Lessons learned from a targeted ransomware attack at a health system
Skip to main content
MDHC_Logotype_white
Subscribe
  • My Account
  • Login
  • Subscribe
  • News
    • This Week's News
    • COVID-19
    • Providers
    • Insurance
    • Government
    • Finance
    • Technology
    • Safety & Quality
    • People
    • Regional News
    • Digital Edition
    • Michigan to begin vaccinating homeless people for COVID-19
      Workers worry about safety, stress as states ease mask rules
      Highlights of the $1.9T COVID bill nearing final passage
      merrill goozner
      The FDA needs a public health visionary
    • Michigan to begin vaccinating homeless people for COVID-19
      Workers worry about safety, stress as states ease mask rules
      Highlights of the $1.9T COVID bill nearing final passage
      Doctors performing surgery
      Doctor appears in court video call while performing surgery
    • Shareholder group calls out HCA for alleged excessive emergency department admissions
      Metrologo 600x400_i.jpg
      MetroHealth forms Center for Cancer Research
      The Check Up: Dr. Marc Boom
      The Check Up: Dr. Marc Boom of Houston Methodist
      Dr. Marc Boom
      Q&A: Houston Methodist CEO praises staff efforts to keep vaccine efforts going during ice storm
    • A younger woman provider helping an older woman on a tablet.
      Insurers set sights on growth in Medicare Advantage, Medicaid managed care
      By the Numbers: Insurers owing largest MLR rebates
      5 things to know about Alignment Healthcare's proposed IPO
      Solid sign-ups for Biden's new Obamacare coverage offer
    • MedPAC likely to recommend an effective cut in Medicare Advantage spending
      MedPAC likely to recommend CMS simplify alternative payment models
      Florida governor faces growing charges of vaccine favoritism
      States rapidly expanding vaccine access as supplies surge
    • 369178053.jpg
      Shares of insurer Oscar Health fall following $1.4B IPO
      Sutter Health posts sizable 2020 loss, announces sweeping review of finances
      UPMC's patient volumes stabilize, boosting 2020 profits
      Genomics firms taking advantage of SPACs trend to go public faster
    • Abbott gets emergency use authorization for test that detects COVID-19, other infections
      Insurance regulator to issue warning on virus-test billing
      351532635.jpg
      Red-hot virtual care market propels New York City health startups to record year
      Teladoc reports $383.3M in fourth-quarter revenue, up 145%
    • Workers worry about safety, stress as states ease mask rules
      Doctors performing surgery
      Doctor appears in court video call while performing surgery
      Artist Gus Moran begins his chalk art piece Feb. 28 at the Disneyland Resort Vaccine Super Site POD.
      City of Hope commissions street art to spread positive messages
      54.2% of teens were fully vaccinated against HPV in 2019, compared with 51.1% in 2018. 79 million: Estimated number of Americans currently infected with HPV.
      Data Points: Another vaccination race for HPV
    • Francoise_Adan1_i.jpg
      Cleveland's UH creates position of chief whole health and well-being officer
      Alicia Wilson
      Q&A: Emerging leader Alicia Wilson on staying close to home
      Michael Jordan, Novant team up to address health equity
      Former Ascension CEO, the first to lead the health system, passes away
    • Midwest
    • Northeast
    • South
    • West
  • Insights
    • ACA 10 Years After
    • Best Practices
    • Special Reports
    • Innovations
    • The Affordable Care Act after 10 years
    • Dr. John Fischer
      Patient-reported outcomes tool for hernia surgery helps physicians improve care
      New care model helps primary-care practices treat obesity
      doctor with patient
      COVID-19 treatment protocol developed in the field helps patients recover
      Rachel Wyatt
      Project to curb pressure injuries in hospitals shows promise
    • What's next for on-demand telehealth companies?
      A CalOptima PACE vaccination clinic.
      Will COVID-19 be the catalyst for creating a more sustainable healthcare system?
