Enloe Medical Center in EHR Downtime over Two Weeks

For over two weeks following a ransomware attack, the Enloe Medical Center in Chico, California, remained in Emergency Health Record (EHR) downtime mode, delaying surgical procedures and potentially putting patient safety at risk.

Fortunately, a quick response by the center’s IT workers reportedly got major clinical programs back online within three days of the attempted ransomware attack that disrupted its computer systems. As of Jan. 17, Enloe CEO Mike Wittermood reported that the center was operating at 95 percent.

According to Chico, Calif. news source Action News Now, caregivers at Enloe Medical Center credit well-planned and frequently practiced backup protocols for minimizing the danger to patients and allowing them to continue providing patient services while work was underway to restore systems. Hospital officials have also reportedly assured patients that their personal information and health records were not compromised because of the attack.

Nonetheless, because the hackers encrypted data that was in the hospital’s system, some elective procedures were reportedly delayed and had to be rescheduled.

Ransomware Attacks on Health Care Facilities Increasing

While the hackers hoping to score a large payday from Enloe Medical Center were foiled, other hospitals and clinics across the country were not as fortunate or well-prepared for a ransomware attack. Last year, Park DuValle Community Health Center in Louisville, Ky., was reportedly forced to hand over $70,000 to hackers in order to recover 20,000 patient records after being locked out for nearly eight weeks. According to cybersecurity firm Emsisoft, there was a total of 764 clinics and hospitals that fell victim to ransomware attacks in 2019.

Fortunately, no patient deaths have been reported as a result of these attacks – but Emisoft’s Chief Technology Officer, Fabian Wosar, warns that it was mostly luck. “That luck may not continue into 2020,” he said, as such ransomware attacks are expected to get worse in the coming year.

Experts doubt that hackers are trying to get patient data through these attacks – they are simply using extortion tactics to get money from these institutions. Health care facilities are more likely to pay up because of the urgency of being able to access patient records when needed.

Difficult Decisions

The FBI recommends that victims of ransomware attacks refuse to pay. However, when lives are at stake – as is usually the case at places such as Enloe Medical Center – there is little time to act and few choices. Questions such as whether or not there are reliable backups and how long it could take to restore them come into the equation. These must be weighed against the danger to patients. For this reason, most hospitals and clinics decide to pay the ransom.

How Ransomware Attacks Happen

Most hospital data systems have strong protections – but they cannot always protect against human error. Ransomware typically infects a system through “phishing” emails that contain malicious attachments, or a user who either unwittingly clicks on a malicious link, or views an online ad that contains malware. However, hackers are also able to gain access through outdated system software.

Outdated software is going to present a serious danger going forward since 70 percent of all healthcare systems use Windows operating software that Microsoft has stopped supporting. This underlines the importance of transitioning to new systems as soon as possible.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.