Hurricane Ida and the IT dependencies that sit under the EHR

The week

Hurricane Ida made landfall near Port Fourchon, Louisiana, on August 29, 2021, as a Category 4 storm. It arrived sixteen years to the day after Hurricane Katrina, a date that carried heavy weight in the region. The National Hurricane Center later put its maximum sustained winds at landfall at about 150 miles per hour, tying it with the strongest hurricanes on record to strike Louisiana.

The grid

The wind did its worst damage to the transmission system, the high-voltage lines that carry electricity from power plants to the local networks serving homes and businesses. Every transmission line feeding New Orleans failed, and a transmission tower on the Mississippi River collapsed. With that backbone broken, grid power was cut to New Orleans and much of southeast Louisiana, in many areas for more than a week. More than a million utility customers in the state lost power. Fuel was scarce in the days that followed, as gas stations without electricity could not pump and roads were blocked by debris. Restoration had to begin with the transmission system before local circuits could be reconnected, so even undamaged neighborhoods waited.

The hospitals

Hospitals did what they are built to do in that situation: they switched to generators. Running a hospital on generators for an afternoon is routine. Running one for days is a different test, of fuel, of maintenance and of which parts of the building are actually wired to receive emergency power. Some hospitals in the hardest-hit parishes moved patients elsewhere after the storm damaged roofs or building systems.

All of this happened while the region’s hospitals were already crowded with patients from the Delta wave of COVID-19, so there was little spare capacity to absorb transfers. Before landfall, state health officials said hospitals would largely shelter in place rather than evacuate, because there were few places with room to take their patients. That decision made each hospital’s ability to sustain itself for days more important than usual.

The region had seen versions of this before. In August 2020, Hurricane Laura damaged water and power systems around Lake Charles, and hospitals there moved patients out. In February 2021, a winter storm in Texas caused widespread grid failures, and some hospitals lost water pressure as well as power. Separately, in May 2021, a ransomware attack had left a large California health system working without its electronic records for weeks. Long outages of the systems beneath clinical care were not hypothetical in 2021.

The networks

Communications failed too. Cellular, landline and internet service went down across much of the region as cell sites lost power and lines were damaged. A cell site, the tower and equipment that connects mobile phones in an area, usually has batteries and sometimes a generator, but those run out. When enough sites go dark, a whole area loses mobile service, and with it the way most staff, patients and families reach each other. Service in some parishes took days to return, and the outages drew attention from federal regulators.

Beyond the hospitals

The storm’s human toll extended beyond hospitals. More than 800 residents of seven nursing homes had been evacuated before the storm to a single warehouse, where conditions deteriorated after it passed. Louisiana authorities opened investigations into the deaths of residents there, and the state health department later moved to revoke the homes’ licenses.

And Ida was not finished. On September 1, its remnants caused deadly flash flooding in New York and New Jersey, far from where it first came ashore. The National Weather Service issued its first-ever flash flood emergency for New York City that night.

The question it raised

The week raised a question that rarely features in hospital technology planning. Most attention goes to the clinical software itself, above all the electronic health record, or EHR: the digital chart where clinicians record and look up everything about a patient, from medications to lab results. Ida showed that the EHR is only as available as the electricity and networks underneath it, and that those layers are usually owned by people who do not plan together.

The dependence had grown over the previous decade. Hospitals had moved clinical work onto wireless devices: barcode scanners at the bedside, smartphones for nurses, computers on wheels, and internet-based phones that draw their power from network switches. Many had also moved the EHR itself to data centers run by its vendor, hundreds of miles away. Each change made care faster and more reliable on an ordinary day. Each also added a link between the patient and the record that depended on power and connectivity a hospital might not control in a regional disaster.

Take a charge nurse on a medical floor at 3 a.m., two days after the storm. The lights are on, because the generators are running. The EHR is, technically, fine; the vendor’s data center hundreds of miles away is humming along. But the computer at her nursing station shows an error, because the network switch in the wiring closet down the hall is not on emergency power and its battery ran out hours ago. For her unit, the EHR is down. So is the desk phone, which drew its power from the same switch.