      A map of the U.S. with images of the coronavirus.
      The digital divide becomes a new social determinant of health
      Ascension’s St. Mary’s Hospital Surgery Center at Towne Centre and Allegheny Health Network’s Bethel Park surgery center
      Hospitals see opportunity, risk in ambulatory surgery centers
    • Ryan McGinnis
      Finding efficiencies in the OR using tech
      Dr. Daniel Hall
      UPMC pilots machine learning, telehealth to inform patient transfers
      A woman being recorded using her inhaler on a smartphone.
      Digital check-ins, connected inhalers help control asthma
      A phone screen showing the question, "Mary we hope this information was helpful and we'd like to keep guiding you. Are you interested in knowing when it's your turn to receive the vaccine?"
      Chatbots, texting campaigns help manage influx of COVID vax questions
  • Transformation
    • Patients
    • Operations
    • Care Delivery
    • Payment
    • What's next for on-demand telehealth companies?
      Rising prescription copays drop adherence, spike mortality, research shows
      Dr. John Fischer
      Patient-reported outcomes tool for hernia surgery helps physicians improve care
      Highmark Health inks six-year cloud, tech deal with Google
    • Ryan McGinnis
      Finding efficiencies in the OR using tech
      Hospitals' Medicare billing practices suggest upcoding, OIG says
      California hospitals prepare ethical protocol to prioritize lifesaving care
      Amazon, JPMorgan Chase, Berkshire Hathaway disband Haven
    • Dr. Daniel Hall
      UPMC pilots machine learning, telehealth to inform patient transfers
      A woman being recorded using her inhaler on a smartphone.
      Digital check-ins, connected inhalers help control asthma
      Humana partners with in-home provider for 24/7 care
      A phone screen showing the question, "Mary we hope this information was helpful and we'd like to keep guiding you. Are you interested in knowing when it's your turn to receive the vaccine?"
      Chatbots, texting campaigns help manage influx of COVID vax questions
    • MedPAC likely to recommend CMS simplify alternative payment models
      Bundled payments reduce surgery costs by 10.7%
      Coordinated payment policies could speed transition to value, experts say
      CMMI's geographic direct contracting model needs an overhaul, experts say
  • Data/Lists
    • Rankings/Lists
    • Interactive Databases
    • Data Points
    • Health Systems Financials
      Executive Compensation
      Physician Compensation
  • Op-Ed
    • Bold Moves
    • Breaking Bias
    • Commentaries
    • Letters
    • Vital Signs Blog
    • From the Editor
    • Dr. Alan Kaplan
      The risks, rewards of taking organizations 'where they haven’t gone before'
      Wellstar CEO calls adapting for the pandemic her bold move
      Howard P. Kern
      Recognizing the value of telehealth in its infancy
      Dr. Stephen Markovich
      A bold move helped take him from family doctor to OhioHealth CEO
    • Dr. Stephen Markovich
      Making sure we're aligned along the path to achieving inclusion
      Barry Ostrowsky
      Ending racism is a journey taken together; the starting point must be now
      Laura Lee Hall and Gary Puckrein
      Increased flu vaccination has never been more important for communities of color
      John Daniels Jr.
      Health equity: Making the journey from buzzword to reality
    • The COVID-19 experience and its influence on post-pandemic health policy
      Haven is history, but its mission is the future of healthcare
      Vaccinating children could be the key to ending the pandemic
      Mikelle Moore
      The promising future of rural healthcare, even amid the COVID-19 pandemic
    • Letters: Eliminating bias in healthcare needs to be ‘deliberate and organic’
      Letters: Maybe dropping out of ACOs is a good thing for patients
      Letters: White House and Congress share blame for lack of national COVID strategy
      Letters: VA making strides to improve state veterans home inspections
    • Sponsored Content Provided By Optum
