What a nationwide EHR outage at UHS asked of nurses and unit leaders

The week

In the early hours of Sunday, September 27, 2020, staff at hospitals run by Universal Health Services began finding that their computers no longer worked. UHS was one of the largest hospital and behavioral health operators in the United States, with around 400 facilities in the U.S., Puerto Rico and the United Kingdom. A cyberattack had taken systems offline across its network.

The company ran two kinds of business: acute care hospitals, and behavioral health facilities that treat psychiatric illness and substance use, where it was one of the largest operators in the country. The attack also came seven months into the COVID-19 pandemic. Hospitals were already carrying the strain of infection control, staff shortages and procedures deferred from the spring.

Media reports widely attributed the attack to the Ryuk ransomware, which had first appeared in 2018 and was known for targeting large organizations for large ransoms. Ransomware is malicious software that locks up an organization’s computers and files by scrambling them, then demands payment for the key that unlocks them. In a hospital, the most important thing it locks up is the electronic health record: the digital chart where doctors and nurses find a patient’s history, write orders, record medications and see test results.

UHS did not name the malware. An employee told the technology site BleepingComputer that files were being renamed with a “.ryk” extension and that a ransom note had appeared on screen. Security researchers quoted by the same outlet had seen Emotet and TrickBot infections at UHS during 2020. Those are tools typically delivered by phishing email, which Ryuk’s operators used to get a foothold before taking administrator credentials and deploying the ransomware by hand.

That last detail matters for what came next. An attacker with administrator rights can reach almost anything on the network, including backup servers and the directory that controls who can log in. Containment therefore meant switching off broadly, and recovery meant rebuilding trust in the network itself before switching anything back on.

What followed was a large, unplanned experiment in running modern health care without computers. Staff at many sites reported reverting to paper charting, manual orders and phone calls. Nurses who normally scan a barcode on a patient’s wristband before giving a drug were back to handwritten records. Lab results that usually appear on a screen had to be phoned through or carried by hand. Some facilities diverted ambulances, sending emergencies to other hospitals, or delayed procedures.

UHS said it had suspended user access to its U.S. information technology applications as a precaution. That is a common and sensible step in an attack: switching systems off can stop the infection spreading, even though it widens the immediate disruption. The company said patient care continued using established backup procedures, including offline documentation, the paper-based routines hospitals keep for exactly this situation.

Over the following weeks it restored systems site by site, reconnecting electronic records, laboratory and pharmacy systems. In October it reported that its hospitals were resuming normal operations as the back-loading of data from the downtime period was largely completed. It said its investigation, with outside forensic firms, had found no evidence that patient or employee data had been accessed, copied or misused.

Because the attack hit a single corporate network, every facility had the same problem at the same time. In a local outage, a hospital can borrow forms, staff or technical help from a sister facility. Here the sister facilities were in the same position, and the central IT team was stretched across hundreds of sites at once.

The bill was significant. The company later reported that the incident had a material financial impact on its results, the formal language companies use when something is large enough that investors need to know about it.

The attack landed in a month already shadowed by a hospital ransomware story. On September 10, an attack had disrupted Düsseldorf University Hospital in Germany, and an emergency patient sent to a more distant hospital died. German prosecutors opened an investigation. They later said they could not attribute the death to the attack, but the case had already made the clinical stakes of ransomware vivid.

Hospitals had been hit by ransomware before. What made the UHS attack notable was its scale: a national network losing core systems for days, and at some sites for weeks, rather than one hospital losing a system for an afternoon. It tested whether the people on the wards could carry the load.

Hospitals have had downtime procedures for as long as they have had electronic health records. “Downtime” is the industry’s word for any period when the computer systems are unavailable, and downtime procedures are the plans, forms and routines that let care continue on paper. Most were written for a short, local event: one hospital, one system, a few hours, perhaps a planned upgrade on a Sunday night.

The UHS attack tested them at a different scale, with a national network losing core systems for days and, at some sites, weeks. Readiness turned out to be held less in documents than in people. Four pieces of downtime capability matter most: the workflows that degrade first, the staff who carry the extra load, the clinical information that goes missing, and the work of returning to electronic operation. First, though, we look at what the record does that staff no longer notice. After the four parts, a composite week on paper ties them together, followed by the cost, a test of a real plan and questions a board can ask.

The invisible safety checks in the electronic record

An executive who has never worked on a hospital ward may underestimate how much invisible work the electronic health record performs. It is far more than a digital filing cabinet; it works more like the hospital’s air traffic control system.

