of those are time-sensitive,” Corman said. “In some cases, time matters. Pain level is affected. Quality of life is affected. Mortality is affected.”

Back to HCB News

Cyber Security Homepage