Ardent took one network offline, and emergency departments in six states had to answer for it

The week

On Thanksgiving morning, November 23, 2023, Ardent Health Services began responding to a cybersecurity incident later identified as ransomware. The Nashville-based company operates 30 hospitals in six states, and the response began on a day when hospital administrative offices are usually close to empty.

Ransomware is malicious software that criminals use to break into an organization’s computer network and scramble (encrypt) its systems and files so they cannot be used, usually followed by a demand for payment to unlock them. In a hospital, those systems include the electronic health record, the digital chart that holds every patient’s history, medications, test results and orders.

Ardent took its network offline. That is a common and defensible move in a ransomware attack, much like closing fire doors to stop flames from spreading: disconnecting systems can keep the attackers from reaching more of them. But in a hospital, closing the fire doors also means staff lose the tools they use every minute of the day.

The effects showed up quickly in emergency departments. Several hospitals went on diversion, asking ambulances to take patients elsewhere because they could not safely handle certain cases without their usual systems. Some elective procedures, planned operations that can safely wait, were rescheduled while staff worked on downtime procedures, the paper-based and manual routines hospitals keep for when computers are unavailable.

On November 27, Ardent confirmed publicly what had been happening since Thursday morning. Affected facilities included Lovelace hospitals in Albuquerque, two Hackensack Meridian Health hospitals in northern New Jersey and UT Health East Texas. Several of them were run with partners whose names were on the building, so local residents saw familiar hospital brands in the news, not necessarily Ardent’s.

Ardent said patient care continued and that it was working with law enforcement and outside experts. Hospitals came off diversion market by market over the following days. Ardent later said diversions lasted a few days, until the incident was contained, while billing and other systems took longer to restore.

The story reached beyond one company’s security, to the way a single decision, made at the center of a large organization, ripples out into very different local communities, emergency medical systems and partnerships, on a holiday when many of the people who usually make and explain such decisions were away.

A hospital’s diversion affects its whole region, and a large system’s hospitals fail together when shared platforms go down. Ardent’s attack adds a governance problem specific to multi-state operators.

The decision that mattered most, disconnecting a shared network, was made centrally, as it should be. Its effects arrived in hospitals that sat in different state emergency medical systems, under different health department expectations, often with an academic or health system partner as co-owner and brand. And it happened over a holiday, when the people who normally make and explain such decisions are hardest to reach.

The reason one network decision can touch so many hospitals at once comes first. The problem itself has three parts, following the path of the decision: the central call to disconnect, the local calls that follow it, and the obligations owed to partners and public bodies.

Why one network decision reaches every bedside

A multi-state hospital operator usually runs much of its technology centrally. That is sensible: it is cheaper and more consistent to run one electronic health record, one email system, one set of security tools and one data center arrangement than thirty. The hospitals are connected to these shared systems through a wide-area network, the private network that links sites in different cities and states to the company’s core systems.

The benefit is efficiency and standardization. The cost is shared fate. If an attacker gets into the network, the same links that carry patient records between hospitals can carry the attack. And if the operator decides to close those links to stop the attack spreading, every hospital on them loses access at once.

Inside a hospital, the list of things that depend on the network is long. The electronic health record holds orders and charts. Imaging systems let radiologists view CT scans and X-rays, sometimes from another site. Lab interfaces send blood test results straight into the chart. Pharmacy systems check doses and interactions. Often the phones themselves run over the same network. When it goes dark, a hospital does not stop, but it slows down sharply, and its staff fall back on paper forms, runners carrying results by hand and phone calls, if the phones still work.

Some services are more sensitive than others. Stroke and trauma care, which depend on imaging and rapid lab results, are typically the first to divert. Minutes matter in those cases, and a hospital that cannot quickly read a brain scan may be safer sending the ambulance to a neighbor that can.

Diversion itself is a regional act. When one emergency department asks ambulances to go elsewhere, nearby hospitals absorb the extra patients, transport times lengthen and local emergency medical services (EMS), the ambulance crews and the physicians who oversee them, have to adjust. Every state organizes this differently, and there the multi-state problem begins.

The central call to disconnect

Taking a network offline is a defensible response to ransomware, because it can stop encryption and exfiltration (the copying of data out of the network) from spreading. In a multi-state operator, it is also the single largest clinical decision of the incident, because every hospital on that network loses the electronic record, imaging access, lab interfaces and often phones at once. It is usually made by a small group, such as the chief information security officer (CISO), the chief information officer (CIO) and the chief executive, within hours.

Preparation makes that decision cheaper. Four elements matter.

