Cybersecurity Beyond the Hospital Walls

Most healthcare emergency managers have tested a familiar scenario: staff log into the electronic health record and discover something is wrong. As the scope of the disruption becomes clear, the organization activates downtime procedures, transitions to paper documentation, and begins operating through alternate processes.

It is an important scenario to test. Hospitals must be prepared to continue providing safe patient care when technology is unavailable.

But there is another question worth asking:

Is your ambulatory network equally prepared for a cyber disruption?

Today's healthcare delivery systems extend far beyond the hospital campus. Primary care practices, urgent care centers, ambulatory surgical centers, specialty clinics, imaging centers, laboratories, and other outpatient services have become integral parts of the healthcare infrastructure within our communities.

These locations may have fewer onsite resources and less experience operating for extended periods without their normal technology.

Clinical professionals can provide hands-on care in many environments. But can that care be delivered safely and efficiently without access to:

• Electronic health records

• Patient schedules and medical histories

• Medication and allergy information

• Laboratory and imaging results

• Electronic prescribing

• Patient registration and referral systems

• Normal communications and network resources

If the answer is no, another question immediately follows: Where will those patients go?

Demand for care does not disappear when a clinic becomes unavailable. It shifts somewhere else, potentially affecting urgent care centers, neighboring practices, emergency departments, and other parts of the healthcare system.

For emergency preparedness, the question should therefore extend beyond, "Can the hospital operate in downtime?"

Instead, consider:

Can our healthcare delivery system continue operating safely when critical technology and communications are unavailable?

1.    Start at the Clinic

Each outpatient location should understand what services it can safely provide during a prolonged technology disruption.

Consider:

• Can staff determine which patients are scheduled?

• Can medications, allergies, and pertinent medical history be verified?

• Are essential downtime forms accessible when the network is not?

• How will the clinic communicate with health system leadership?

• Who has the authority to modify, restrict, or suspend services?

A downtime plan is only useful if the people expected to use it can access and implement it when normal systems are unavailable.

2.    Consider the Patients Who Have Not Yet Arrived

Outpatient disruption presents a different challenge from traditional hospital downtime. Clinics must manage not only the patients currently receiving care, but also those scheduled to arrive throughout the day.

Planning should consider how the organization will:

• Identify scheduled patients when appointment systems are unavailable

• Notify patients of delays or closures

• Determine which visits and procedures can safely continue

• Redirect patients to alternate locations when necessary

• Communicate with patients if normal digital channels are unavailable

Organizations should also anticipate the downstream effects of closing or limiting services at one or multiple locations.

3.    Anticipate the Human Workaround

Healthcare employees are problem solvers. During prolonged downtime, however, well-intentioned attempts to continue operations can introduce additional risks.

Personnel may consider personal email, personal devices, USB drives, messaging applications, or other unapproved workarounds when established systems are unavailable.

Preparedness should go beyond telling employees what not to do. For critical processes, staff should be able to answer:

If our normal process is unavailable, what is the approved alternative?

That question should be answered before an incident occurs, not during one.

4.    Don't Forget Recovery

Restoring technology is not the end of the incident.

Once systems return, the organization may need to reconcile:

• Paper documentation

• Laboratory and diagnostic results

• Prescriptions

• Orders and referrals

• Patient messages

• Appointments and scheduling changes

• Other work completed or deferred during downtime

Recovery planning should address how the organization will account for these activities and safely transition from downtime operations back to normal workflows.

Returning the EHR and network to service does not necessarily mean the organization has returned to normal operations.

Five Questions Worth Asking Now

Healthcare organizations should consider whether they can confidently answer the following:

1. Can we rapidly determine which ambulatory locations are operational during a cyber incident?

2. Can those locations continue providing safe care without their normal technology and communications?

3. Who decides whether a location continues, restricts, redirects, or suspends services?

4. How will patients and employees receive instructions if normal communication systems are unavailable?

5. How will we reconcile clinical and operational activities performed during downtime once systems return?

The Bottom Line

Cybersecurity is not solely an information technology problem. For healthcare organizations, a significant technology disruption can rapidly become a patient safety, continuity, communications, and emergency management problem.

Cyber exercises should reflect that reality beyond the walls of the hospital.

Test the primary care practice. Test the urgent care center. Test the specialty clinic. Test the loss of communications. Test patient redirection. Test decision-making when IT resources are overwhelmed. And test what happens after systems are restored.

The goal of cyber preparedness is not simply to restore the network.

The goal is to maintain, and restore, the organization's ability to safely care for its patients.

Author: Ryan Weaver, MBA, BSN, RN, CPPS, manager, emergency management