When a doctor orders a medication, the record checks it against the patient’s allergies, their other drugs and their weight, and warns of dangerous combinations. It sends the order to the pharmacy, which prepares the drug, and to the nurse’s worklist, which says when it is due. When the nurse gives it, a barcode scan on the wristband and on the medication confirms the right drug is going to the right patient at the right dose. If a lab result comes back dangerously abnormal, the record can alert the clinician. Bed boards show which beds are free. Transfer tools tell ambulance services where to go.

Each of these is a safety net built from software, and most staff never think about them. Take the software away and every one of those checks has to be done by a human, with paper, a phone and a second pair of eyes. The work becomes slower, more tiring and more error-prone, especially for people who have never worked that way.

The interfaces nobody sees

Much of that work happens between systems rather than inside the record. A hospital typically runs a laboratory information system, a pharmacy system, a radiology system and an image archive, a bed management tool and a billing platform. An interface engine passes messages among them, in a health data standard called HL7, thousands of times an hour. Smart infusion pumps, automated dispensing cabinets and bedside monitors may also connect to the network.

When the network goes down, each link fails in its own way. Dispensing cabinets may fall back to an override mode that lets nurses pull drugs without a pharmacist’s verified order. Infusion pumps keep running but stop receiving drug library updates. Analyzers in the lab still produce results, but nothing carries them to the chart. Each fallback is a local workaround that someone must know about.

Why containment widens the outage

Ransomware operators who reach administrator rights usually compromise the directory service that controls logins across the organization. Until that directory is rebuilt or proven clean, almost nothing that depends on it can be trusted, including the record, email and remote access. That is why outages from attacks like this last weeks rather than hours. Systems cannot simply be restored from backup onto a network the attacker may still control.

A hospital cyberattack is therefore a clinical operations event first. The damage starts in the servers, but it is felt on the wards.

The workflows that degrade first

Processes do not fail at the same rate. In an extended outage, the most dangerous gaps tend to appear in three places.

• Medication administration. Barcode scanning and electronic records normally catch wrong-patient and wrong-dose errors. On paper, those checks depend on a second person and a legible order.
• Results. Laboratory and imaging results stop flowing to clinicians automatically. Someone has to phone, print or carry them, and track who has seen what.
• Orders. Orders revert to paper and must be transcribed, interpreted and followed by hand, often by staff who have rarely written one.

Medications, step by step

Take a 30-bed medical unit at a community hospital on the second night of an outage. Twelve patients have medications due at 10 p.m. Normally the nurse pulls up a worklist, scans and documents in a few minutes per patient. Tonight, the nurse works from a paper medication record copied out by hand that afternoon from the last printed list. One patient’s dose was changed by a doctor this morning on a paper order that has not yet reached the copy. Nothing is broken and nobody is careless, yet the conditions for an error are all there. Multiply that by every unit, every shift, for a week.

The controls that close that gap are procedural. A single paper order sheet per patient, kept at the bedside, with every change written there first. A pharmacist reviewing new paper orders before first doses, except in emergencies. Independent double checks for high-alert drugs such as insulin, anticoagulants and opioids. A set time each day when the paper medication record is rewritten from the current orders and checked by a second nurse. Each step costs minutes, and the minutes add up across a unit.

Results and orders

Results need a closed loop. The lab phones critical values to the unit, and the person taking the call reads the value back and logs it with the time. Routine results arrive in batches by runner or fax, and someone must reconcile what was expected against what came. Imaging is harder, because radiologists may be reading on standalone workstations and dictating reports that cannot be routed. Orders need a standard paper form, a rule against verbal orders except in emergencies, and a way to know which orders are active after several pages have accumulated.

The support services behind the ward

Less visible services degrade too. Diet orders normally flow electronically to the kitchen, so allergies and texture restrictions must be phoned or carried. Patient transport and environmental services often run on electronic task queues that tell porters and cleaners where to go next. When those stop, beds sit dirty and patients wait for transport, which slows admissions from the emergency department. Each service needs its own paper or radio workflow.

Behavioral health and other settings

Behavioral health facilities, a large part of the UHS network, add their own concerns. Observation rounds (regular, documented checks on patients at risk of harming themselves), restraint and seclusion documentation, and medication timing are tightly regulated and safety-critical. Medicare’s hospital conditions of participation, for example, set specific requirements for orders, monitoring and a face-to-face evaluation within one hour when restraint or seclusion is used for violent or self-destructive behavior. Each needs a tested manual equivalent, and a binder that has not been opened since it was written does not count.

