What Health Systems Can Learn From a Cyberattack on The Pitt

Rating The Pitt Staff’s Downtime Readiness

As far as a readiness score, Pittsburgh Trauma Medical Center was probably 60% ready for the downtime event. The management team knew what it would need, who to call and what resources to go after, but the staff had no clue what to do. They had never been through anything like this.

Younger physicians were not prepared for the loss of technology. The episode featured a clinical case in which a woman went into cardiac arrest because she wasn’t diagnosed properly. The team was waiting on lab results that weren’t requested correctly, creating a major delay.

Timing is critical in many cases. Every second matters, especially for stroke victims. If there’s no way to quickly get them into a CT scan or to communicate the need for fast results, it could lead to loss of life. The Pitt showcased why having systems, testing and checklists in place is necessary to ensure downtime procedures are second nature.

Unfortunately, this is a realistic scenario. And it’s going to happen if there are clinicians who have always relied on technology alone for patient safety checks lose access to those tools.

How Healthcare Organizations Can Ensure Clinical Care Resilience

To be truly prepared, healthcare organizations should go through all of the different components that will be affected during a downtime event, including supply chain, people preparedness and technology needs. You must factor it all into your preparations.

We spoke to clinicians at a health system in South Carolina about how well they could handle another situation like the CrowdStrike outage. The head of endoscopy, a seasoned clinician, said, “Bring it. It’s time these kids know what it’s like to really practice medicine — how we were trained.” When asked the same question, a junior nurse in the neonatal ICU said, “I’d become an actuary and retire from this healthcare gig.”

There’s a clear divide because many people have become dependent on technology. However, no matter the makeup of its clinical staff, no hospital has perfected its downtime procedures. Some health systems are further along on their journey than others, but no hospital can go on autopilot when downtime occurs.

Cyber resilience involves both IT and clinical aspects. From an IT perspective at CDW, we talk with IT teams to ensure they’ve transitioned from the traditional disaster recovery model to a cyber recovery model, with automation that speeds recovery. The security components also need to be in place to ensure that when the hospital has returned to normal operations, it’s in a trustworthy state with no lingering infected systems.

READ MORE: Build clinical care resilience when your EHR goes down.

We’ve seen traditional disaster recovery fail when the Tier 0 components that tie systems together do not resume normal operations. In another episode of The Pitt, there was a mention of even the HL7 connectivity going down, which was a cool callout because normally people forget about that aspect of downtime. However, it’s significant when it comes to making sure all systems are working and communicating.

When we talk to customers, it’s all about making sure the glue is in place that will keep operations together. Testing, tabletops and simulations should all be done frequently, putting the recovery processes through their paces.

What this translates to on the clinical resilience side is that the clinical teams should be preparing for all scenarios. They shouldn’t be waiting around for systems to be back up and running, because no one knows how long that will take. It could take weeks. In that case, what would the clinical team do? If team members are just waiting around, what will happen to their patients? Processes and tools need to be in place to keep patients safe. That includes clipboards, paper, pens and methods of communication.

Phones are one of the most critical tools for communication between departments. A fractional outage impacting the radiology department can have a huge trickle-down effect on the rest of the hospital, especially the ER. How do they communicate with the organization in that case?

How Partnership Supports Hospitals’ Clinical Care Resilience Efforts

A trusted technology partner such as CDW can help health systems determine how well their existing clinical care resilience and cyber resilience plans function and navigate the process of improving those plans to ensure patient safety and continued operations.

In addition to creating an overall resilience plan, we can also help healthcare organizations set up isolated recovery environments for Epic that minimize the impact of downtime. We can also discuss the introduction of 5G to make endpoints more resilient.

CDW has a full program dedicated to helping healthcare organizations achieve their downtime goals and clinical care resilience planning. Many organizations bring in the tools they think they need while forgetting about the people and processes that make up the foundation of a successful clinical care resilience plan. We help organizations create the foundation for a successful program.

This article is part of HealthTech’s MonITor blog series.