Hospital IT resilience planning usually starts with applications: EHR downtime procedures, backup and recovery, ransomware scenarios. Ida tested something underneath. For days, the question in affected hospitals was not whether the EHR was healthy but whether there was electricity to run the equipment that reaches it and a network to carry its traffic.

Three layers sit beneath every clinical application, and a week without the grid tests all three at once: power, what keeps devices running; connectivity, what links the hospital to everything outside it; and hosting, where the systems themselves live. Each is typically owned by a different team, which is why gaps between them go unnoticed until a storm finds them.

The sections below first trace the chain from bedside to record, then take the three layers in turn. They then cover the downtime procedures that bridge a failure in any layer, the cost and governance questions for leaders, and a method for tracing workflows to find single points of failure.

The chain between a wristband scan and the EHR

When a nurse scans a patient’s wristband and a medication barcode, it feels like one action. Behind it is a chain of equipment, and every link needs electricity.

The scanner talks over Wi-Fi to a wireless access point, a small box usually mounted on a ceiling. That box is cabled to a network switch, a device in a wiring closet that sorts traffic between the devices on a floor and the rest of the hospital. Switches connect to the hospital’s core network, which leads either to the hospital’s own server room or out through a telecommunications carrier’s lines to a data center elsewhere. At the end of that path, the EHR software checks the order and records the dose.

The arrangement resembles a city’s water supply. Most people notice only the tap. But water reaches the tap through pumps, mains and pipes, and a failure anywhere along the way leaves the tap dry, no matter how clean the reservoir is. The EHR is the reservoir. The closets, switches, carrier lines and cooling are the pipes and pumps.

The three layers correspond to that chain:

• Power keeps every device in the chain running, from the scanner to the server.
• Connectivity is the set of network links, especially those leaving the building, that carry the traffic.
• Hosting is where the servers running the EHR and other systems physically live, whether in the hospital basement or a remote data center.

Links that do not look like IT

The chain has hidden branches. Many wireless access points and desk phones receive their power through the network cable itself, from the switch, a design called power over Ethernet. When the switch loses power, the access points and phones on that floor go dark with it. Nurse call systems, patient monitoring networks, badge readers on medication rooms and the computers that run pneumatic tube systems often depend on the same closets.

Identity is another branch. Before the EHR opens, a clinician has to sign in. That sign-in may depend on directory servers in the hospital, on a cloud identity service, or on a second factor sent to a mobile phone. If the cellular network is down, a sign-in that requires approving a prompt on a phone can fail even when every other link works.

How the picture differs by type of provider

The chain looks different across health care. A large academic medical center usually has its own data center, an engineering staff and several carrier links, but also more closets, more systems and more places for a gap to hide. A rural critical access hospital, limited to 25 inpatient beds, may have a single carrier, a small IT team and a vendor-hosted EHR, with fewer redundant options available to it at any price.

Ambulatory networks face a different problem. Most clinics do not have generators. When the grid fails, a clinic simply closes, and the question becomes whether its patients can be seen elsewhere with access to their records. Dialysis centers and home health agencies have patients who cannot wait. Some patients at home depend on electricity for oxygen concentrators or other equipment, and they turn up at emergency departments when the power stays off. The federal emPOWER program, run by the Department of Health and Human Services, gives public health officials data on Medicare beneficiaries who rely on such equipment, which helps local planners anticipate that surge.

Power: what the generators actually feed

Hospitals are required to have emergency power, and the CMS emergency preparedness rule requires planning for alternate energy sources, including fuel. CMS, the federal Centers for Medicare & Medicaid Services, sets the conditions hospitals must meet to be paid by Medicare and Medicaid, which in practice makes its rules binding on nearly every hospital. CMS also adopted the 2012 editions of two National Fire Protection Association codes, the Life Safety Code and the Health Care Facilities Code, which set the technical rules for hospital emergency power.

Generators are usually maintained well. The questions that matter over a week of grid failure are more specific. How many days of fuel are on site? Do resupply contracts hold when roads are blocked and every facility in the region is calling the same suppliers? And which loads are actually connected to emergency circuits?