• Know the dependencies. An operator should know which clinical systems at each hospital depend on the shared network and which can run locally. That map tells leaders what they are actually switching off.
• Segment the network. Segmentation means dividing a network into compartments with controlled doors between them. A well-segmented network allows a disconnect to be partial where evidence allows, for example cutting corporate systems and wide-area links while leaving local clinical networks running. That segmentation is expensive and takes years, so it belongs in the capital plan, not the incident plan.
• Write down who decides. The decision authority should be written down with named alternates for holidays, because a decision delayed while executives are reached by phone is a decision made by the attacker.
• Put a clinician in the room. The incident command structure, the temporary chain of command a hospital sets up during an emergency, should include a clinical leader from the first call, so the person deciding to disconnect hears what it will mean in emergency departments before it happens.

Take an operator with twelve hospitals in four states. Its security team detects ransomware spreading at 5 a.m. on a holiday. In one version of the morning, the CISO spends two hours trying to reach the chief executive, who is on a flight, before cutting everything. In another, the CISO and a named alternate executive, joined on the first call by the chief nursing officer, agree within twenty minutes to cut the wide-area links and corporate systems while leaving local clinical networks running in the hospitals the evidence suggests are unaffected. Both versions disconnect. Only one of them chose how.

The local calls that follow

Once the network is down, each hospital faces decisions that cannot be made at headquarters: whether to go on diversion, for which services, and for how long. Those calls need to be made by people at the hospital who can see the emergency department and talk to local emergency medical services.

That requires pre-delegation, meaning authority handed down in advance so nobody has to ask permission on the day. Each hospital’s on-call incident commander, usually a senior nurse or physician leader, should hold written authority to set diversion status for named services, and to lift it, using criteria agreed in advance with clinical leadership. The criteria can be simple. For example: divert stroke patients if imaging results cannot be read within a set time; lift diversion once imaging and lab results are flowing again and verified.

Incident commanders also need the contact details for the regional EMS medical director, the state or regional diversion system and neighboring hospitals, held on paper or on devices outside the corporate network. If the only copy of the phone list sits on the system that has just been switched off, nobody can call anyone.

Across six states, those systems and contacts differ, which is why a single corporate playbook is not enough. One state may run an online diversion board, another may handle it by phone through a regional coordinator, and a third may have specific rules for trauma centers. A playbook written at headquarters can set principles, but the specifics must be local.

Ardent’s recovery was reported market by market, with some emergency departments back on ambulance traffic days before others, which is what local decision-making looks like. That unevenness was no failure: it reflected hospitals making their own calls, based on what they could see.

Holidays make this harder. Staffing is thin, executives travel, and some hospitals run on the minimum. A useful test is to pick a holiday weekend on the calendar and ask, for each hospital, who would hold diversion authority at 6 a.m. that day and whether they know it.

The obligations to partners and public bodies

Many hospitals in multi-state systems are joint ventures or carry a partner’s brand. A joint venture is a business co-owned by two organizations; in health care, it often means an operator like Ardent runs a hospital together with a local health system or academic medical center, whose name may be the one patients recognize. Ardent’s model included partnerships with academic medical centers and health systems.

When a joint venture hospital goes on diversion, the partner’s name is in the local news, and its own leadership, board and patients want answers. Reporters call the partner. Patients call the number on the sign. The partner’s board asks its chief executive what happened, and the chief executive may know less than the reporter.

The joint venture agreement may set notice obligations, information rights and decision rights that apply in an incident, and few were written with ransomware in mind. Operators should review each agreement for four things:

1. Incident notice timing: how quickly the partner must be told.
2. Who may speak publicly, and who approves statements.
3. Access to forensic findings, the investigators’ conclusions about what happened.
4. Responsibility for costs, from recovery to patient notification.

Then they should agree a short incident protocol with each partner before one is needed: a page or two that says who calls whom, within what time, and how public statements will be handled.

The same logic applies to public bodies. State health departments generally expect notice of significant service disruptions, and the rules and contacts differ by state. Health care is also in scope for federal incident reporting under the 2022 cyber incident reporting law, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), whose rules were still being written in 2023.

A matrix listing, for each hospital, the partner, the state agency, the EMS authority and the notice expectation, kept offline, turns a holiday scramble into a checklist. It is the least glamorous document in the incident plan and among the most useful.

The first night at one hospital

The three parts fit together over a single night. Follow one of that operator’s twelve hospitals: a joint venture with a local university health system, whose name is on the sign out front, in a state with a regional, phone-based diversion system.

5:20 a.m. The operator’s central incident team cuts the wide-area links. The hospital’s local clinical network stays up, but the electronic health record, which is hosted centrally, is no longer reachable. Imaging can still be performed on site, but the radiologists who read scans overnight work remotely and can no longer see them.

5:35 a.m. The house supervisor, a senior nurse who is the hospital’s on-call incident commander, opens the paper binder in the command center. It lists her authority: she may place the emergency department on diversion for stroke and trauma if imaging cannot be read within the agreed time. She calls the regional coordinator, using the number in the binder, and the EMS medical director. Stroke and trauma diversion starts at 5:50.

