Ascension hospitals in Wisconsin and across the U.S. were hit Wednesday by a cyberattack that has interfered with its computer network and led to major disruptions in patient care that have continued into Thursday.
The cyberattack has led to canceled appointments, delayed care and confusion at Ascension hospitals and health care facilities in Wisconsin and across the country.
Health care workers at Ascension Wisconsin sites report not having access to Epic, the medical records system critical for storing patients’ medical information and managing their care. That interruption means doctors and nurses cannot see patients’ medical histories or other patient information, cannot communicate like they used to across hospital departments and have limited ability to see patients’ prior labs or test results. They are having to use paper records to track patient conditions, order procedures and write prescriptions, according to health care workers.
Some patients reportedly were unable to use MyChart, the online platform for patients to make appointments, check lab results and talk with their physician.
“This is a crisis situatoin,” said Tracey Schwerdtfeger, a registered nurse at Ascension St. Francis Hospital on Milwaukee’s south side and member of the union that represents health care workers there. “It’s really just seemed to paralyze a lot of the stuff we need to do.”
It is unclear when the situation might be resolved.
Company said it is working to resolve the issue
In an email obtained by the Journal Sentinel with a message from Ascension CEO Joseph Impicciche to health care workers, he said Ascension was working “diligently to resolve the issues as quickly as possible.”
“It is unclear how long it will take to get all systems back on track,” Impicciche’s message said.
The email also instructed health care workers to “prepare and act as if this downtime will last into the foreseeable future.”
In a statement posted on its website, Ascension said it detected “unusual activity on select technology network systems” Wednesday, later determined to be a “cyber security event.” It is unclear what kind of attack it was and whether ransomware was involved.
The statement says Ascension responded immediately, opened an investigation and began efforts to correct the situation. The statement alluded to ongoing interruptions to some systems as a result of the situation, but did not provide specifics.
“Our care teams are trained for these kinds of disruptions and have initiated procedures to ensure patient care delivery continues to be safe and as minimally impacted as possible,” the statement said. “There has been a disruption to clinical operations, and we continue to assess the impact and duration of the disruption.”
An earlier version of Ascension’s statement urged its business partners to temporarily sever online connections to its system.
Disruption leads to work-arounds for patient care
The disruptions mean it will take longer for patients to get care, but health care workers are doing the best they can to take care of patients and find workarounds, said Connie Smith, president of the Wisconsin Federation of Nurses and Health Professionals, the union that represents health care workers at Ascension St. Francis Hospital.
Union members at St. Francis are worried about their ability to provide quality care if they don’t have the necessary technology.
“Imaging results are taking hours which can have a very negative impact especially if it’s something that is very serious,” said Schwerdtfeger, the RN at St. Francis Hospital.
The shutdown of the Epic system has also negatively affected health care workers’ ability to monitor patients’ vital signs in the emergency department, to page doctors and to locate a physician or specialist for a consult, Schwerdtfeger said.
One physician who works at Ascension and spoke on the condition of anonymity for fear of repercussions advised patients who are critically ill or who have chronic illnesses that require detailed follow-up to avoid Ascension locations until the crisis is over.
Under this situation, when a patient comes in to an Ascension hospital or office for an appointment or a visit, doctors are “flying blind,” the physician said.
“You have no backstory of the person. You don’t know what the chief complaint is. You don’t know the history of the patient,” the physician said. “You’re completely blind.”
Cyberattacks becoming increasingly common
Cyberattacks are becoming increasingly common in health care, often affecting protected health information along with other data, such as account numbers, Social Security numbers, phone numbers and addresses.
Earlier this year, Change Healthcare, part of the conglomerate UnitedHealth, was hit by a cyberattack — one of the worst hacks to hit U.S. healthcare — that caused widespread disruptions in payments to doctors and health facilities. UnitedHealth ended up paying a ransom of $22 million in cryptocurrency, its CEO told a Congressional committee earlier this month.
Ascension is working with Mandiant, a cybersecurity consulting company, to investigate its cyberattack and help determine what information, if any, was compromised in the attack.
In its statement, Ascension said it would notify any individuals affected if it found any sensitive information was compromised.
A Catholic health system headquartered in St. Louis, Missouri, Ascension has around 140 hospitals, along with other care facilities, across 19 states and the District of Columbia. The national health system reported having about 134,000 employees in mid-2023.
In Wisconsin, the health system has 17 hospitals in southeastern Wisconsin and the Fox Valley, in addition to many physician offices and other health care sites.
The Detroit Free-Press and Reuters contributed to this story.
Read More: Ascension Wisconsin hospitals hit by cyberattack, disrupting care