The crippling effects of a cyberattack at an academic level 1 trauma center: An orthopedic perspective

Abstract

IntroductionMalicious cyberattacks are increasing in frequency and severity with healthcare institutions spending an average of over 10 million dollars to resolve the consequences of healthcare data breaches. This cost does not include the effect of a downtime event should a healthcare system electronic medical record (EMR) lose functionality. An Academic Level 1 trauma center suffered a cyberattack resulting in a total EMR downtime of 25 days. Orthopedic operative time was used as a surrogate for OR functionality during the event and a framework with specific examples is presented to promote rapid adaptation during downtime events. MethodsOperative time losses were identified by calculating a running average of weekday total in room operative time during a total downtime event secondary to a cyberattack. This data was compared to week-of-the-year matched data from the year prior and the year after the attack. A framework for creating adaptations to a total downtime event was created by repeatedly interviewing different provider groups and identifying how they adjusted care to the challenges faced. ResultsTotal weekday in room operative time during the attack decreased by 53.4% ± 12.2% and 53.2% ± 14.9% when comparing the matched period one year prior and one year after, respectively. Immediate challenges to patient care were identified by small groups of highly motivated individuals, with self-assigned agile teams formed. These teams sequenced system processes, identified failure points, and created real-time solutions. A frequently updated EMR backup mirror and hospital disaster insurance were crucial for mitigating the impact of the cyberattack. ConclusionsCyberattacks are expensive and their downstream effects, including downtime events, can be crippling. Agile team formation, process sequencing, and understanding EMR backup times are tactics used to combat the challenges of a prolonged total downtime event. Level of EvidenceLevel III retrospective cohort