Anatomy of a Cyberattack: Part 2: Managing a Clinical Pathology Laboratory During 25 Days of Downtime

Abstract

Objectives Our academic health care institution was the victim of a cyberattack that led to a complete shutdown of major patient care, operational, and communication systems, including our electronic health record (EHR), laboratory information system, pharmacy, scheduling, billing and coding, imaging software, internet, hospital shared computer drives, payroll, and digital communications. The EHR remained down for 25 days, significantly affecting our clinical pathology (CP) laboratory operations. Methods During the downtime, our CP laboratory incorporated manual interventions for patient specimen testing, recruited additional staff for reporting results, and employed multiple communication modalities to support patient care. The crisis required a swift response, employing innovative approaches to mitigate patient harm; regular, multidisciplinary engagement; and consistent, broad-reaching communications. CP leadership worked with hospital administration, staff, and our referral clients to provide the timely laboratory results needed for acute patient care. Results During this downtime, the laboratory lacked accurate information about the number of patient samples diverted to other laboratories, the number of specimens processed, and the number of test results reported. Conclusions This paper focuses on the approaches the CP division took to develop and maintain downtime operations. Laboratories should consider these strategies in preparation for a prolonged downtime.

Surviving a Cyberattack in Anatomic Pathology: Disaster Response and Creation of an Incident Command System

“…Our hospital was the victim of a cyberattack, causing a complete shutdown of all computer systems for 25 days. [1][2][3][4] In the AP laboratory, we were forced to make decisions on specimen processing, risk management, staffing, and resource management in a high-stress environment, with impaired communication channels, lack of an EHR or any computer connectivity, and no prior experience running an AP laboratory entirely manually. Our routine downtime procedure could not support the system for a prolonged period, and as the work continued to come through the receiving window, we recognized the immediate need for action and coordination.…”

“…Our hospital was the victim of a cyberattack, causing a complete shutdown of all computer systems for 25 days 1–4 . In the AP laboratory, we were forced to make decisions on specimen processing, risk management, staffing, and resource management in a high-stress environment, with impaired communication channels, lack of an EHR or any computer connectivity, and no prior experience running an AP laboratory entirely manually.…”

How do we leverage data through replication and warehousing to meet blood collection and transfusion service needs

“…Maintaining a separate data replicate away from the CIS's network can also potentially help with recovery from another disaster – malware attack. Some forms of cyberattack, such as ransomware, prevent user data access through encryption as was experienced by University of Vermont Medical Center in 2020 forcing 25 days of downtime operations 2–5 . In such instances, data replicates, if outside of the affected systems, can provide an accessible data source for downtime and recovery operations.…”