The branches and what is on them

That last question belongs to IT as much as facilities. Hospital electrical systems separate emergency power into branches for life safety, critical care and essential equipment. Exit lighting and fire alarms sit on one, operating rooms and intensive care on another, other important equipment on a third. Network switches in wiring closets, wireless access points, nursing station workstations, badge readers, and the cooling for server and network rooms may or may not be on those branches. It depends on decisions made when each area was built or renovated.

That is how a hospital ends up with lights on and computers dark. A data center running on generator power with failed cooling will shut itself down within hours, because servers produce heat and protect themselves by switching off when they get too hot. An EHR that is running but unreachable from a unit because the closet switch has no power is down for that unit.

The seconds between grid and generator

Even equipment on an emergency branch loses power briefly. The codes allow up to ten seconds for the generator to start and the transfer switch to move the load. Lights flicker and return. A network switch without battery backup, however, reboots, and a reboot can take several minutes. Every device behind it reconnects afterward, and some clinical systems need staff to sign in again. A closet on emergency power with no battery, or a battery that has failed, turns every transfer into a short outage.

Generators also do not always transfer cleanly. Some installations transfer in stages, and some loads are shed deliberately when a generator nears capacity. Facilities engineers know these sequences; IT teams often do not. A shared runbook that lists which IT loads come back in which order, and which are shed first, prevents surprises.

Testing with the real load

The codes require regular generator testing, typically monthly runs under load and a longer test every three years. Those tests prove the generator works. They do not prove that the right equipment is connected to it. A test that runs at an off-peak hour, without the IT closets, cooling units and workstations drawing their normal load, can pass while hiding the gaps that matter.

The fix is a joint map, maintained by facilities and IT together, showing which IT components sit on which emergency branch, verified by load tests that run with the IT equipment actually drawing power. The map should also record battery runtime for each closet, because the gap between grid failure and generator transfer, or a generator fault, is bridged by batteries nobody has tested in years. Those batteries, often called a UPS or uninterruptible power supply, tend to be assumed healthy until the day they are needed. Battery health can be monitored remotely, and many network-attached batteries report their own status. Few hospitals had wired that reporting into anyone’s daily dashboard.

Running for days

A generator running for a week needs more than fuel. It needs oil and filter changes at set intervals, staff watching it around the clock, and a plan for what happens if it fails while another unit carries the load. Diesel stored for long periods degrades unless it is maintained. Resupply depends on trucks reaching the site on cleared roads, and on suppliers honoring contracts when every hospital, nursing home and water plant in the region is calling at once.

Cooling is often the weakest point. Large chillers draw a great deal of power and are not always on generator circuits. Some depend on water supply, which can fail with the grid. Server rooms and network closets in buildings without full cooling get hot quickly. A plan that lists which rooms will overheat, how fast, and what portable cooling or load shedding is available turns a crisis into a procedure.

Connectivity: the network outside the walls

The second layer is everything that connects the hospital to the outside. During Ida, carrier networks failed widely as cell sites ran out of backup power and lines were damaged. Hospitals depend on those networks for links to other facilities in the system and for internet access to hosted applications. They also depend on them for telephones, for contact with emergency medical services, and for staff trying to reach work or check in.

Resilience here means diversity that is physical as well as contractual. Two carriers whose fiber enters the building through the same conduit, or shares a path down the same road, offer one route. Physical path diversity has to be checked on maps, not assumed from invoices.

This is one of the most common blind spots. A hospital may sign contracts with two telecommunications companies precisely so that one can fail without cutting it off. But carriers often lease space on each other’s cables or run them along the same road or bridge. A single washed-out culvert or a single fallen pole can then sever both. On paper the hospital has two lifelines; in the ground it has one.

Where shared paths hide

Shared paths hide in several places. Both carriers may route through the same telephone company central office, the building where local lines meet the wider network. Both may depend on the same regional fiber ring. The building may have only one entrance for cables, so both links share the last fifty feet. A backup cellular router, sold as diversity, depends on the same cell towers that fail in a regional storm.

