Four weeks on paper: what Scripps exposed about downtime plans

The week

Scripps Health, a large nonprofit health system in San Diego with five hospitals and 19 outpatient facilities, detected a ransomware attack on May 1, 2021. Ransomware is malicious software that criminals use to scramble an organization’s computer files so they cannot be used, then demand payment to unscramble them. To contain the damage, Scripps took many information systems offline, including access to its electronic health record and its patient portal. Trade press reports later said offsite backup servers had been affected as well, which closed off one of the obvious routes to a fast recovery.

The electronic health record, or EHR, is the central software a hospital runs on: every patient’s diagnoses, medications, allergies, test results and clinical notes, plus the orders that tell nurses, pharmacists and labs what to do. The patient portal is the website or app patients use to see their own records and message their doctors.

The attack did not come out of a clear sky. In late October 2020, CISA, the FBI and the Department of Health and Human Services had issued a joint advisory warning of ransomware activity aimed at US hospitals and healthcare providers. A month before that advisory, Universal Health Services, which runs hospitals and behavioral health facilities across the country, had been hit. It later reported about $67 million in pre-tax losses. The threat to hospitals was well signposted by the spring of 2021.

During the first week of May, Scripps diverted some ambulance traffic and some patients to other facilities, and clinicians worked on paper. Diversion means telling ambulances to take patients elsewhere, a serious step for any hospital and one that shifts pressure onto its neighbors. Contemporaneous reporting described stroke and heart attack patients being rerouted away from its four main hospitals, in Encinitas, La Jolla, San Diego and Chula Vista. Trauma patients could not be accepted at Scripps Mercy Hospital San Diego or Scripps Memorial Hospital La Jolla. Stroke, heart attack and trauma are the conditions where minutes matter most. A study published two years later estimated that Scripps accounted for roughly a quarter of inpatient discharges in the region, so the diverted load was large for neighbors to absorb.

For most of May, one of Southern California’s best-known health systems ran on clipboards: medication orders on paper, lab results carried by hand from floor to floor, patient histories reconstructed from memory and phone calls. Patients who could not reach the portal turned to phone lines, and some sought care elsewhere. All of this happened while hospitals were still operating under pandemic conditions, with staff already stretched by more than a year of COVID-19.

Scripps was not the only large organization in crisis that month. Colonial Pipeline was hit by ransomware on May 7, and Ireland’s national health service on May 14. For health system boards, the Scripps case was the closest to home: a US system of their own type, running on the same kind of software, going dark for weeks.

Recovery was slow. Core systems were restored gradually over close to four weeks, with portal access returning at the end of May.

The damage did not stop at disruption. Scripps later notified about 147,000 people that personal and health information had been taken from documents stored on its network. Several class action lawsuits followed. Its financial disclosures that summer put the cost at about $113 million. Of that, roughly $91.6 million was lost revenue and about $21.1 million was response and recovery expense, as reported by the HIPAA Journal from Scripps’s quarterly results. Insurance had covered only a small part at that point, and litigation costs were not included.

The incident drew attention because of its length and because it hit a large, well-resourced system. This was not a small rural hospital with a thin IT team. If Scripps could spend nearly a month on paper, so could almost anyone. That left every health system board with an uncomfortable thought: a downtime plan that works for an afternoon may not work for a month.

Every hospital has downtime procedures. Most were written for planned maintenance or an unplanned outage of hours, perhaps a day. Scripps showed what happens over weeks.

A short-outage plan treats the problem as one thing: keep caring for patients until IT brings the system back. A long outage splits it into three fronts that move at different speeds and need different owners: clinical continuity, the ability to deliver safe care without the record; revenue continuity, the ability to capture, code and bill that care; and workforce endurance, the ability of staff to sustain manual work far longer than anyone had rehearsed.

The article starts with why the systems go down at all, and why they take so long to come back, because that duration drives everything else. It then takes the three fronts in turn. The remaining sections pull them back together. They cover what the three fronts put in front of a board, and how they collide over a three-week timeline. They end with who owns each front and what a prepared organization has in place.

