A ransomware attack this past week on a California-based health care system forced some of its locations to close and left others to rely on paper records.
The system, Prospect Medical Holdings, which operates 16 hospitals and more than 165 clinics and outpatient centres in Connecticut, Pennsylvania, Rhode Island and Southern California, announced the cyberattack Thursday.
A Prospect Medical spokesperson could not estimate Saturday when services would return to normal. It was not immediately clear how many of the system’s sites were affected.
On its website, Eastern Connecticut Health Network, an affiliate of Prospect Medical, listed locations that would be closed until further notice, including a medical imaging centre, an urgent care facility and an outpatient blood-draw centre, among others.
CharterCARE Health Partners, a Rhode Island affiliate, said on Facebook on Thursday that it had to reschedule some of its appointments and to revert to paper records. The Philadelphia Inquirer reported that computers were also down at Crozer Health facilities in Delaware County.
“Prospect Medical Holdings, Inc. recently experienced a data security incident that has disrupted our operations,” the company said in a statement Saturday. “Upon learning of this, we took our systems offline to protect them and launched an investigation with the help of third-party cybersecurity specialists.”
The company said it was focused on “addressing the pressing needs of our patients as we work diligently to return to normal operations as quickly as possible.”
It did not provide details on the nature of the security breach.
Waterbury Hospital, in Waterbury, Connecticut, said Saturday that it was continuing to have disruptions. It also said that some of its outpatient and diagnostic imaging services had not been available Friday or Saturday. On Thursday, it said it was relying on paper records.
Cyberattacks on hospitals have become more common, said John Riggi, senior cybersecurity adviser to the American Hospital Association.
In 2022, One Brooklyn Health, a hospital group that serves low-income neighbourhoods in New York, was hit by a cyberattack that also forced staff members to use paper records. Employees said at the time that it was a learning curve, given that most hospitals have been using electronic records since the 1990s and that some diagnostic test results were coming back slower because of the cyberattack.
CommonSpirit Health, which has more than 140 hospitals and more than 700 care sites nationwide, was the target of a cyberattack last year that led to postponed surgeries, doctor visits and other delays in care, NBC reported. And in 2020, Russian hackers launched a ransomware attack on United Health Services, which has at least 400 facilities, making it the largest attack of its kind at the time.
Cyberattacks are becoming more frequent, in part because the coronavirus pandemic brought many more health care services online, Mr. Riggi said.
“We’re relying more on cloud-based services, remote third parties,” Mr. Riggi said. “So all of these things are done with good intention – ultimately to improve patient care and to save lives. But the unintended consequence of this is that it has expanded dramatically our digital attack surface.”
Hospitals and clinics typically use third parties to write code and develop the technology for these systems, so it’s imperative these third parties deliver secure technology, he said.