After a cyberattack in fall 2020, the University of Vermont Medical Center took 151 days to fully recover. Preparation was key to handling downtime.

During a session at the RSNA annual meeting, titled “Hoping for the Best, Planning for the Worst: Ensuring Platform Speed, Reliability, and Disaster Recovery for Your Practice,” radiology leaders shared their departments’ experiences and best practices.

Dr, Matthew Geeslin, a musculoskeletal imager and associate vice chair of imaging informatics in the radiology department at the University of Vermont Medical Center, recounted how, after the cyberattack, workflow shifted to paper and radiologists used a downtime viewer and typed reports in Microsoft Word.

“Needless to say, exam turnaround time and the amount of time required per exam interpretation was significantly increased,” Geeslin said.

There was communication via WhatsApp and Zoom meetings because email was down, and the department set up a “film library.”

For 21 days the department used an advanced visualization viewer. It “was not intended to function as a backup viewer but something we were very fortunate to have because it allowed us to read in-house but remote from the modalities, with occasional necessary reading off the modalities when the downtime viewer crashed,” Geeslin said.

There were also 24 days without an EHR or RIS for the entire hospital and 39 days until full radiology production systems were restored. During that time, approximately 10,000 downtime exams with preliminary reports were acquired and ultimately required re-review and finalization once production systems were restored.

To prepare for such an outage, practices should prepare to co-locate with other modalities, with backup drives for modality exam storage. There should also be a complete paper workflow with a commensurate distribution system and standardized documentation and the ability to set up a physical film library quickly, with physical copies of downtime workflows per modality.

Radiologists should understand that all exam interpretation is preliminary, Geeslin said. He also recommended to prepare for an outage with downtime simulations.

Staff preparation is also key.

“Once the outage occurs, you cannot do anything but dig your way out,” Geeslin said. “Taken together, prior planning to support mental and even emotional preparedness, as well as communication to support forecasting of the impact of the outage, as well as continuous rather than bolus work throughout the recovery, are two significant factors that can work to preserve staff resiliency during the outage.”

"It's not if, but when," said Sylvia Devlin, director of clinical application operations at Radiology Partners, who spoke about a previous experience with a ransomware attack.

Devlin said the department’s older scanners didn’t have a way to export data, and as they needed to wait for service technicians to come onsite, they ended up using new imaging modalities, resulting in lower throughput.

“We couldn’t risk losing any of our patients’ imaging studies,” Devlin said.

Jonathan Shoemaker, administrative director, of imaging systems and services at Stanford Health Care, provided an overview of the department’s platform dataflow, which replicates all of the environments with backups in case of a system failure.

Shoemaker encouraged attendees to establish procedures to address core systems if they’re compromised.

“If you had to recover from bare metal, how would you provide clinical care for the next 30 to 60 days?” Shoemaker asked. “If you do have a backup system, can it maintain the enterprise load?”

Shoemaker noted that it was important to assess skills across a team and cross trained staff so that if certain experts are on vacation or unreachable, you can still move forward with recovery efforts, without staff working 24/7.

“Make sure that there’s a clear escalation path for them to utilize when they do have a barrier,” Shoemaker said, “and celebrate their successes daily.”