The argument is narrower than “ransomware is bad for hospitals.” A downtime plan sized for hours fails in predictable, separate ways when the outage runs for weeks, and each failure belongs to a different leader. Most of those failures can be found and fixed in a conference room, long before an attacker forces the question.

Why a ransomware outage lasts so long

When ransomware strikes, the attacker has usually been inside the network for some time, moving unnoticed from computer to computer and gaining higher levels of access. By the time files are scrambled, nobody can be sure which machines are clean.

That is why the first response is often to switch things off. Disconnecting systems stops the infection from spreading, but it also takes away the tools staff rely on. In a hospital, nearly everything connects to the EHR: the pharmacy, the lab, radiology, scheduling, billing, even some medical devices. Pull the plug on the core and the whole building feels it.

The containment decision

The first hours force a choice with no good option. Leaving systems running keeps care flowing but risks the attacker reaching more of them. Shutting down stops the spread but blinds clinicians at once. Most organizations in this position shut down broadly, because a partial shutdown that misses one infected server can restart the whole incident.

That decision is usually made by a small group in the middle of the night, often before anyone knows how the attacker got in. Organizations that have agreed the criteria in advance make it faster and with less second-guessing. Those that have not tend to lose hours to debate while encryption continues.

The rebuild sequence

Recovery is not as simple as flipping the switch back. Each system must be checked for hidden traces of the attacker, rebuilt or restored from backup copies, tested and reconnected in a careful order.

The order is dictated by dependencies. Identity services come first, because every other system relies on them to decide who may sign in. Attackers usually seize those services early, so they often have to be rebuilt from scratch. Then come the network, the servers that host the EHR, and the database itself. Only after that can the interfaces be restored.

Interfaces are the connections that carry orders and results between the EHR and the lab, pharmacy, radiology and billing systems. A large hospital can run hundreds of them through an interface engine, a piece of middleware that translates messages between systems. Each one has to be tested before clinicians can trust that an order placed on screen reaches the right department. A missing lab result is a safety problem, not a cosmetic one.

Bring a system back too early and the attacker may still be inside, ready to strike again. A house after a flood is a fair comparison: nobody moves back in the moment the water recedes. Each room is dried out and the wiring checked before anyone sleeps there again.

Backups, forensics and insurers

Three further factors stretch the timeline. First, backups. Attackers now look for backup systems and try to encrypt or delete them, and reporting on Scripps said its offsite backup servers were affected. Backups that sit on the same network, with the same administrator accounts, are not a reliable recovery path.

Second, forensics. Investigators need to establish how the attacker got in and what was taken, partly to close the door and partly to meet breach notification duties. Preserving evidence can slow the rebuild of the very systems that hold it.

Third, the insurer. Cyber insurance policies commonly direct the policyholder to approved breach counsel and forensic firms. That brings expertise, but it also adds parties, approvals and documentation to every major decision.

Hosted and self-run systems

The type of organization changes the shape of the outage. A large system that runs its own EHR in its own data centers has to rebuild that environment itself. An ambulatory network or smaller hospital that uses a vendor-hosted EHR may find the record intact at the vendor, but unreachable. If its own identity services, network and workstations are compromised, staff cannot safely connect, and the vendor may suspend the connection until it is satisfied the client is clean.

Hosting moves part of the recovery to the vendor, but it does not remove the local rebuild. It also adds a new dependency to plan for: the vendor’s own criteria for letting a compromised customer back in.

An outage measured in weeks is therefore often what a careful recovery looks like, rather than a sign of incompetence. Planning that assumes a quick restoration is planning for the wrong event.

Clinical continuity: paper works, briefly

In the first hours of an outage, paper works. Clinicians know their patients, downtime forms are printed, and read-only downtime reports give recent medication lists, allergies and results. Those reports are printouts or files generated in advance so that staff have a snapshot of each patient if the system goes dark.

