Effects of the CommonSpirit Health Ransomware Attack and What This Means for Hospitals Nationwide

Ransomware is back–well, actually, it never went anywhere. Cybercriminals bounce from industry to industry. The overarching theme is this: no sector is safe or exempt from risk. In a recent resurgence of hospitals as ransomware targets, CommonSpirit Health was hit by a major ransomware attack that caused extensive IT outages at many of their hospital facilities throughout the United States. CommonSpirit Health is one of the largest nonprofit healthcare systems in the country. Let’s look at the effects of the attack and what your organization can do to prevent ransomware attacks within your business.

What Were the Effects of the CommonSpirit Ransomware Attack?

The attack impacted several electronic health record systems across the country. Among the organization’s 1,000 care sites throughout the United States, 140 hospitals in 21 states reported issues with computer systems and widespread outages following the ransomware attack.

The Organizational Fallout from Ransomware

In addition to angry and frustrated employees resorting to social media and news outlets to criticize management for its handling of the attack, the hospital was also forced to move to non-standardized paper charts. For a giant hospital built around all records being digital, this caused organizational-wide disorganization and hassle.

The forced move to paper charts creates issues surrounding patient history access and pharmacy order verification. With the inability to print official labels for prescriptions, pharmacists cannot verify the order. In a desperate effort, some affected hospitals have moved to use fax machines to share prescription information so it can be verified. As you might imagine, this causes significant delays in patient care and treatment response time.

What We Learn from the CommonSpirit Attack

The CommonSpirit press team assured news outlets and patients that current patients remained their number one priority and that patient care would not be affected. But was this really true? The evidence says otherwise. Businesses nationwide, and hospitals specifically, should heed the lessons learned from this significant ransomware attack and proceed accordingly.

1. No matter the size or scope of a ransomware attack, all attacks affect an organization’s operations in some way. In the case of CommonSpirit, it affected access to patient history and slowed medication verification, directly affecting the speed of patient care.
2. An organization’s public response after a ransomware attack matters. Transparency and acknowledgment after an attack matters for the news and employees or customers that were affected. Ignoring an attack or not responding publically typically causes more negative backlash for the affected organization. 
3. Even if you’re not in the IT business, technology matters. In the case of CommonSpirit, the temporary lack of an IT system caused patient care delays and a physical backlog of patients in their existing facilities following the attack. With care time slowed, patients were collecting in waiting rooms and unable to receive care on a regular timeline. Even if your business is not IT-centric, IT matters in every business.
4. Make a cybersecurity plan and stick to it. Prioritizing preventative IT security is vital to practically every organization’s operations. An IT security plan won’t prevent every ransomware attack, but it will mitigate the damage and provide a clear and timely path forward following an attack. Remember, 80% of ransomware attacks stem from common pitfalls. Working with a professional managed IT provider will help your organization avoid common mistakes that lead to attacks.

Managed IT Services With PK Tech

At PK Tech, we take a full-picture approach with our clients, analyzing your existing IT infrastructure and understanding the gaps to produce a more robust and preventative cybersecurity strategy. Book a 15-minute call with a team member to discuss how PK Tech can support the IT security of your organization.