Finding these takes work. Carriers can provide route maps, sometimes only under nondisclosure terms and sometimes only after persistent requests. Diversity can be written into contracts, with a requirement to notify the hospital if a route changes. Contracts drift over the years as carriers re-route traffic, so the check has to be repeated.

Priority programs most hospitals can use

Federal programs exist for exactly this situation. The Telecommunications Service Priority program lets eligible organizations, including many health care providers, register critical circuits so carriers restore them first after an outage. The Government Emergency Telecommunications Service and the Wireless Priority Service give authorized staff priority calling when networks are congested. Enrollment takes paperwork in advance and costs little. A hospital that enrolls its key circuits and its incident commanders’ phones before a storm gets a place in the queue that it cannot get afterward.

When everything wired is down

Beyond terrestrial links, satellite connectivity sized for essential clinical traffic, and radio systems for coordination with emergency services, cover the case where every wired and cellular network is down. “Sized for essential clinical traffic” matters. A satellite link will not carry everything a hospital normally sends, so someone has to decide in advance which systems get priority.

That decision is a clinical one as much as a technical one. The EHR, pharmacy systems, laboratory interfaces and the identity services that let clinicians sign in might come first. Email, guest Wi-Fi and software updates can wait. The network team can enforce the priorities, but clinical leaders should set them. Radio needs the same planning: who holds the radios, which channels connect to the regional coalition and emergency management, and who has practiced using them.

Outside dependencies by function

The other half is knowing which clinical functions need outside connectivity at all. E-prescribing, interfaces to reference laboratories, remote radiology reads, payer eligibility checks and telehealth all stop when the hospital is cut off. E-prescribing sends prescriptions electronically to pharmacies. Reference laboratories are outside labs that run specialized tests. Remote radiology reads are scans interpreted by radiologists working elsewhere. Payer eligibility checks confirm a patient’s insurance coverage. Each needs a written fallback, such as local printing of prescriptions, courier arrangements, or on-site reading of critical imaging.

Some fallbacks depend on partners who are also affected. A pharmacy without power cannot fill a printed prescription either. A reference lab may be reachable by courier only if roads are open. A teleradiology group in another state can still read images if the hospital can send them. Fallbacks should be checked against the regional picture as well as the hospital’s own.

Hosting: where the systems live

The third layer is location. Over the previous decade, many health systems moved their EHR and other clinical applications into vendor-hosted or cloud data centers far from the hospital. A vendor-hosted system runs on servers owned or managed by the software company; a cloud system runs on rented capacity from a large provider. Either way, the servers are no longer in the hospital’s basement.

That protects the systems from local disasters, a real benefit when the hospital’s own building is at risk of flooding. It also makes every hosted system depend completely on the connectivity layer. A hospital with a remotely hosted EHR and no working network link is in the same position as one whose data center flooded.

Matching the hosting model to the other layers

Bringing systems back on premises is rarely the answer. Matching the hosting model to the other two layers is. Remote hosting needs diverse, resilient network paths and a local, regularly refreshed read-only copy of critical patient information, available on emergency-powered devices when links fail. A read-only copy is a snapshot that staff can look at but not change: current medication lists, allergies, recent results and care plans, printed or viewable on a handful of designated computers. Local hosting needs protected power, cooling and a server room above flood level. Both need tested procedures for working without the primary system for days, not hours.

Major EHR vendors offer features for this purpose, often a set of designated workstations that receive regular downloads of key reports for each unit. These work only if the workstations are on emergency power, have a battery, have a local printer that is also powered, and are checked regularly to confirm the downloads are current. A business continuity computer that stopped receiving updates months ago gives false confidence.

Hybrid arrangements and their seams

Most hospitals in 2021 ran a hybrid. The EHR might be hosted remotely, while the virtual desktop servers that clinicians use to reach it run in the hospital’s own server room. Laboratory, imaging and pharmacy systems might be local, with interfaces to the remote EHR. Directory services might be split between the two. Each seam is a dependency: if either side fails, the workflow stops.