Days one to three

Most EHR vendors offer business continuity tools: designated computers that receive regular extracts of key patient information and can print them during downtime. In a short outage these work well. The problem in a ransomware event is that those computers often sit on the same network as everything else. If the network is shut down, or the machines themselves are encrypted, the snapshot may be unavailable just when it is needed.

In these first days, the organization also stands up its command structure. Many US hospitals use the Hospital Incident Command System, a standard model for emergencies with an incident commander and sections for operations, planning, logistics and finance. Clinical units switch to downtime forms. Runners are assigned. The emergency department decides what it can and cannot safely accept.

After the snapshot goes stale

After a few days those reports are stale. New patients arrive with no accessible history. Lab and imaging results must be walked or phoned to units. Radiologists may read images at the scanner itself, because the system that stores and distributes images is offline. Orders for a CT scan or a blood test travel on paper and come back on paper, and every handoff is a chance for something to be lost.

Downtime tools are snapshots, and a long outage needs a living record. That means structured paper documentation designed for reconciliation later, manual tracking boards for bed status and pending results, and clear rules on which information must be entered into the EHR when it returns.

It also means an isolated, read-only copy of critical patient data that can be refreshed and accessed without the compromised network, something many organizations lacked in 2021. Isolated means separate credentials, separate infrastructure and no standing connection that an attacker could follow. Such a copy is usually narrow by design: active problems, medications, allergies, recent results and advance directives, for current and recently seen patients.

Medication safety without barcodes

Medication administration, which depends on barcode scanning and electronic orders, becomes slower and more error-prone. Barcode scanning is the safety check where a nurse scans the patient’s wristband and the medication before giving it, so the system can catch a wrong drug or wrong dose. Without it, that safety net is gone and everything depends on careful human checking.

Pharmacy feels this first. Automated dispensing cabinets on the units may run in a limited override mode. Pharmacists verify orders by phone or from paper copies. High-risk drugs, such as insulin, anticoagulants and opioids, need extra checks that the software used to provide. Many hospitals respond by restricting the formulary during downtime and requiring a second nurse to verify certain doses. Each of those controls costs time, which feeds straight into the workforce front.

Diversion and the region

Diversion is the hardest clinical decision. Leaders need criteria agreed in advance for when to stop accepting stroke, trauma or other time-critical patients they cannot safely treat. Making that call in the middle of a crisis, with incomplete information and exhausted staff, is far harder than agreeing the rules beforehand.

The criteria should be specific. A stroke center depends on fast imaging and fast access to prior records. A trauma center depends on blood bank systems, imaging and operating room scheduling. A cardiac program depends on the catheterization lab’s own systems. Each can be degraded in a different way, and each deserves its own trigger for diversion and for coming off diversion.

A long outage at a large system does not stay inside its walls. When Scripps diverted ambulances, neighboring hospitals absorbed the load at a time when emergency departments were already stretched by the pandemic. Referring clinics lost access to results, and patients due for infusions or procedures had to be reached by phone.

Regional emergency medical services, public health agencies and nearby hospitals should be part of the plan: how diversion will be announced, how records will move when systems are down, and how mutual aid will work beyond the first few days. Many regions already have healthcare coalitions that coordinate for disasters. A multi-week cyber outage belongs in their scenarios alongside earthquakes and pandemics.

How the clinical front differs by setting

An academic medical center has the deepest clinical staff and the most specialized services, but also the most complex web of systems and research platforms. Its biggest clinical risk is the volume of high-acuity patients who cannot easily go elsewhere.

A community hospital has fewer systems and simpler workflows, which can make paper easier to sustain. It may have little spare IT capacity and depend heavily on outside help to rebuild. A critical access hospital in a rural area may have no realistic diversion option at all, because the next hospital is hours away.

