Ascension Hospitals Face Disruptions from Suspected Cyberattack

Ascension, one of the largest health care systems in the United States, detected disruptions in its technology network systems on Wednesday due to a suspected “cybersecurity event.”¹ Although the extent of the disruption and its damage are currently unknown, the company was forced to shut down several of its systems across the country to ensure the safety of patient information.

What’s the Issue?

Ascension, which operates 140 care sites throughout the country, was forced to shut down specific health systems because of the disruption. The company is working to alert the proper entities involved to begin remediation processes and prevent similar cyberattacks in the future.

Ascension Via Christi in Wichita, Kansas, one of the many Ascension health systems affected by the recent cybersecurity event. | image credit: JHVEPhoto / stock.adobe.com

• With an immediate response, Ascension began its investigation of the disruptions as soon as it was alerted of them, and immediately activated its remediation procedures. An Ascension spokesperson also noted that the company and its care teams are trained to react to these types of cybersecurity events and will continue to ensure the delivery of proper patient care in the meantime.²
• “Systems that are currently unavailable include our electronic health records system, MyChart (which enables patients to view their medical records and communicate with their providers), some phone systems, and various systems utilized to order certain tests, procedures and medications,” said an Ascension spokesperson.² In order to keep the utmost protection of its systems holding sensitive data, Ascension was forced to shut down several operations as they work swiftly to address the potential harm caused by the possible attack.
• Ascension has since contacted Mandiant, a third-party cybersecurity company, to assist in the investigation and remediation of the attack.² When large scale cyberattacks like this occur, expert assistance from teams trained to protect and remediate these disruptions is almost necessary. Ascension has also contacted appropriate business partners that may have been affected by the event, allowing them to also implement the proper procedures to safeguard their systems.²

Why It Matters

Cybersecurity within US health care systems has become an increasingly critical issue. From the Ascension disruptions to the Change Healthcare cyberattack in February, officials are working hard to recover and enact the proper procedures to prevent future attacks.

• As health systems across the country continue moving to digitize their data and medical records, a new threat of cyberattacks grows increasingly worrisome for health care officials. Health care data breaching has since become a profitable business for illegal hackers around the world. One common mode of breaching hackers utilize is called ransomware, which is a type of malware that restricts patients and providers from accessing sensitive medical information until a ransom is paid.³
• A similar type of ransomware was used during the Change Healthcare cyberattack in February. The fallout of the cyberattack, which affected 1 in 3 medical records in the US,⁴ is still impacting health systems under the UnitedHealth Group—who recently acquired Change Healthcare—umbrella. Like the ransomware detected in health care cyberattacks in the past, UnitedHealth admitted to paying a $22 million ransom amidst its February disruptions.⁴

READ MORE: UnitedHealth CEO Testifies Before Congress on Change Healthcare Cyberattack

Expert Commentary

• “Safely caring for patients remains our highest priority as we navigate this cybersecurity incident. We are actively supporting our ministries as they continue to provide safe, patient care with established downtime protocols and procedures, in which our workforce is well trained. It is expected that we will be utilizing downtime procedures for some time. Patients should bring to their appointment notes on their symptoms and a list of current medications and prescription numbers or the prescription bottles so their care team can call in medication needs to pharmacies,” wrote an Ascension spokesperson.²
• “We have no access to medical records, no access to labs, no access to radiology or X-rays, no ability to place orders. We have to write everything on paper. It's like the 1980s or 1990s. You go to the X-ray room to look at the X-rays on film, you call the lab they tell you what the results are over the phone. So it's just much more cumbersome, but we do have training for these moments,” an Ascension Michigan doctor told the Detroit Free Press.⁵

In Depth Insights

• “Ascension initially recommended business partners temporarily suspend any connections to the health’s system’s technology environment. But in an update posted Thursday, the operator said it was reaching out to partners so they could take steps to safeguard their systems,” wrote Emily Olsen for Healthcare Dive.³ While technological shutdowns seem to be the most appropriate first response, Ascension is working to educate and inform its partners on how to recover from damage caused by the attack and prevent future disruptions. However, at this time, the full extent of the attack remains unknown as officials continue to gather information, but system-wide shutdowns are not something patients and providers can afford.
• HHS has experienced a 256% increase in large data breaches reported to the Office for Civil Rights in the past 5 years. With the Change Healthcare attack being the peak of those breaches—so far—industry leaders are working with government officials and cybersecurity experts to alleviate this growing issue as soon as possible. Another example of a large data breach occurred in April at Kaiser Foundation Health Plan, a large health care organization serving over 12.5 million individuals. The organization experienced “impacted information” belonging to over 13 million people.^3,6

READ MORE: Cybersecurity Best Practices for Pharmacies in the Digital Age

Extra Reading

• Hack targeting hospital chain Ascension is impacting patient care (The Washington Post)
• Cyberattack forces major US health care network to divert ambulances from hospitals (CNN Business)

References

1. Ascension, one of the largest hospital systems in Illinois, reports “disruptions” to clinic operations following suspected cyber attack. NBC 5 Chicago. May 9, 2024. Accessed May 10, 2024. https://www.nbcchicago.com/news/local/ascension-cyber-attack-illinois-hospitals-evanston-hospital-systems-down/3432706/

2. Cybersecurity Event Update. Ascension. May 9, 2024. Accessed May 10, 2024. https://about.ascension.org/cybersecurity-event

3. Olsen E. Ascension hit by cybersecurity incident affecting clinical operations. Healthcare Dive. May 9, 2024. Accessed May 10, 2024. https://www.healthcaredive.com/news/ascension-cybersecurity-incident-disrupts-clinical-operations/715633/

4. UnitedHealth CEO Andrew Witty testifies about cyberattack. Youtube. May 1, 2024. Accessed May 1, 2024. https://www.youtube.com/watch?v=vjQAcWy1_dQ

5. Shamus KJ. Cyberattack hits Ascension hospitals’ computer networks: “It’s affecting everything.” Detroit Free Press. May 9, 2024. Accessed May 10, 2024. https://www.freep.com/story/news/health/2024/05/09/ascension-hospital-cyberattack-data-breach-hacked-michigan/73620340007/

6. Vogel S. Kaiser exposed up to 13.4M plan member records to third parties. Healthcare Dive. April 26, 2024. Accessed May 10, 2024. https://www.healthcaredive.com/news/kaiser-exposed-millions-records-data-breach/714441/