Crisis Standards of Care: Cyber Attack During a Pandemic
Authors: Hana Akselrod
Journal: Annals of Internal Medicine (2021)

On Being a DoctorMay 2021Crisis Standards of Care: Cyber Attack During a PandemicFREEHana Akselrod, MD, MPHHana Akselrod, MD, MPHGeorge Washington University School of Medicine and Health Sciences Washington, DCAuthor, Article, and Disclosure Informationhttps://doi.org/10.7326/M20-7191 Audio Reading - "Crisis Standards of Care: Cyber Attack During a Pandemic" Audio. Michael A. LaCombe, MD, Annals Associate Editor, reads "Crisis Standards of Care: Cyber Attack During a Pandemic" by Hana Akselrod, MD, MPH Your browser does not support the audio element. Audio player progress bar Step backward in current audio track Play current audio trackPause current audio track Step forward in current audio track Mute current audio trackUnmute current audio track 00:00/ SectionsAboutVisual AbstractPDF ToolsAdd to favoritesDownload CitationsTrack CitationsPermissions ShareFacebookTwitterLinkedInRedditEmail For the second time this year, I was leading very unusual rounds. The fellow was struggling to formulate a plan while missing key pieces of information, with no clear idea of when test results might return or whether diagnostic procedures could be performed. The first such time had been in March, when COVID-19 first reached our region. Now the disrupting pathogen was not a virus, at least not in the traditional sense.In the early hours of September 27, 2020, Universal Health Services—a network of more than 250 hospitals and clinics across the United States—was crippled by a ransomware attack, one of the largest to ever target a medical system (1). "We're historic," I muttered behind my N95 mask and face shield, in an attempt at either humor or perspective, as we wound our way through two dozen consult patients whose culture results we could not see and imaging we could not review. We were practicing medicine stripped to its essentials, relying on our oldest tools: pen and paper, a listening ear, a call to a colleague, our full attention, and our trust and compassion for each other in the face of a disaster.The Ryuk attack on Universal Health Services disabled access to the electronic health record that we rely on for information about immensely complex patients. In its absence, the team was painstakingly tracking down the "downtime" paper charts and order sheets and contacting nurses, laboratory staff, and radiologists. Operating room scheduling and electronic device monitoring were offline. Ambulances were diverted and transfers declined. The uncertainty and the rumors—it was an attack by North Korea, it was the Russians, we would pay them off, we would not—were flashbacks to early COVID-19 times. In the meantime, we worked long hours at personal cost, followed emergency protocols, and used closed-loop communication to ensure operational safety.In March, we did not know which of our patients were positive for SARS-CoV-2 for days, waiting for send-out tests to return against a mushrooming backlog—5, 7, 10 days—while our laboratory team labored around the clock to create an in-house PCR assay. Now the testing platform thankfully continued to work, but the results could only be conveyed verbally. A couple of days into the breach, a result was miscommunicated and an entire team was exposed. We rounded short of breath in extra PPE, facing a new operational reality each day, laser-focused on keeping our patients safe to the best of our ability: safe from the virus; safe from nosocomial harm; and safe from a system that was failing them, again.Digital security has been recognized as a major threat to health care systems for years, with hospitals and medical device users considered uniquely vulnerable to cyber attacks. This vulnerability owes its existence to the drive toward interconnectivity, with investments in security lagging far behind the expansion of technologies used in patient care. A typical ransomware attack involves "phishing," in which a link or e-mail attachment mimicking a trusted source is used to gain entry into the system. Once introduced, the malware locks the system. The hackers then demand a ransom to release it, holding the information—and potentially the lives—of patients hostage (2). Earlier in the COVID-19 pandemic, cybercrime rates did not seem to be appreciably altered from recent baselines despite concerns that the shift to remote connectivity might create added opportunities. Some cybercrime syndicates pledged not to target health care facilities (3, 4). From our experience this past September into October, that promise has expired.It is hard for an infectious disease doctor to ignore the poetic similarity between malware entering a computer network through mimicry and the global spread of a virus that uses a ubiquitous respiratory receptor. Both the malware and the virus cross continents easily, taking advantage of our enthusiasm for connection. Both had been the subject of repeated warnings from security experts. Both expose the slow-motion crises of a fraying infrastructure and a workforce already on the edge of burnout. Both can kill directly and cause unmeasured damage through delayed and omitted treatment, medical error, and the moral injury of providing inadequate care. Both leave us and our trainees to powerlessly watch our patients suffer. Although the drastic lockdowns of early 2020 are over, COVID-19 still holds our way of life for ransom.The root cause of the Universal Health Services data breach has not been shared