An ambulatory network faces a different problem. It can often reschedule routine visits, but it loses scheduling, prescribing and messaging at once, and patients with chronic conditions fall through the gaps. Behavioral health and long-term care providers depend on the record for medication histories and safety plans that are hard to reconstruct from memory.

Each setting needs a plan that reflects what it actually cannot do without the record. A single template copied across the enterprise misses those differences.

Revenue continuity: the outage continues after recovery

The second front is financial, and it is the one boards most often underestimate. When registration, charge capture, coding and claims systems are down, care is still delivered but not billed.

How care becomes cash

Registration records who the patient is and how they are insured. Charge capture records what was done for them. Coding turns clinical documentation into the standardized codes insurers require. Claims are the bills sent to insurers, who usually pay weeks later. Together these form the revenue cycle, the pipeline that turns care into cash.

Most claims pass through a clearinghouse, a company that checks and forwards electronic claims to many insurers. Eligibility checks and prior authorizations also travel electronically. During an outage, every one of those steps stops or moves to phone and fax, which few teams are staffed to sustain.

The backlog after go-live

During an outage, paper encounters pile up. When systems return, each one must be entered, coded and submitted, often with incomplete documentation and with timely filing limits running. Insurers set deadlines for submitting claims; miss them and the hospital may never be paid. Medicare generally allows twelve months from the date of service. Many commercial contracts set much shorter windows, which makes the order in which the backlog is worked a financial decision.

Documentation gaps make the backlog harder. Coders need physician notes, procedure details and diagnoses written in a form they can code. Paper notes written under pressure are often incomplete. Each gap becomes a query back to a clinician who is already behind. Some charges are never captured at all, because nobody wrote down the supply used or the time spent.

Cash falls during the outage and stays weak through the backlog. Denials may rise afterwards too, because insurers reject claims with missing authorizations or late submissions. Each denial needs an appeal, which needs more staff time.

That is why a four-week clinical outage can affect a health system’s finances for months. Scripps’s own disclosures showed the pattern: most of its estimated cost was lost revenue, with incident response and recovery a smaller share. The expensive part was the care that could not be billed, or could not be delivered at all, rather than fixing the computers.

Days of cash and who can bridge them

Planning means knowing how many days of operating expenses the organization can cover without claims income. It also means knowing which payers might advance payments, whether a credit line can be drawn quickly, and who will staff the backlog. Some organizations pre-arrange surge coding support with outside firms. Others set rules in advance for which accounts are worked first, usually by value and filing deadline.

Cyber insurance helps less than many boards assume. Business interruption cover usually has a waiting period before it applies, a limit on the total, and a requirement to document the loss in detail. Recoveries arrive months later, after the cash crunch. Scripps had received only a small fraction of its losses from insurance by the time it reported them. Insurance is a recovery source, not a bridge.

Differences by organization

A large nonprofit system with public debt may have bond covenants tied to days of cash on hand, and rating agencies watch that measure closely. A long outage can threaten a covenant, which turns an operational crisis into a conversation with lenders.

A physician group or ambulatory network typically runs on much thinner reserves and can feel a missed payroll within weeks. A critical access hospital may depend on a few payers and have little room to wait. A health plan or integrated system with its own insurer faces the problem from both sides, as payer and provider at once.

These are finance and revenue cycle questions, and in 2021 they rarely appeared in IT incident plans. The chief financial officer owns this front, with the revenue cycle leader running the backlog. Their plan should be exercised alongside the technical recovery plan, because the order in which systems return determines when billing can restart.

Reconciliation

There is also a reconciliation burden that few plans account for. When the EHR returns, every paper record created during the outage must be matched to the right patient and, where the rules require, entered into the system. Medications given, results received, notes written: each is a potential gap or error in the permanent record.

Organizations that design their paper forms with this moment in mind, using the same headings and fields as the electronic record, make the catch-up faster and safer. They also decide in advance what gets entered in full, what gets scanned as an image, and what gets summarized. Without those rules, the back-entry work can run for months and compete with current patients for the same clinicians’ time.