      How blockchain could ease frustration with the payment process
      Sponsored Content Provided By Optum
      Three steps to better data-sharing for payer and provider CIOs
      Sponsored Content Provided By Optum
      Reduce total cost of care: 6 reasons why providers and payers should tackle the challenge together
      Sponsored Content Provided By Optum
      Why CIOs went from back-office operators to mission-critical innovators
  • Awards
    • Award Programs
    • Nominate
    • Previous Award Programs
    • Other Award Programs
    • Best Places to Work in Healthcare Logo for Navigation
      Nominations Open - Best Places to Work in Healthcare
      Nominations Open - 50 Most Influential Clinical Executives
    • 100 Most Influential People
    • 50 Most Influential Clinical Executives
    • Best Places to Work in Healthcare
    • Health Care Hall of Fame
    • Healthcare Marketing Impact Awards
    • Top 25 Emerging Leaders
    • Top 25 Innovators
    • Minorities in Healthcare
      • - Luminaries
      • - Top 25 Minority Leaders
      • - Minorities to Watch
    • Women in Healthcare
      • - Luminaries
      • - Top 25 Women Leaders
      • - Women to Watch
    • Excellence in Nursing Awards
    • Design Awards
    • Top 25 COOs in Healthcare
    • 100 Top Hospitals
    • ACHE Awards
  • Events
    • Conferences
    • Galas
    • Webinars
    • COVID-19 Event Tracker
    • podium march webinar logo lockup
      Sponsored Content Provided By Podium
      Webinar: Critical Touchpoints for Every Patient’s Journey — How Technology Plays an Important Role
      scp health logo lockup march 2021
      Sponsored Content Provided By SCP Health
      Webinar: COVID’s call to action — Reset for success in 2021
    • Women Leaders in Healthcare Conference
    • Social Determinants of Health Symposium
    • Healthcare Transformation Summit
    • Leadership Symposium
    • Virtual Briefings
      • - Hospital of the Future
      • - Mental Health
      • - Patient Safety & Quality
      • - Strategic Marketing
      • - Virtual Health
      • - Workplace of the Future
    • Best Places to Work Awards Gala
    • Health Care Hall of Fame Gala
    • Top 25 Minority Leaders Gala
    • Top 25 Women Leaders Gala
  • Listen
    • Podcast - Next Up
    • Podcast - Beyond the Byline
    • Sponsored Podcast - Healthcare Insider
    • Video Series - The Check Up
    • Sponsored Video Series - One on One
    • Empty boardroom
      Next Up Podcast: What's going to happen tomorrow? Succession planning during emergencies
      Next Up Podcast: Educating patients on the COVID-19 vaccine with Tanya Andreadis
      Dr. Joseph Cacchione
      Next Up Podcast: Educating patients on the COVID-19 vaccine with Dr. Joseph Cacchione
      Dr. Karen DeSalvo
      Next Up Podcast: What to expect with telehealth and healthcare technology in the next four years
    • Beyond the Byline: Insurers are betting on virtual-first plans as COVID-19 shifts care pathways
      Beyond the Byline: How residents' stories shape our coverage of the vaccination rollout in nursing homes
      Beyond the Byline: Regulators aim to boost value push with fraud and abuse law updates
      An older man wearing a mask receiving a vaccine.
      Beyond the Byline: Verifying information on the chaotic COVID-19 vaccine rollout
    • Outreach during COVID-19
      Leading intention promote diversity and inclusion
      Introducing Healthcare Insider Podcast
    • The Check Up: Dr. Marc Boom
      The Check Up: Dr. Marc Boom of Houston Methodist
      The Check Up: Dr. Imran Andrabi
      The Check Up: Dr. Imran Andrabi of ThedaCare
      The Check Up: Tanya Blackmon
      The Check Up: Tanya Blackmon of Novant Health
      The Check Up: Dr. Patrick Hwu
      The Check Up: Dr. Patrick Hwu of the Moffitt Cancer Center
    • ivana naeymi-rad one on one intelligent medical objects
      Video: Ivana Naeymi Rad of Intelligent Medical Objects
  • MORE +
    • Advertise
    • Media Kit
    • Newsletters
    • Jobs
    • People on the Move
    • Reprints & Licensing
MENU
Breadcrumb
  1. Home
  2. Opinion & Editorial
December 20, 2019 06:00 AM

