Partner Perspective: Beyond IT — Safeguarding Patient Care During Healthcare Downtimes

Hospitals have become prime targets for ransomware attackers due to the highly sensitive nature of healthcare data and the potential for widespread disruption. When attackers seize control of essential systems, the very core of healthcare—its ability to deliver critical care—is jeopardized. In these situations, it’s not merely an IT issue but a matter of life and death.

A study conducted by the University of Minnesota revealed that from 2016 to 2021, there were 374 instances of ransomware attacks on healthcare organizations, with the frequency of these incidents increasing each year. “As health care delivery organizations have increased their reliance on information technology to serve their patients, they have unfortunately also increased their potential exposure to cybersecurity risks, such as ransomware attacks,” said Neprash, the study’s author. In normal times, roughly 3 in 100 hospitalized Medicare patients will die in the hospital. During a ransomware attack, that number goes up to 4 out of 100. And, remember, this is only for the Medicare population. High-profile attacks on organizations like Change Healthcare, Ascension Health, and OneBlood underscore the growing severity of this threat.

While it’s impossible to prevent all disruptions, healthcare organizations can mitigate their impact by adopting a comprehensive business and clinical continuity strategy. This approach focuses on maintaining critical functions during catastrophic downtimes, ensuring that essential services continue, even when technology systems are compromised. Such a strategy is key to delivering uninterrupted patient care, maintaining operational stability, and protecting an organization’s financial health and reputation.

Protecting Patient Care

At the heart of any healthcare continuity plan is the need to safeguard patient care, especially during major disruptions. The primary goal of a proactive strategy is to ensure that critical clinical workflows continue. This involves identifying the most essential processes—such as access to patient records and maintaining life-saving equipment—and creating alternative methods to ensure they run smoothly.

• Backup Continuity Access – One key alternative method is implementing robust backup systems for EHR data. These backups may involve regularly syncing data to on-site and off-site servers or cloud platforms that can be accessed even if the primary system goes down.
• Manual Processes – In some cases, manual processes may need to be temporarily reintroduced. For instance, paper forms can be kept on hand for patient admissions, medication administration, and surgical checklists. These forms can also be built out in other technologies that the clinical teams may still be able to access (e.g., Microsoft Excel, SharePoint) to streamline the disaster recovery processes. Staff should be regularly trained in using these manual systems so they can quickly switch to them without hesitation in the event of an outage.
• Communication Systems – Equipping clinical teams with mobile devices that operate independently can provide immediate access to critical patient information. These mobile solutions can work in conjunction with backup communication tools such as satellite phones, walkie-talkies, or secured text messaging platforms to ensure that staff can remain in contact and coordinate care.
• Pre-established Partnerships – Some healthcare organizations pre-establish partnerships with other hospitals or clinics to share resources during crises. This could include access to equipment, beds, or technology platforms if necessary. Agreements with third-party vendors specializing in emergency response, such as those providing mobile health units or temporary infrastructure and staffing, can also ensure continuity.

Empowering Staff with Clear Protocols

Healthcare professionals are already accustomed to working in high-pressure environments, but a sudden system failure can amplify that stress. To address this, healthcare organizations should develop clear protocols and communication strategies that staff can follow during downtimes. These protocols are essential for ensuring teams know precisely what steps to take when systems go offline. Regular training and preparedness exercises are crucial to equipping staff with the confidence and knowledge to perform their duties effectively, even under challenging circumstances.

A Comprehensive Approach to Continuity

In an era where ransomware attacks are increasingly targeting healthcare organizations, having a proactive business-led continuity plan is no longer optional—it’s essential. Traditional IT disaster recovery efforts, while critical, are not sufficient on their own. Healthcare organizations must integrate business and clinical continuity planning into their overall strategy to ensure the organization is resilient against a range of potential threats. By focusing on both the clinical and business aspects of the organization, a comprehensive continuity plan ensures that critical functions are maintained, staff are empowered, and financial stability is preserved.

Through such a proactive approach, healthcare organizations can confidently face disruptions, ensuring that patient care is prioritized, staff are prepared, and the institution’s reputation remains intact. By adopting these best practices, healthcare providers can better protect themselves from the growing threat of ransomware and other catastrophic downtimes, keeping their operations resilient and their communities safe.

About the Author

Steve Hendrick is a Senior Vice President with Healthlink Advisors, a consulting firm dedicated to transforming healthcare organizations through strategic and operational excellence. Healthlink Advisors guides hospitals and health systems through complex challenges such as IT optimization, business and clinical continuity planning, and digital transformation. With a focus on innovation, collaboration, and actionable insights, Healthlink Advisors empowers clients to achieve sustainable success, improve patient outcomes, and navigate the ever-evolving healthcare landscape.