Workforce endurance: rehearsed for hours, needed for weeks

The third front is people. Manual processes take more time and attention. Nurses chart on paper and later help reconcile it. Pharmacists verify orders by phone. Registration staff rebuild patient records by hand. Physicians work without the decision support and alerts they rely on, the automatic warnings about drug interactions, allergies and abnormal results that the EHR normally provides. Fatigue builds, and the risk of error rises with it.

A generation without paper

Clinicians who trained after electronic records became the norm may have little experience working without one. For them, paper is not a familiar fallback but a new and stressful way of working, learned under pressure. Older colleagues may remember it, but even they have not done it at scale for years. Residents, travel nurses and agency staff, who rotate through many organizations, may not know the local downtime forms at all.

The staffing arithmetic

Endurance needs explicit management. That includes extra staffing on units, shorter shifts where possible, runners to carry results and orders, and support for staff who feel unsafe practicing without familiar safeguards.

The extra capacity has to come from somewhere. Administrative staff can be redeployed as runners, scribes and phone teams, which is one reason the incident command structure needs a labor pool function from day one. Elective procedures can be reduced to free clinical staff. Agency and travel staff can be added, though in 2021 they were scarce and expensive because of the pandemic. Each option has a cost, and the costs land in the revenue front.

Where staff are represented by unions, staffing changes, extended shifts and redeployment may be governed by collective agreements. Those conversations go better when the downtime plan has been shared with labor representatives in advance rather than presented in the middle of a crisis.

Safety culture under strain

Errors are more likely during manual work, and staff know it. If they fear blame, near misses go unreported, and the organization loses the information it needs to adjust. Leaders should say early and plainly that downtime near misses are expected and should be reported. Pharmacy and nursing quality teams can then spot patterns, such as a particular drug or handoff, and add a check.

Moral distress is part of the picture too. Clinicians who cannot see a patient’s history, or who must send a stroke patient elsewhere, carry that weight. Employee assistance programs, chaplaincy and peer support are part of the response, not an afterthought.

Communication as a clinical tool

Communication matters as much. Staff need regular, accurate updates on what is working, what is not and when to expect change. Patients need to know how to reach their care team when the portal is down. Leaders who treat this communication as part of the clinical response reduce confusion and frustration.

Communication channels themselves may be affected. Email, the intranet and the paging system may all depend on the compromised network. The organization then needs an alternative arranged in advance: a mass-notification service hosted elsewhere, printed call trees, or regular in-person huddles on every unit.

What lands on the board’s desk

It is easy for a board to hear “ransomware” and file it as a technology risk, delegated to the chief information officer and reviewed once a year. Scripps shows why that framing falls short.

Patient safety. Every safeguard built into modern clinical software, from allergy warnings to barcode checks, disappears at once. Care continues, but with fewer nets beneath it. The board’s duty to oversee quality and safety is directly engaged. A quality committee can ask for downtime-specific safety measures and near-miss reports, just as it reviews infection rates.

Money. The Scripps figures make the point: the cost of a long outage is dominated by revenue that never arrives or arrives late, not by the technical recovery. A health system operating on thin margins can find its cash position transformed in a matter of weeks. A finance committee can ask management to model a four-week outage in the same way it models a payer contract loss.

Staff. Weeks of manual work, on top of ordinary pressures, test morale and retention. How leaders support people during an outage will be remembered long after systems return.

Patients and community. Patients lose access to their records and their usual ways of reaching clinicians. Neighboring hospitals absorb diverted patients. The organization’s standing in its community depends on how well it communicates and how fairly it shares the burden.

Privacy and regulators. Scripps also had to notify about 147,000 people that their information had been taken. A long outage is often accompanied by a data theft, which brings its own legal duties, costs and scrutiny on top of the operational crisis.

The regulatory frame

The rules already reach these questions, though not in the language of weeks. The HIPAA Security Rule requires covered entities and business associates to have a contingency plan. It includes a data backup plan, a disaster recovery plan and an emergency mode operation plan. Testing those plans and analyzing which applications are most critical are listed as addressable elements, which means an organization must assess them and document its decision.