Vendor contracts and service levels describe the vendor’s side of the seam. A hosting agreement typically commits the vendor to availability at its data center and its network edge. The link from that edge to the hospital, the hospital’s own network and its power are the hospital’s responsibility. Reading the contract with that boundary in mind shows where the vendor’s promise ends.

Sign-in as a hosted service

Identity deserves its own line in the hosting plan. If clinicians sign in through a cloud identity service, the hospital’s connection to that service is as important as its connection to the EHR. If sign-in relies on directory servers in the hospital, those servers need emergency power and cooling like any other. Either way, a set of emergency accounts, stored securely and tested, lets designated staff reach critical systems when normal sign-in fails. Security teams sometimes resist such accounts, with reason, so they need tight controls, logging and review after every use.

Downtime procedures: planning for days, not hours

Every hospital has downtime procedures: the agreed way of working when the EHR is unavailable. Typically they involve paper order forms, printed medication administration records, runners carrying lab requisitions and a plan for entering everything into the system once it comes back. Staff practice them, usually for planned maintenance windows that last a few hours overnight.

A multi-day outage strains those procedures in ways a short one never does. Suppose a hospital loses its link to a remotely hosted EHR. The days might unfold like this.

On the first day, paper works reasonably well. Nurses have the most recent printed summaries, clinicians remember their patients, and the pharmacy fills orders from paper forms. The main pain is speed.

By the second day, the printed summaries are out of date. New patients have arrived with no electronic history available, so clinicians are asking patients and families about allergies and medications from memory. Lab results come back by phone and are written down by hand, and each handwritten transcription is a chance for error. Staff on their third or fourth double shift are tired, and tired people make more mistakes.

By the third day, the hospital faces a new problem: the backlog. Every paper record created during the outage eventually has to be entered into the EHR so that the patient’s chart is complete and the hospital can bill for its care. The longer the outage, the larger that pile, and the more staff time it consumes after the systems return.

Recovery is its own phase

Recovery deserves the same planning as the outage itself. When systems return, someone must decide what gets entered first. Active medication orders, allergies and results for patients still in the hospital come before charges for patients already discharged. Paper records need a controlled path into the chart, with checks for transcription errors. Interfaces that queued messages during the outage may release them in a flood, and staff need to know which results are new and which are old. Revenue cycle teams need extra hands for weeks. A hospital that writes this sequence down in advance, with named owners, shortens the tail of the outage considerably.

Departments with their own failure modes

Some departments fail in particular ways. Pharmacy loses automated checks for drug interactions and allergies, so pharmacists must check more by hand. Laboratory analyzers may still run, but results that normally flow straight into the chart must be printed and delivered. Blood bank depends on positive identification of patients and units, which barcode systems normally support. Imaging can still acquire scans if the equipment has power, but radiologists may not be able to see prior studies for comparison. Each department needs its own procedure, owned by its own leader.

Communicating when the phones are down

Staff communication is part of downtime planning. If cellular service and internal phones fail, staff cannot be called in or told when to report. Some hospitals set expectations in advance, such as reporting for the next scheduled shift unless told otherwise, or gathering at a fixed point at fixed times. They are less dependent on networks that may not exist. Runners, overhead paging and two-way radios become the internal network.

What good preparation changes

Good preparation changes this picture. A refreshed read-only copy of key patient information, available on a few emergency-powered computers, keeps the summaries current. Pre-printed forms in sufficient quantity, and supplies of them on each unit, keep orders consistent. A named downtime coordinator for each shift keeps track of who is doing what. And a recovery plan, with staff set aside to enter the backlog, prevents the outage from dragging on in the billing office for weeks after the lights are back. Drills that run for a full shift, rather than an hour, show where the procedures break before a real event does.

The same procedures serve any cause of outage. A storm, a cut fiber and a ransomware attack all leave clinicians without the record. Ransomware differs in one respect: the hospital may not trust its own systems even when power and networks work, and the read-only copy must be protected from the same attack. Planning downtime for days covers all three.

Patient safety, money and the board’s part

These layers translate directly into patient safety, money and reputation. When clinicians lose access to medication histories and allergies, the risk of errors rises. When laboratory interfaces stop, results travel by phone and paper, which is slower and easier to get wrong. When the hospital cannot reach its insurance payers, billing stalls, and catching up afterward takes weeks of staff time.