6:15 a.m. Using the offline matrix, the central team calls the partner university health system’s designated contact, as the joint venture protocol requires within two hours. The partner’s communications lead is told what has happened, what is known and when the next update will come. The two organizations agree a single short statement, as the protocol already says they will.

7:00 a.m. The same matrix tells the central team which state health department contact to notify for this hospital, and by what route. A dozen similar calls are being made for the other hospitals, each to a different agency, each recorded.

Day two. A radiologist arrives on site to read scans directly, and lab results are being walked to the emergency department. The incident commander judges that her criteria for lifting stroke diversion are met and ends it, telling the regional coordinator and the neighboring hospitals that had been taking her patients.

The attack is no less serious for all this. Elective procedures are still rescheduled and staff are still on paper. But at each step, someone already knew what they were allowed to do and whom to call. Run the same night without the binder, the matrix or the protocol: the nurse waiting for headquarters to tell her whether she may divert, the partner learning from a reporter, the health department call forgotten until the following week. The gap between those two nights is almost entirely a matter of preparation done months earlier.

Patients, money, regulators and partners

The case for this preparation rests on several kinds of exposure at once.

• Patients. Every hour on diversion means some patients travel farther for care, and every rescheduled procedure means someone waiting longer. The aim of all three parts is to shorten that period.
• Money. Diversion and cancelled procedures cut revenue, and billing systems that take longer to restore delay cash coming in. Recovery, forensic investigation and notification all carry costs.
• Regulators. State health departments, EMS authorities and, increasingly, federal agencies expect timely notice. Different expectations in different states multiply the chances of missing one.
• Partners and reputation. A partner that learns about an incident from the local news is unlikely to forget it. Joint ventures run on trust, and the first night of an incident can strain a relationship built over years.
• Staff. Clinicians working on paper for days need clear direction and support. Uncertainty about who is in charge adds to an already exhausting shift.

Decisions settled before the holiday

The three parts reinforce one another. A central decision made with clinical input, local leaders who already understand their authority, and partners who know what they will hear and when: together they shorten the period in which patients bear the cost of a network decision.

The gaps are just as consistent. Operators treat the disconnect as a purely technical decision, when it is the largest clinical decision of the incident and needs a clinical voice. They write one corporate playbook for every state, although diversion systems, EMS contacts and health department expectations differ. They keep contact lists on the network, when paper and offline devices are unfashionable and essential. They name only weekday decision-makers, instead of writing down holiday and overnight alternates who know they are on the list. They leave joint venture agreements silent on cyber incidents, and silence becomes argument at the worst possible time. And they put segmentation in the incident plan instead of the capital plan, though it cannot be built during an attack.

Before the next holiday weekend

• If we disconnected our network tonight, which clinical systems at each hospital would stop, and which could keep running locally?
• Who has written authority to disconnect the network, who are the named alternates on holidays, and is a clinical leader on the first call?
• At each hospital, who holds authority to start and end diversion, for which services, and using what criteria?
• Where are the contact details for each region’s EMS medical director, diversion system and neighboring hospitals kept, and could we reach them with the network down?
• What does each joint venture agreement say about incident notice, public statements, forensic findings and costs?

With hindsight

Ardent restored its systems over the following weeks, and later disclosed that the attacker had taken a copy of some patient and employee information. That second detail is a reminder that ransomware is often two crimes in one: the systems are locked, and data is stolen. Restoring the network ends the first; the consequences of the second can last much longer, in notification work, regulatory attention and patient concern.

In 2024, the attacks on Change Healthcare and Ascension showed the same tension between central decisions and local consequences on a larger scale. Ascension’s hospitals in several states worked without their electronic health record for more than a month, with ambulance diversions in some markets. The pattern Ardent illustrated, a shared network decision landing in many different local contexts, turned out to be a feature of how large health systems are built rather than a one-off.

Federal reporting moved forward slowly. CISA’s proposed incident reporting rule, published in April 2024, would cover many hospitals; as we write CISA is still working to finalize it. For hospital operators, that means one more set of expectations to add to the matrix once the rule is final, alongside state health departments and EMS authorities.

Ardent itself went public through an initial stock offering in July 2024, and its prospectus described the November 2023 incident among its risks. The signal is a useful one: a cyber incident that once might have been treated as an IT event now appears in the documents investors read when deciding whether to buy a company’s shares.

The expensive parts of resilience, such as network segmentation, take years and belong in capital planning. The cheap parts take weeks: written decision rights with holiday alternates, a clinician on the first call, pre-delegated diversion authority and agreed protocols with partners. For multi-state operators, the matrix of partners, state agencies and EMS authorities described above is a modest piece of work that still determines how the first night of an incident goes.