Cyberattack ‘struck the nervous system’ of UVMMC

By | November 11, 2020

Steve Leffler
Dr. Steve Leffler, the president and chief operating officer of UVM Medical Center, at a press conference about the state’s second presumptive case of COVID-19 on Thursday, March 12, 2020. Photo by Mike Dougherty/VTDigger

The University of Vermont Medical Center didn’t have an appointment on the books when a VTDigger staff member showed up for a non-emergency visit last weekend. 

A scan of a clipboard and a printed list provided no further details. They couldn’t say whether the appointment had been scheduled at all. They didn’t call to reschedule for another two days — and then only after the patient reached out. 

“I’m just a scheduler who can’t access schedules,” said a UVM staff member on the phone Monday. 

Staff members and patients alike describe a harried effort to resume care and move to a more onerous paper system in the wake of a cyberattack. Hospital officials say there’s no end in sight. 

The Oct. 28 system breach by hackers has caused “massive, ongoing patient care disruptions,” UVM officials acknowledged in a release Tuesday. “It’s tough for all of us right now. Every person at the medical center is working around the clock,” assured Medical Center President Stephen Leffler. 

Leffler said the hospital is also simultaneously preparing to care for an uptick in coronavirus patients. Covid “won’t wait for us to manage our IT systems,” he quipped grimly. 

Meanwhile, staff are scrambling to figure out how to use pen-and-paper records, in an unanticipated return to the analog health care system of two decades ago. 

“Imagine stacks and stacks and stacks of manila envelopes,” said one nurse, who spoke on condition of anonymity. 

VTDigger is underwritten by:

Everything takes longer now, he said. Normally, staff check a patient’s prescriptions by scanning the barcode on their wristband, which brings up a screen with the medications and how often they should be administered, he said. Now, patients rely on handwritten notes in manila folders. Messy handwriting, a delayed update from a doctor, or a mistake by those who transcribe the list of prescriptions could easily lead to error, he said. 

The system is “fraught with risk,” he said. The hospital increased the staffing on his unit to deal with the backlog and make care more efficient, he said. 

The attack, he added, has “really struck at the nervous system of the hospital.” 

READ MORE  Republicans Tagged House Speaker Johnson as Out of Touch

The network failure has come at a time when the state is experiencing a surge in Covid cases. Leffler said in a town meeting Tuesday night with the health commissioner and Mayor Miro Weinberger that the hospital is caring for coronavirus patients now and has adequate testing supplies and PPE in preparation for an influx of cases. 

“The biggest challenge the medical center faces right now is I think everyone knows we’re day 14 into a cyber attack,” Leffler said. “I want to make sure people understand that we are open for business, our ER is open, we’re accepting trauma patients, we’re delivering babies, we’re taking care of heart attacks and strokes. But it has had a major impact on what we do. Our electronic medical record is still down. And while we have strong downtime procedures, it’s more difficult to care for people when we don’t have the record. And it’s more labor intensive.”

UVM Medical Center is taking fewer transferred patients and surgical cases until the network is operational, Leffler said. “We know that has a big impact on people who need us. And we are making big progress every day, we’re getting closer to having our EMR electronic medical record, come back on board. But we’re not quite there yet. We still have some days in front of us. But I do want people to know that even throughout this it downtime, we’ve been taking care of COVID-19 patients.” 

Walkie-talkies and exhaustion

Indeed portions of nearly every part of the hospital have been affected. CT scans are delayed by weeks, a second anonymous employee said. A downed email system has made it challenging for department heads to contact each other, and the nurses’ union can’t contact members, said union president Deb Snell. The phone system isn’t functioning — the hospital bought walkie-talkies for some staff members, said Leffler. 

Hospital employees have two methods of communication: “fax transmissions of records, and the other is old fashioned paper,” said Public Safety Commissioner Michael Schirling at the press conference Tuesday. 

On the cardiology unit, everything from the patient alarm system to the process to get lab results has changed, said nurse Mari Cordes, who is also a state legislator. 

READ MORE  How Vermonters voted in Tuesday’s top races, town-by-town

Staff who need to look up patient records must crowd around a small nursing station, she said. Checking and double-checking patient medications makes everything take longer. 

The change in protocol, on top of Covid-19, has taken its toll on everyone, Cordes said. “All of us are just so tired from the stress of the Covid pandemic and adjusting our systems and the nature of being frontline workers and being at risk of infection ourselves.”

“It’s exhausting, frankly.”

Seeking answers

The 14 days since the attack have yielded few answers for who caused the outage and why. More than 20 other hospitals across the country have been hit by cyberattacks in 2020, Leffler said. Some attacks were linked to a Russian group, but neither Leffler nor the FBI have not provided details on what kind of malware they found, or who was responsible. 

“Federal authorities have directed us not to discuss the details of the attack on our IT systems in order to preserve the integrity of their investigation. What I can tell you is that this attack was very broad in its reach,” Health Network CEO John Brumsted said in a release Tuesday. 

VTDigger is underwritten by:

FBI spokesperson Sarah Ruane said she couldn’t provide updates on the ongoing investigation. “Our investigations are lengthy, so it could be a while,” she said. 

On Tuesday, the hospital had reduced its census to 340 patients, roughly 100 less than it would normally, Leffler said. Surgeons were performing about half the procedures they’d typically do, he said. 

Last week, the Medical Center furloughed about 350 people, primarily those in departments such as finance or registration that rely on the computer system. About half have been able to accept other job assignments, Leffler said. 

The hospital’s IT team has been working with the National Guard, which was deployed last week, to clean and install antivirus software on every one of the 4,500 Medical Center’s computers, laptops, and workstations. Many clinical staff are also working overtime, he said.

READ MORE  Walmart Blocks Vermont Workers From Hazard Pay Program

“Whether someone needs a physical therapy evaluation, or someone needs a medication immediately, or you need to know what a lab result is, it’s involving a lot more staff and a lot more expense to the hospital,” Cordes said of the cardiology floor where she works. 

She said the hospital had been as well prepared for the situation as it could have been. 

Staff are making do, agreed Snell. “Nurses are like MacGyvers. We figure out what we can do and get it done,” she said. 

The anonymous nurse also praised the medical center leadership for their hard work to restore the system, and his coworkers for their diligence. “We’re doing the best that we can,” he said. “The fact of the matter is there’s still a really long way to go.”

Indeed, neither Leffler nor any of the half dozen hospital employees that spoke to VTDigger could offer a timeline for recovery. The hospital chief promised “days, and not weeks,” but “I know I keep telling you the same thing,” he conceded. 

He apologized to patients and employees who had been affected. “We’re doing everything in our power to get through this, to get back to normal, and provide care to those who need it,” he said. “We are sorry, we’re committed to making things right. This week, some cancer care systems, and schedules for staff for outpatient clinics came back online, he added. 

Normal operations remain a long way off. Even when access to the electronic records are restored, staff will have to manually enter the information from the paper records into Epic, the electronic medical records system, he said. 

Source link

Leave a Reply