Hospitals that participate in Medicare must also meet CMS emergency preparedness requirements, in force since 2017. They call for an all-hazards risk assessment, policies to preserve and protect medical records during an emergency, and regular exercises. A multi-week cyber outage fits squarely inside those requirements, even though many plans written to meet them pictured storms and power failures.

Under the HIPAA Breach Notification Rule, a ransomware attack that encrypts protected health information is generally presumed to be a breach unless the organization can show a low probability that the information was compromised. Notification duties to individuals, to HHS and sometimes to the media then follow, with state laws adding their own requirements. The details are a matter for counsel, but the board should know these duties start running while the clinical crisis is still under way.

The objection: invest in prevention instead

The strongest objection to all this is that money spent preparing for a month on paper would be better spent stopping the attack. Prevention protects all three fronts at once. Downtime planning only softens the blow.

The objection has force, and prevention deserves the larger budget. But it assumes a level of certainty no security program can deliver. Health systems run thousands of devices, many third-party connections and staff who must open email from outside. Some attacks will succeed. The cost of planning for weeks is mostly staff time, exercises and some modest infrastructure, small next to the cost Scripps reported. The two investments complement each other; the second covers the failure of the first.

A second objection is that an isolated copy of patient data adds risk, because it is one more place sensitive information could leak. That is true, and it argues for keeping the copy narrow, encrypted, access-logged and tested, not for doing without it.

Week one versus week three

Suppose a regional health system with three hospitals and a network of clinics is hit by ransomware on a Saturday.

In week one, the downtime plan works roughly as written. Paper forms come out, downtime reports are printed, the emergency department goes on diversion for the most time-critical cases, and staff rally. There is a sense of shared crisis, and people work extra hours willingly.

In week two, the strain starts to show in places nobody planned for. The clinics have rebooked routine visits once and are running out of slots. The pharmacy’s workaround for high-risk drugs is holding, but only because the same senior pharmacists are covering extra shifts. The incident command center is meeting twice a day, and its updates have started to repeat themselves.

By week three, the picture has changed. The downtime reports are weeks old. Every new patient is a blank page. The pharmacy is behind on phone verifications. Nurses who volunteered for extra shifts are exhausted, and some are calling in sick. Specialists at referring clinics are asking why they cannot see results. In the finance office, a room is filling with boxes of paper encounter forms, and the chief financial officer is watching cash fall while the filing deadlines on the earliest encounters creep closer.

Meanwhile, the IT team is making good, careful progress, restoring systems one at a time. But nobody agreed in advance which systems come first. IT has prioritized the core clinical record, which is sensible, yet billing will be one of the last systems back, which means the cash problem lasts longest. If finance and clinical leaders had agreed a recovery sequence with IT beforehand, the system could have made that trade-off deliberately rather than discovering it.

When the EHR finally returns, the crisis changes shape rather than ending. Clinicians must learn which data from the outage period is in the system and which is still on paper. The back-entry project begins. Coders start on the boxes. For several weeks the organization is running two jobs at once: today’s patients, and the reconstruction of last month.

There is a less visible cost, too. Patients who were diverted, or whose procedures were postponed, may not come back. Some will have found new clinicians at neighboring systems during the outage. The system will only see that loss months later, in visit numbers that stay stubbornly below where they were.

Not one of the week-three problems is technical. Each one belongs to a different leader, and each one could have been rehearsed.

The same pattern applies outside health care. Any organization whose core operations run through a single system, a bank’s core ledger, a county’s benefits platform, an insurer’s claims engine, faces the same three fronts in a long outage: keep the essential service safe, keep the money moving, and keep people going. Health care simply makes the stakes most visible.

Who owns what

Each front needs its own named owner. Clinical leaders own care continuity and diversion criteria. Finance owns cash and backlog. Nursing leadership and human resources own staffing and support. IT owns recovery sequencing, which should be agreed in advance with the other three, because the order in which systems come back decides which front recovers first.

