By Jon Moore

Ransomware continues to be a plague on the healthcare sector. Recent headlines illustrate that our hospitals, whether large or small, are not safe from criminal organizations willing to profit through extortion.

Effectively planning for and responding to a ransomware attack requires a holistic approach. All departments of a hospital may be impacted by an attack, and all must be prepared to respond.
Patient safety comes first
The first concern during a ransomware incident should be patient safety. Your organization should immediately activate its emergency protocols and, if necessary, business continuity plan.

Often communications systems are compromised in the attack. Therefore, your organization will need to be prepared to establish alternative communication channels to facilitate communications with stakeholders.

If the EHR and other clinical systems are offline, your organization will need to switch to paper. It is becoming increasingly difficult and risky for hospitals to switch to paper. Staff, particularly those newer to the field, are not always familiar with the use of paper charts. Also, particularly during shift changes, there is a chance information is lost with significant potential consequences for patients.

It is particularly important that staff verify patient information. They will need to be extra cautious in verifying identities, history, medication records, and other information that may not be otherwise available or captured fully and accurately.

Because of the extra time and attention needed, it is important to focus first on your most at-risk patients. The organization will need to prioritize patient care and reschedule non-urgent appointments if necessary.

Even still the organization may be overwhelmed, and it may be necessary to coordinate care with other facilities. The organization should be prepared to collaborate with nearby hospitals, clinics, or healthcare providers to ensure continuity of care for patients who may need to be transferred or redirected to other facilities.

Leadership will need to keep staff informed about the situation. They will also need to be prepared to provide guidance on any temporary procedures or safety measures they should follow during the recovery process.

Given the elevated risk to patient safety, the team will need to closely monitor patients for any signs of complications or adverse events that may arise from disruptions in care or changes in treatment plans.

Health IT Homepage