CLEVELAND, Ohio — Cleveland-based University Hospitals is still working to restore its IT systems nearly two weeks after a cybersecurity incident was detected on October 22, and it cannot yet say when normal operations will return. In a November 2 update on its website, the system said it is working to restore systems safely but, in its words as reported by Becker’s Hospital Review, “we do not currently have an estimated timeline for completion.” The HIPAA Journal, reporting November 4, likewise said systems remained offline and no restoration timeline could be provided.
The most visible effect for patients remains the loss of MyChart, the online portal patients use to view test results, message their providers and manage appointments. According to Becker’s Hospital Review, the portal remains offline and patients cannot view lab results through it. Becker’s reported one partial workaround: patients whose tests were handled through Quest Diagnostics can still access those results on Quest’s own website.
Inside the hospitals, much of the technology still functions but is cut off from the outside world. Becker’s Hospital Review reported that most applications on the system’s servers still work but cannot send or receive information outside the system. Because University Hospitals is a cashless facility, Becker’s reported, it cannot take payments at the time of service. Video visits have shifted to phone, Zoom or in-person appointments, and providers can print, fax or call in prescriptions when e-prescribing is unavailable, according to Becker’s.
University Hospitals has stressed throughout that care itself continues. Both Becker’s Hospital Review and The HIPAA Journal reported that the system’s hospitals, emergency departments and physician offices remain open, and Becker’s reported that the vast majority of appointments and procedures have proceeded as scheduled. At the same time, The HIPAA Journal reported that the incident has disrupted insurance pre-authorizations, and some appointments and elective procedures have had to be rescheduled.
University Hospitals is one of Northeast Ohio’s largest health systems — The HIPAA Journal described it as a 21-hospital health system based in Cleveland — and its main campus, University Hospitals Cleveland Medical Center, sits in the city’s University Circle neighborhood. For its patients, MyChart is the everyday front door to their care: where lab results appear, where scheduling lives, and where they message their care teams. Losing it does not close a hospital, but it pushes routine tasks back to phone calls, paper and fax while systems are validated and restored.
The timeline began Thursday, October 22, when University Hospitals detected unusual activity on its servers. According to both Becker’s Hospital Review and The HIPAA Journal, it activated its incident response protocols and disconnected its systems from the internet as a precaution, taking digital services including MyChart offline. Becker’s has reported the system is investigating with outside experts and has been in communication with law enforcement.
On Monday, October 26, University Hospitals publicly confirmed a cybersecurity incident, telling Becker’s Hospital Review it had made significant progress over the preceding weekend but expected challenges through that week, including network-connection problems at some locations. In an October 28 update reported by Becker’s, it advised patients to attend scheduled appointments unless their care teams contacted them. The November 2 update then made clear full restoration would take longer, with no completion date offered.
The outage has already drawn legal scrutiny, though nothing about it has been proven. Becker’s Hospital Review reported that a proposed class-action lawsuit filed October 28 in the U.S. District Court for the Northern District of Ohio alleges University Hospitals failed to protect patient information and that sensitive information was stolen. Becker’s noted the complaint’s own figures were inconsistent, that the allegations have not been proven in court, and that a University Hospitals spokesperson told Becker’s it does not comment on pending litigation.
University Hospitals’ phone system was not affected, but Becker’s Hospital Review reported long hold times from high call volume. The system has also warned patients about scam calls and phishing messages exploiting the outage, noting, as Becker’s reported, that it will not call or text patients asking for banking information.
What we know — and what we’re still waiting on
Confirmed, by University Hospitals’ own updates as reported by Becker’s Hospital Review and The HIPAA Journal: the October 22 detection, the precautionary disconnection, the continuing MyChart outage, the pre-authorization disruption, some rescheduled appointments and procedures, and no restoration timeline as of November 2. Still unknown: the cause. The HIPAA Journal reported that whether ransomware was involved has not been publicly disclosed, no ransomware group appears to have claimed responsibility, the investigation is ongoing, and University Hospitals has not yet determined the extent to which patient data was involved.
Read our earlier coverage of the Cleveland VA Medical Center’s switch to a new electronic health record system and of Knox Community Hospital’s agreement to join Kettering Health.
What happens next is a restoration process University Hospitals says it will not rush: the system has described its work as restoring systems safely. For patients, the practical guidance from its updates, as reported by Becker’s Hospital Review, is to attend scheduled appointments unless contacted by a care team, call a provider’s office directly with questions while MyChart is down, use Quest’s website for Quest-handled test results, and treat any call or text asking for banking information as a scam. NewsForce247 will update this story when University Hospitals announces a restoration timeline or discloses findings on whether patient data was involved.
Photo: Cards84664, CC BY
[…] health systems have been in the headlines for harder reasons this fall. NewsForce247 has covered University Hospitals’ ongoing recovery from an October cyber incident, Knox Community Hospital’s agreement to join Kettering Health and the Cleveland VA’s […]