Fitting the fronts into incident command

Most hospitals already have an incident command structure for disasters, and the three fronts fit into it. The operations section carries clinical continuity. The finance and administration section carries revenue continuity and should be staffed by revenue cycle leaders as well as accountants. The logistics section supports workforce endurance, with the labor pool, supplies and food for staff working long shifts. The planning section tracks the situation and plans the next operational period.

The gap in many plans is that IT and security leaders are treated as a separate team, reporting to the command center rather than sitting inside it. In a cyber event, the technical recovery drives every other section’s timeline. A technical liaison in the command center, who can translate restoration progress into dates the other sections can plan around, closes that gap.

One voice outward

Someone must also own communication across all three fronts. Staff, patients, referring clinicians, neighboring hospitals, insurers and the press all need different messages, and inconsistent ones cause confusion. Many organizations name a single communications lead for the incident, working from pre-written templates, so that updates go out on a regular rhythm even when there is little new to report. Silence is the fastest way to lose the trust of exhausted staff.

Legal and privacy leaders run a parallel track: working with breach counsel and investigators, preparing notifications, and handling any contact with the attackers or law enforcement. That track needs its own owner, because its deadlines and confidentiality constraints differ from the operational ones.

Exercising for weeks, in an afternoon

Exercises should run the scenario for several weeks, not a single shift, and should include the people who would actually carry the load. A tabletop exercise, where leaders talk through a scenario around a table, can compress weeks into an afternoon by jumping ahead: “It is now day 18. What has changed?” That simple device surfaces the endurance and revenue problems that a one-day drill never reaches.

A good multi-week tabletop has a few injects ready for each jump. On day 4, the business continuity reports are stale. On day 10, a payer refuses to extend filing deadlines. On day 18, nurse sick calls double on two units. On day 25, the EHR is back but interfaces to the lab are not. Each inject tests a different owner, and the exercise report should list the gaps by owner with a date to close each one.

Functional exercises can then test pieces for real. A unit can run a full shift on downtime forms. The revenue cycle team can process a sample of paper encounters end to end. IT can restore the isolated patient data copy from scratch and time it. Each produces evidence that a regulator, auditor or insurer can see.

The checklist for a month on paper

A well-prepared health system tends to have:

• Downtime plans written for weeks as well as hours, with different stages and triggers.
• An isolated, refreshable read-only copy of critical patient data, tested on a schedule.
• Business continuity computers and printers that can work without the main network.
• Diversion criteria and record-sharing arrangements agreed with neighboring hospitals and emergency medical services.
• A cash plan: days of expenses covered, credit available, payer contacts for advance payments, and surge coding support lined up.
• A staffing plan for sustained manual work, including relief, runners, a labor pool and support for staff.
• A recovery sequence agreed between IT, clinical, finance and workforce leaders.
• Offline or immutable backups, with restore times measured rather than assumed.
• Regular communication routines for staff, patients and partners, through channels that survive a network shutdown.
• Paper forms that mirror the electronic record, and rules for what gets entered afterwards.

What the evidence looks like

An auditor, surveyor or insurer asking about these items will want artifacts, not assurances. Useful evidence includes the dated contingency plan and its last review, and the applications and data criticality analysis. It also includes after-action reports from multi-week exercises, with owners and closure dates. Restore test logs with measured times, and signed agreements with outside coding or staffing firms, complete the file. A board can ask to see the same documents.

Where plans usually fail

The failures are equally recognizable. Treating ransomware as an IT problem with a clinical side effect. Rehearsing downtime for a single shift. Leaving the chief financial officer out of incident exercises. Assuming staff goodwill will last indefinitely. Keeping business continuity tools on the same network as everything else. And forgetting that the whole region, beyond the hospital itself, will feel the outage.

