University Hospitals has no timeline for restoring systems after 22 October cyber incident

The internal letter, obtained by 3News from a UH staff member, says the system is adjusting workflows to keep providing care while affected systems remain unavailable. It says University Hospitals is working with third-party cybersecurity experts to validate that all systems are safe before it can reconnect to partner sites, and that takes time.

What is offline

Electronic prescribing is not working, so University Hospitals has moved to written prescriptions, faxed prescriptions and telephone refills, according to the letter. For visits, staff should offer patients an in-person appointment, a Zoom visit or a telephone visit, in that order. Offices are calling patients to remind them of upcoming appointments. Some locations have had trouble connecting to the UH network, and some patients have had problems with insurance pre-authorizations, Ideastream reported.

What is working

A source told 3News that nearly 97% of appointments and procedures have gone ahead. University Hospitals said the vast majority of appointments and procedures continued as normal. In most cases, patients have seen no change in the care they receive, according to the letter. Spokesperson Ansley Kelm said the intranet was not affected, so doctors can still reach patient records. The hospital system is encouraging patients to keep their appointments. The statement also apologized for the inconvenience and said offices remain open for business. Employees scheduled to be paid on Friday received their pay, and the letter said the system expects its 5 November payroll to go forward.

Timeline

The Cleveland-based system, which BankInfoSecurity describes as a 21-hospital system, noticed unusual activity on its servers on Thursday 22 October and disconnected its websites and MyChart from the internet, Ideastream reported. Most websites were still down on 29 October, showing an error message that the system was "experiencing difficulties and limited services are available at this time." Attempts to log in to MyChart returned a pop-up saying "we couldn't log you in right now." An earlier statement said some appointments and elective procedures had been rescheduled.

Legal fallout

BankInfoSecurity reported that University Hospitals said it is working with outside cybersecurity experts and law enforcement agencies to investigate the incident and restore services, and that as of Friday the system faced at least one proposed federal class action complaint filed by a patient on behalf of herself and "over 1 million" current and former patients allegedly affected. The complaint alleges negligence, among other claims. The system did not comment to BankInfoSecurity on whether the incident involved ransomware or whether patient information was compromised. In a public update, University Hospitals warned patients about potential scams and said UH will not call or text asking for banking information.