Columbia-Md.-based MedStar Health issued a statement Wednesday reporting that “the three main clinical information systems supporting patient care are moving to full restoration“ following a malicious malware attack on the IT systems Monday.
MedStar Health also reported “enhanced functionality continues to be added to other systems.”
“We are pleased that our analysis continues to show no patient or associate data have been compromised. MedStar's IT team and cybersecurity experts have worked around the clock to protect the integrity of our clinical data systems, and to restore operations. Restoration of additional clinical systems continues with priority given to those related directly to patient care,” health system officials wrote in a statement posted on the health system’s website at 11 am Wednesday.
MedStar Health has posted numerous updates about the malware incident on its website under the banner, “MedStar Health Update Regarding Computer Downtime.”
According to the health system, the recovery of major clinical information systems followed MedStar's decision to take its systems offline to prevent the spread of the malware identified early Monday morning.
There has been no comment from MedStar Health officials about whether the malware is, in fact, ransomware.
As previously reported by Healthcare Informatics Editor-in-Chief Mark Hagland on Monday, The Washington Post broke the story that a virus had infected the clinical information system of the 10-hospital MedStar Health integrated health system early Monday morning, forcing the system’s leaders to shut down their electronic health record (EHR) and e-mail system. As Hagland reported, the cyber attack marks a new watershed moment in the recent history of hacking-based EHR and clinical information system shutdowns in U.S. hospitals.
In a more recent update posted on its website at 3 pm Wednesday, MedStar Health credited the “diligent and tireless efforts” of the MedStar leaders, including IT systems team, clinicians and associates, and “above all else, the trust and support from our patients and community,” for the progress the health system is making toward full restoration of its major IT systems.
MedStar Health also reported that it had “maintained its promise to meet care needs of the communities” it serves.
“The malicious malware attack has created many inconveniences and operational challenges for our patients and associates. With only a few exceptions, we have continued to provide care approximating our normal volume levels,” the statement read.
According to the health system, since Monday morning, MedStar Health as seen more than 6,000 patients in its hospitals and ambulatory centers.
Specifically, according to the statement, MedStar Health has cared for:
- An average of 3,380 patients a day in its 10 hospitals
- Treated 2,400 patients in its emergency departments
- Performed 782 surgeries
- Welcomed 72 babies into the world
“Our remarkable team of physicians, nurses and associates have been dedicated to maintaining high quality care for all our patients despite the disruption caused by the malware attackers,” Stephen R.T. Evans, M.D. chief medical officer of MedStar Health said in a statement. “The disruption to our systems has not impacted our ability to provide quality care to our patients, and we regret any inconveniences to our patients and the extra challenges to our associates that the perpetrators of this attack have caused.”
According to a Washington Post article on Tuesday, a MedStar Health spokeswoman said “by Tuesday evening, MedStar staff could read — but not update — thousands of patient records in its central database, though other systems remained dark.”
The Post article, written by John Woodrow Cox, also stated, “MedStar officials have refused to characterize the attack as ‘ransomware,’ a virus used to hold systems hostage until victims pay for a key to regain access. But a number of employees reported seeing a pop-up message on their computer screens seeking payment in bitcoins, an Internet currency.”
The health system did address patient safety issues in its statement posted Tuesday: “Every caregiver across the system is trained to prepare for these types of challenges, and our patients can be assured that their team of caregivers is well coordinated. Patients should feel confident that they will receive excellent care, and can continue to rely on our commitment to provide the highest levels of quality and safe care.”
According to MedStar Health on Tuesday, “with a few exceptions, all of our doors remain open.”
“Despite the challenges affecting MedStar Health’s IT systems, the quality and safety of our patients remains our highest priority, which has not waned throughout this experience. Fortunately, the core ways in which we deliver patient care cannot be altered, manipulated or harmed by malicious attempts to disrupt the services we provide,” Evans said in statement posted Tuesday. “Our ability to serve our patients and their families depends first and foremost on our caregivers, and their expert knowledge and compassion focused on each patient.”
Kenneth A. Samet, president and chief executive officer, MedStar Health, also stated in an official statement posted Tuesday, “The attempt to negatively impact an institution designed to save lives and care for those in need is a sad and troublesome reality of our times, not only for MedStar Health, but for our entire industry and the communities we serve,” says “Fortunately, thanks to the expertise and dedication of our clinical and IT teams, we are addressing the current issue in an expeditious and thoughtful manner, never losing sight of our responsibility to our patients.”
Hagland reported Monday that according to the Post report, “The FBI is investigating the breach, which comes just weeks after similar cyber-attacks on two other medical institutions in California and Kentucky. Still, MedStar officials said they had found ‘no evidence that information has been stolen,” the Post report said.