Where a month-long outage would bite first

Five questions will tell a leadership team quickly how far its plan reaches:

1. How long could we run safely on paper, and what would break first?
2. Do we have a copy of critical patient data that clinicians could reach if our main network were shut down?
3. How many days of operating expenses can we cover without claims income?
4. In what order would our systems come back, and who agreed that order?
5. When did we last exercise an outage lasting weeks, and were finance and workforce leaders in the room?

Honest answers to these five will usually show which front is weakest. That front, rather than the one with the most familiar owner, is where the next dollar and the next exercise should go.

With hindsight

Scripps turned out to be a preview of larger events. What happened to one health system in San Diego in 2021 later happened at national scale.

The regional effect was measured first. In May 2023, researchers at UC San Diego published a study in JAMA Network Open on the two emergency departments of their own health system during the Scripps outage. Compared with the weeks before, daily emergency department volume rose by about 15 percent and ambulance arrivals by about 35 percent. Patients leaving without being seen more than doubled, and stroke care metrics were affected. The authors argued that ransomware attacks on hospitals should be treated as regional disasters. That gave hard numbers to the point that a long outage does not stay inside one system’s walls.

For Scripps itself, the legal tail ran into 2023. Reports in January of that year described a proposed settlement of roughly $3.5 million in the consolidated class action over the attack, with Scripps denying wrongdoing. The settlement was small next to the lost revenue, which fits the article’s argument about where the money goes.

In August 2023, the Joint Commission issued a Sentinel Event Alert on preserving patient safety after a cyberattack. It urged hospitals to prioritize services that must stay operational during extended downtime, form downtime planning teams, train staff for downtime operations and plan communication with patients and families. Extended downtime had become an accreditation topic.

In February 2024, the attack on Change Healthcare disrupted claims processing and pharmacy services across much of the US health system, turning the revenue continuity front into a national problem. Change Healthcare is a company in the middle of the payment pipeline, moving claims and payments between providers, pharmacies and insurers. When it went down, organizations that had never been attacked themselves found they could not get paid.

CMS responded in March 2024 with accelerated payments to hospitals and advance payments to other Medicare providers and suppliers. Trade press later reported that more than $2.5 billion went to hospitals under the program, which shows how quickly a revenue outage became a cash emergency. The Scripps lesson that finance owns a front of its own now applied to systems whose own networks were never touched.

In May 2024, Ascension, one of the largest US health systems, detected a ransomware attack that left major clinical systems unavailable for weeks. It did not restore electronic health record access across all its markets until mid-June. Its clinicians faced the same paper-based, multi-week ordeal that Scripps staff had lived through three years earlier, across a far larger footprint. Ascension later notified about 5.6 million people that their information had been taken.

Both reinforced the three fronts. Both made the case for rehearsing multi-week scenarios, keeping isolated read-only copies of critical records, and bringing finance and workforce leaders into exercises much harder to dismiss. HHS published voluntary cybersecurity performance goals for the sector in 2024, giving health organizations a reference point for the basic protections they should have in place. In January 2025, HHS proposed a major update to the HIPAA Security Rule that included a requirement to be able to restore certain critical systems within 72 hours. Whether and in what form that proposal is finalized is something organizations should confirm with counsel.

Some of the original analysis held up and some did not. The three-front structure held up well; each later incident stressed the same three. The assumption that a large, well-resourced system is safer did not: Ascension was larger than Scripps, and Change Healthcare showed that the revenue front can fail at a vendor rather than at home.

The basic arithmetic has not changed. The longer the outage, the more the burden moves from technology teams to clinicians and finance staff, and plans have to be written with them. Technology teams decide how fast systems come back. Everyone else decides how well the organization survives the wait.

The practical meaning of Scripps follows from that. A cyberattack on a hospital is not mainly an IT event. It is a patient safety event, a cash flow event and a workforce event that happens to start in the computers. Asking “how quickly can we restore?” is necessary. Asking “how do we run for a month if we cannot?” is what separates a plan from a hope.