Regulators and the public also look closely at how a hospital performed in a disaster. A hospital that had to move patients because a generator-fed server room overheated will face harder questions than one that lost the grid and kept operating.

The money before and after

The spending involved is usually modest compared with what is at stake. Moving a few wiring closets onto emergency circuits, replacing aging batteries, paying a carrier for a genuinely separate route or adding a satellite terminal are ordinary capital projects. They compete for budget with visible clinical investments, which is why they tend to slip.

Some of the cost can be shared. Private nonprofit hospitals can be eligible for FEMA public assistance after a declared disaster, including for some emergency protective measures, and federal hazard mitigation grants can fund projects such as generators. Both require documentation, and reimbursement after an event depends on records kept during it. Finance teams should know the rules before the storm, and check with counsel or advisers on eligibility.

What a board should ask for

A board that asks to see the dependency map, and the list of single points of failure on it, gives those projects the attention they need. It also gives the board a clear way to judge, after the next storm or outage, whether management had done what could reasonably be expected.

Ownership is split. Power belongs to facilities, networks to IT, carrier contracts often to procurement, and downtime procedures to nursing and clinical leaders. Nobody owns the whole chain unless leadership assigns someone to. The assignment can sit with an existing role, such as the emergency management director, provided that person has authority to convene facilities, IT, procurement and clinical leaders and to escalate gaps.

The strongest objections

Three objections come up. The first is that the EHR vendor is responsible for availability. Its contract covers its own data center. The hospital’s closets, power and last-mile links are outside that promise, and they were what failed for many units during Ida.

The second is that a hospital facing a major storm should evacuate rather than try to ride it out. Evacuation carries its own risks for fragile patients, and in 2021 there was often nowhere to send them. The decision to evacuate is better made by a hospital that knows how long it can sustain itself, which is what the dependency map tells it.

The third is that a week without the grid is rare, so the spending is hard to justify. The same fixes help in far more common events: a construction crew cutting fiber, a failed transfer switch, a software fault, a ransomware attack. Spending justified by the rare event pays off in the ordinary ones. Not every closet needs the same protection, though. Prioritizing by clinical area, starting with emergency, intensive care, labor and delivery, and pharmacy, keeps the cost proportionate.

Tracing three workflows down to the generator

Underneath all three layers is a regional reality. Hospitals compete for the same fuel, the same carriers’ repair crews and the same transfer beds during a regional disaster. Healthcare coalitions, utilities and emergency management agencies are part of the dependency map, and their contacts belong in the plan.

A practical exercise is to trace three critical workflows, such as medication administration, laboratory results and imaging, down through application, network path, hosting site and power, and list every single point of failure found. Gaps found on paper cost far less than gaps found in a storm.

Take a 200-bed community hospital that traces its medication administration workflow. It finds that the EHR is hosted remotely, with two carrier links that turn out to share a road for the last mile. Three of its eight wiring closets are on emergency power; the other five rely on batteries rated for about 30 minutes. The server room cooling is on emergency power, but the network switches in that room are not. Nothing here is exotic, and all of it can be fixed with modest spending once someone has drawn the map.

Running the exercise

The exercise works best with a small group in one room: a facilities engineer, a network engineer, a clinical informatics nurse, someone from procurement who knows the carrier contracts, and the emergency management lead. They start at the bedside device and walk each step, asking at every link what powers it, what it connects to, and what happens when that fails. Floor plans, electrical one-line drawings, network diagrams and carrier circuit lists should be on the table.

The output is a short list of single points of failure, each with an owner, a fix, a cost and a date. The list goes into the capital plan and the emergency management plan. A year later, the same group repeats the exercise to see which items closed and which new ones appeared after renovations or system changes. Findings that stay open past their date go to the executive sponsor.