Lessons learned from a targeted ransomware attack

Robert Garrett
  • Tweet
  • Share
  • Share
  • Email
  • More
    Print
    Robert Garrett

    Robert Garrett, CEO of Hackensack Meridian Health.

    Emergency preparedness is a vital component of healthcare management. Unfortunately, preventing cyberattacks has now become as essential as planning for natural disasters, mass shootings, epidemics and a litany of other potential catastrophes.

    Earlier this month, Hackensack Meridian Health was the victim of a targeted ransomware attack. Despite our growing awareness of the frequency of these attacks and preparation, it packed the punch of a hurricane.

    Numerous computer applications were hobbled, including call bells in some locations so we provided patients with actual bells and increased staff. Clinical teams immediately went to backup procedures, including writing physician orders on paper. Prescriptions were filled manually in some of our pharmacies.

    As a healthcare executive for 35 years, I have seen my share of jammed emergency rooms from all sorts of mayhem: multivehicle pileups, deadly fires and the fallout from chemical explosions. Those scenes are disturbing, but it's what we do: We snap into action and save lives. This was surreal and unsettling: a faceless criminal enterprise crept into our hospitals and physician offices, our labs and our pharmacies, to impact operations in pursuit of a payout.

    Our network, which includes 17 hospitals and more than 500 patient-care locations, was saved by countless acts of heroism. Our IT teams worked around the clock to restore functionality; our clinical teams quickly converted to backup practices that include a lot of paper; our vice president of payroll worked 30 hours straight to ensure people got paid. Our physicians and team members really pulled together in this crisis.

    Four days into the attack, our core clinical systems were fully restored. Our entire network reported fewer than 100 elective procedures rescheduled. Patient volumes remained the same or higher than is typical for this time.

    As we continue to stabilize our network, there are lessons to share:

    First, the growing number of cyberattacks makes it clear that even the best preparation may not prevent a successful attack.

    The number of ransomware attacks doubled in 2019 by some estimates and they can have a crippling impact.The city of New Orleans suffered a ransomware attack recently serious enough for the mayor to declare a state of emergency. In October, a network of Alabama hospitals had to stop accepting new patients because of a ransomware attack.

    Healthcare providers are especially vulnerable for several reasons. We operate 24/7 and lives are at stake. Also, as our industry makes quantum leaps forward in technology, our systems are increasingly complex and connected. Cybercriminals know that they can target one vulnerability in a single device and impact the entire network.

    Second, have a strong response strategy, including mitigation of the spreading attack.

    Ensure that backups are reliable and well-tested. Make sure you still have old standbys on paper including phone lists, physician orders and they are easily accessible.Just as physicians place fragile patients into medically induced comas, our IT teams brought down systems to prevent further damage, including our electronic health record system. If we don't take these vital steps and remove malicious files, there will be a more lengthy and costly return to normalcy.

    Third, don't immediately dismiss the option of paying ransom.

    We've come to learn that 70% of victims make these payments. You may not have the luxury of time to consider rebuilding your network. We believe it's our duty to ensure patient safety and protect our communities' access to healthcare. And as a not-for-profit entity, we also understood the potentially crippling impact of interrupting business, which can cost five to 10 times the amount paid in ransom, national experts say.As a leading health network, we have comprehensive coverage to help cover costs associated with a cyberattack, including payment, remediation and recovery efforts. We worked closely with experts and our insurance company and reached the decision that a negotiated payment was the most prudent course for our network, New Jersey's largest.

    Fourth, this menacing world of cyberattacks needs to be brought into sunlight so we can understand the depth and breadth of the problem.

    Try to commit to going public with an attack as soon as you can. We alerted state and federal authorities immediately but going public is different. You don't want to jeopardize negotiations with the attackers. We waited two weeks on the advice of national experts to ensure the best outcome. The more candid we are about the workings of cyberpirates, the more insight we will gain about their operations.

    Lastly, it is imperative that we work collectively—not-for-profit and for-profit organizations, large companies and small—with regulators and lawmakers to safeguard our vital enterprises and institutions.