with us as of this writing, but our electronic health record and other systems were eventually restored. Thanks to the tireless work of information technology personnel who secured each computer and reconnected platforms that had evolved over years in a precarious symbiosis, our hospital became operational once more. Something remained missing, along with patient data from the "lost" week we spent scribbling notes and orders. (The scribbles would eventually be digitized. My sympathy goes out to those tasked with deciphering them.) Absent was a feeling of trust in the structures meant to have protected us. We survived the crisis, again, by the sweat of our teams and (I suspect) the blood of patients who came to harm. In 2020, I have been too angry for tears.Other crises are coming; we know this with certainty. Novel threats from emerging pathogens and changing climate conditions compound older toxic legacies of poverty, unequal access to care, inadequate infrastructure, and structural racism threatening to undo decades of progress in public health. In his recent book Rethinking Readiness: A Brief Guide to Twenty-First-Century Megadisasters, Jeff Schlegelmilch of the National Center for Disaster Preparedness writes that "our systems of governance do not favor broad perspectives across preparedness challenges" (5). However, he continues, "the right investments, with the right framing, can benefit our resilience to disasters, as well as benefit broader society for generations to come" (5). Modeling our health sector on "lean" corporations oriented toward short-term profit and efficient resource extraction has resulted in a system that is neither secure nor resilient. Our patients, our trainees, and we ourselves deserve better than being asked to accept crisis standards of care time after time.Plunging from springtime COVID-19 emergency to autumn cyber attack and now back into a long winter of COVID-19 resurgence has made for an interesting year. In the short time available for reflection, a few lessons have emerged. The first is the difference that visionary leadership and transparent communication make in a crisis. The second is the importance of getting stakeholders at all levels to follow expert advice, whether regarding infection prevention or digital data safety practices. The third is the need to lend each other our ears and respectful attention, whatever pressures we are under, to come through as a community. Last, and perhaps most critical, is the need for structural commitment to resilience—with intentional dedication of resources and development of systems—as we move from frontline heroism to sustained survival and recovery.It is difficult in this moment to envision a world beyond the barricades; however, in the past year we have seen that powerful teamwork, compassion, and innovation can emerge in times of crisis. These represent the best of us and are what our patients truly need of us, even when antiviral medications or electronic charts are unavailable. May we accept the challenge to build a stronger system and lay these principles at its foundation.References1. Davis J. UHS health system confirms all US sites affected by ransomware attack. HealthITSecurity. 5 October 2020. Accessed at https://healthitsecurity.com/news/uhs-health-system-confirms-all-us-sites-affected-by-ransomware-attack on 28 October 2020. Google Scholar2. Zetter K. Why hospitals are the perfect targets for ransomware. Wired. 30 March 2016. Accessed at www.wired.com/2016/03/ransomware-why-hospitals-are-the-perfect-targets on 28 October 2020. Google Scholar3. Hawdon J, Parti K, Dearden TE. Cybercrime in America amid COVID-19: the initial results from a natural experiment. Am J Crim Justice. 2020:1-17. [PMID: 32837157] doi:10.1007/s12103-020-09534-4 MedlineGoogle Scholar4. Winder D. Hackers promise 'no more healthcare cyber attacks' during COVID-19 crisis. Forbes. 19 March 2020. Accessed at www.forbes.com/sites/daveywinder/2020/03/19/coronavirus-pandemic-self-preservation-not-altruism-behind-no-more-healthcare-cyber-attacks-during-covid-19-crisis-promise on 28 October 2020. Google Scholar5. Schlegelmilch J. Rethinking Readiness: A Brief Guide to Twenty-First-Century Megadisasters. Columbia Univ Pr; 2020. Google Scholar Comments0 CommentsSign In to Submit A Comment Author, Article, and Disclosure InformationAffiliations: George Washington University School of Medicine and Health Sciences Washington, DCCorresponding Author: Hana Akselrod, MD, MPH, 2150 Pennsylvania Avenue NW, Suite 8-436, Washington, DC 20037; e-mail, [email protected]edu.This article was published at Annals.org on 19 January 2021. PreviousarticleNextarticle Advertisement Audio Reading - "Crisis Standards of Care: Cyber Attack During a Pandemic" Audio. Michael A. LaCombe, MD, Annals Associate Editor, reads "Crisis Standards of Care: Cyber Attack During a Pandemic" by Hana Akselrod, MD, MPH Your browser does not support the audio element. Audio player progress bar Step backward in current audio track Play current audio trackPause current audio track Step forward in current audio track Mute current audio trackUnmute current audio track 00:00/ FiguresReferencesRelatedDetails Metrics May 2021Volume 174, Issue 5Page: 713-714KeywordsCOVID-19ChartsElectronic medical recordsMedical servicesPathogensRadiologistsResearch laboratoriesSafetyStructural racismSweat ePublished: 19 January 2021 Issue Published: May 2021 Copyright & PermissionsCopyright © 2021 by American College of Physicians. All Rights Reserved.PDF downloadLoading ...