Ascension Diverts Emergency Patients, Postpones Care

The Ascension healthcare system is sending away emergency patients and postponing nonemergency procedures as it digs out from a cyber incident that knocked its electronic health record systems offline with no immediate timetable for restoration.

See Also: OnDemand | Why The Healthcare Industry Has The Most Cyberattacks And What Hospitals Can Do About It

Ascension – a nonprofit, Catholic healthcare system with 140 hospitals and 40 senior care facilities in 19 states – said systems including lab, test and medication ordering and some phone systems will stay offline “for some time” following its Wednesday detection of hackers inside its networks (see: Ascension Responding to Cyberattack Affecting Clinical Care).

Several Ascension hospitals are diverting emergency medical patients to other facilities to order to help ensure that such cases are triaged immediately, the organization said in an update.

The disruption has caused physicians to resort to manual, pen-and-paper processes and the system to put off “some non-emergent elective procedures, tests and appointments.”

The St. Louis, Missouri-based hospital chain recommends patients bring notes on their symptoms and lists of current medications, including prescription numbers, to appointments so that clinicians can call in medication orders to pharmacies.

“We are working around the clock with internal and external advisors to investigate, contain, and restore our systems,” Ascension said. “Our investigation and restoration work will take time to complete, and we do not have a timeline for completion.” Ascension said on Thursday that it is working with security firm Mandiant in the response effort.

Ascension did not immediately respond to Information Security Media Group’s request for additional details, including whether the incident involved ransomware encryption, data exfiltration or an extortion demand from cybercriminals.

The Ascension incident comes on the heels of an attack by cybercriminal gang BlackCat/Alphv t on UnitedHealth Group’s IT solutions unit, Change Healthcare, which for nearly two months disrupted critical services used by thousands of hospitals, doctor practices, clinics and pharmacies across the U.S., including claims processing, prescription orders and patient eligibility.

During an industry event this week, Anne Neuberger, deputy national security adviser for cyber and emerging technology, told Bloomberg that the Biden administration expects to issue a proposed rule requiring hospitals – and possibly other healthcare providers that receive Medicare and Medicaid payments – to put minimum cybersecurity standards into place.

While Neuberger did not provide a timeline, another Biden administrator insider told Bloomberg they expected the proposal to be issued in coming weeks.

Even before the massive Change Healthcare attack, the Biden administration had been hinting for several months that it is considering requirements for hospitals to meet new “cybersecurity performance goals” tied to payments from the Centers of Medicare and Medicaid Services (see: HHS Details New Cyber Performance Goals for Health Sector).

Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, said he encourages all healthcare organizations to review and implement the Department of Health and Human Services’ Cybersecurity Performance Goals, which were touted as “voluntary” when published in January.

The Department of Health and Human Services did not immediately respond to ISMG’s request for comment on the timeline for potential proposed rule-making related to new cybersecurity requirements for the healthcare sector.