    Together, we can work to prevent more chaos and lost business. I, for one, would prefer to leave the harrowing world of ransom payments and Bitcoin where it belongs—in movies and spy novels.

    Letter
    to the
    Editor

    Send us a letter

    Have an opinion about this story? Click here to submit a Letter to the Editor, and we may publish it in print.

    Recommended for You
    Michigan to begin vaccinating homeless people for COVID-19
    Michigan to begin vaccinating homeless people for COVID-19
    Workers worry about safety, stress as states ease mask rules
    Workers worry about safety, stress as states ease mask rules
    Sponsored Content
    Get Free Newsletters

    Sign up for free enewsletters and alerts to receive breaking news and in-depth coverage of healthcare events and trends, as they happen, right to your inbox.

    Subscribe Today

    The weekly magazine, websites, research and databases provide a powerful and all-encompassing industry presence. We help you make informed business decisions and lead your organizations to success.

    Subscribe
    Connect with Us
    • LinkedIn
    • Twitter
    • Facebook
    • RSS
    • Instagram

    Stay Connected

    Join the conversation with Modern Healthcare through our social media pages

    MDHC_Logotype_white
    Contact Us

    (877) 812-1581

    Email us

     

    Resources
    • Contact Us
    • Advertise with Us
    • Ad Choices Ad Choices
    • Sitemap
    Editorial Dept
    • Submission Guidelines
    • Code of Ethics
    • Awards
    • About Us
    Legal
    • Terms and Conditions
    • Privacy Policy
    • Privacy Request
    Modern Healthcare
    Copyright © 1996-2021. Crain Communications, Inc. All Rights Reserved.
    • News
      • This Week's News
      • COVID-19
      • Providers
      • Insurance
      • Government
      • Finance
      • Technology
      • Safety & Quality
      • People
      • Regional News
        • Midwest
        • Northeast
        • South
        • West
      • Digital Edition
    • Insights
      • ACA 10 Years After
      • Best Practices
      • Special Reports
      • Innovations
    • Transformation
      • Patients
      • Operations
      • Care Delivery
      • Payment
    • Data/Lists
      • Rankings/Lists
      • Interactive Databases
      • Data Points
    • Op-Ed
      • Bold Moves
      • Breaking Bias
      • Commentaries
      • Letters
      • Vital Signs Blog
      • From the Editor
    • Awards
      • Award Programs
        • 100 Most Influential People
        • 50 Most Influential Clinical Executives
        • Best Places to Work in Healthcare
        • Health Care Hall of Fame
        • Healthcare Marketing Impact Awards
        • Top 25 Emerging Leaders
        • Top 25 Innovators
        • Minorities in Healthcare
          • - Luminaries
          • - Top 25 Minority Leaders
          • - Minorities to Watch
        • Women in Healthcare
          • - Luminaries
          • - Top 25 Women Leaders
          • - Women to Watch
      • Nominate
      • Previous Award Programs
        • Excellence in Nursing Awards
        • Design Awards
        • Top 25 COOs in Healthcare
      • Other Award Programs
        • 100 Top Hospitals
        • ACHE Awards
    • Events
      • Conferences
        • Women Leaders in Healthcare Conference
        • Social Determinants of Health Symposium
        • Healthcare Transformation Summit
        • Leadership Symposium
        • Virtual Briefings
          • - Hospital of the Future
          • - Mental Health
          • - Patient Safety & Quality
          • - Strategic Marketing
          • - Virtual Health
          • - Workplace of the Future
      • Galas
        • Best Places to Work Awards Gala
        • Health Care Hall of Fame Gala
        • Top 25 Minority Leaders Gala
        • Top 25 Women Leaders Gala
      • Webinars
      • COVID-19 Event Tracker
    • Listen
      • Podcast - Next Up
      • Podcast - Beyond the Byline
      • Sponsored Podcast - Healthcare Insider
      • Video Series - The Check Up
      • Sponsored Video Series - One on One
    • MORE +
      • Advertise
      • Media Kit
      • Newsletters
      • Jobs
      • People on the Move
      • Reprints & Licensing