The usual ways hospitals fall short:

• Testing generators without IT load. A generator that starts perfectly may still not feed the closets that matter.
• Trusting carrier diversity on paper. Two invoices do not guarantee two routes.
• Planning for hours, not days. Downtime procedures written for a four-hour outage break down on day three.
• Forgetting the outside dependencies. E-prescribing, labs and imaging all stop at the hospital’s edge.
• Planning alone. Every hospital in the region will want the same fuel truck.
• Ignoring sign-in. A second factor sent to a mobile phone fails when the cell network does.
• Letting continuity workstations go stale. A downtime computer that has not received a report in months is worse than none, because staff trust it.

Checking the chain from generator to screen

1. Which network closets, workstations and cooling units are on emergency power, and when was that last verified with a load test?
2. Do our two carriers actually use different physical routes into the building? Who has checked the maps?
3. If our remote EHR became unreachable for three days, what would clinicians see, and on which devices?
4. Have we traced medication administration, lab results and imaging all the way down to power, and what single points of failure did we find?
5. Who owns the whole chain, from generator to EHR screen?

A hospital that can answer all five with evidence, and name the date of its last full-shift downtime drill, has done what Ida showed was needed.

With hindsight

Ida turned out to be one in a series of events that pushed infrastructure dependencies up hospital agendas. It was not the most dramatic of them, but it was a clear demonstration that clinical systems can be perfectly healthy and still unusable when the layers beneath them fail.

Connectivity: a rule for carriers, not for hospitals

In 2022, the FCC adopted rules making wireless carriers’ disaster roaming and coordination commitments mandatory, citing Ida among the disasters that had exposed weaknesses. Disaster roaming lets a customer’s phone connect to another carrier’s network when their own is down. Turning that from a voluntary promise into a rule helped the connectivity layer, though it does nothing for a hospital whose carriers all share one damaged road.

Satellite options also changed. Low-earth-orbit satellite internet services, which were new in 2021, became widely available in the years that followed and offered more capacity and lower delay than older satellite links. Many organizations added them as backup. The decision about which clinical traffic gets priority over a limited link remained a planning task, whatever the technology.

Standards caught up in places

The Joint Commission revised its emergency management standards for hospitals, with the new requirements taking effect in July 2022. The revision reorganized the requirements and gave continuity of operations more explicit treatment. That direction fits the three-layer view, though accreditation standards set a floor and do not draw any particular hospital’s map.

Outages without storms

The years after Ida made the case that the same dependencies fail for reasons other than weather. In February 2024, a ransomware attack on Change Healthcare, a large claims and payment processor owned by UnitedHealth Group, disrupted claims, eligibility checks and some pharmacy transactions for providers across the country for weeks. It was an outside dependency failing at a national scale. Hospitals and practices that had written fallbacks for those functions coped better than those that had not. In May 2024, a ransomware attack on Ascension, a large Catholic health system, left many of its hospitals working without their electronic records for weeks. It was a direct test of downtime procedures written for days rather than hours.

In 2024, Hurricane Helene damaged a major IV fluid manufacturing plant in North Carolina, causing national shortages and showing how one regional event reaches hospitals far away. That episode extended the dependency map beyond power and networks to supply chains. The logic was the same: a single point of failure, out of sight, can disrupt care well beyond the storm zone.

In July 2024, a faulty security software update crashed Windows systems worldwide, including at many hospitals, a reminder that the hosting and endpoint layers can fail without any storm. Endpoints are the computers and devices staff use directly. When they stop working, the effect on a unit looks much like a power failure, even though the cause is entirely different. Continuity workstations running the same security software would have failed along with everything else, which argues for managing those machines differently.

What held up and what did not

Health systems have since paid more attention to path diversity, satellite backup and joint facilities-IT dependency mapping. The three-layer view has held: clinical applications are only as available as the power and networks beneath them, and those layers have to be planned by teams that rarely sit together.

The view also needed widening. Ida framed the problem as physical: electricity, cables, buildings. The events that followed showed that a software update, a criminal group or a single supplier can remove a layer just as completely. The method of tracing workflows down to their dependencies still works. The list of dependencies has to include vendors, software and suppliers as well as generators and fiber.

The practical step is to make someone responsible for the whole chain, and to test it under realistic conditions before a storm or an outage does it for them.