Ambulatory networks face a different set of failures. Scheduling and check-in stop, so clinics cannot see who is booked. Electronic prescribing stops, and controlled-substance prescriptions on paper must meet federal and state requirements that many younger prescribers have never had to follow. Patient portals go dark, and patients call the phone lines, which may also be down. A clinic network may decide to cancel non-urgent visits, a choice an inpatient unit does not have.

The staff who carry the extra load

Many nurses, residents and pharmacists working in 2020 had trained entirely on electronic systems. Paper ordering, manual medication reconciliation (the careful process of checking a patient’s full list of drugs for gaps and duplicates) and handwritten notes were unfamiliar. In an outage, unfamiliar work is slower and raises the cognitive load on people already at capacity.

Downtime is therefore a workforce matter, in three ways. It needs training, including drills long enough to surface real problems, such as a full shift with a medication pass and a handoff. It needs staffing flexibility, because the same census, meaning the same number of patients, takes more people and more time without systems. And it needs attention to fatigue across a long event, when strain accumulates day after day and agency staff unfamiliar with local paper forms arrive to help.

Who owns the ward during downtime

Nurse managers and unit leaders decide whether a unit functions during downtime. They choose who runs the paper medication record, who walks results and when to call for help. Giving them ownership of readiness, with IT and clinical informatics in support, puts accountability where the decisions are made. Clinical informatics is the small specialty, often nurses and doctors with technical training, that bridges clinical care and technology. Its people are natural partners for unit leaders, but they cannot own the ward.

Above the units, most hospitals organize a major event through an incident command structure, often based on the Hospital Incident Command System. It assigns roles such as incident commander, operations, planning and logistics, and it works because the roles are known before the event. Downtime plans should map onto that structure, so that forms, runners, staffing and communications each have a named section chief rather than whoever happens to be on call.

Designing drills that teach something

A useful drill runs long enough for the hard parts to happen. Starting a scheduled downtime drill at shift change forces a paper handoff. Including a medication pass with a deliberate order change tests whether changes reach the paper record. Asking the lab to phone a mock critical value tests the read-back log. A short debrief afterward, recorded with the problems found and their owners, turns the drill into an improvement plan.

There is a real trade-off. Running a live unit on paper introduces risk to real patients, which is the very harm the drill aims to prevent. Many organizations therefore use planned maintenance windows, which already require downtime, as drills. Others run simulation sessions with mock patients, or drill on lower-acuity units first. Each choice gives up some realism for safety, and the plan should say which was made and why.

Bringing new staff up to speed

Hospitals have constant turnover. New graduate nurses, rotating residents and travel nurses arrive every month, most of them trained only on electronic systems. Downtime competence fades unless it is part of onboarding: a short session on the paper forms, where the downtime box is kept and who to call. A one-page unit card, kept with the forms, does more on the night than a long policy on the intranet.

Staffing, fatigue and labor relations

A long event needs a staffing plan that assumes slower work. That may mean adding a runner or clerk per unit, shortening shifts, using a labor pool of staff from closed clinics or administrative roles, and bringing in agency nurses. Where staff are represented by unions, overtime, mandatory call-in and reassignment terms in the contract shape what is possible. Agreeing in advance how those terms apply in a declared downtime avoids negotiating in the middle of the event.

A practical measure is the share of staff on each unit who have worked a drilled downtime shift in the past year. It is simple and countable, and it describes real readiness better than the existence of a policy document.

The clinical information that goes missing

Clinicians in an outage lose history: allergies, recent results, current medication lists, code status (whether a patient wants resuscitation if their heart stops) and advance directives. Some organizations keep read-only downtime viewers, or periodic printed or locally stored summaries per unit, to bridge the gap. Those tools help only if they are refreshed often, stored where the same attack cannot reach them, and known to the people who need them at 3 a.m.

What a downtime summary should hold

A unit-level summary works best when it is short and clinical. For each current patient it should show identifiers, allergies, code status, active medication orders with last-given times, recent critical results, isolation status and the care team. Major record vendors offer business continuity tools that generate such reports on a schedule. The interval is a trade-off: refreshing every few hours keeps the content current but adds load and storage, while a nightly refresh can leave a day of changes missing.

Where to keep it

Storage is the condition most often missed. Some downtime viewers run on the same network as the main record. Some nightly summaries are saved to a shared drive the ransomware also encrypts. Either gives a comforting sense of preparation and then fails on the night. Technologists call the fix “segregation”: keeping the backup copy physically or logically separate from the systems an attacker can reach.

A common design is a dedicated workstation on each unit, on backup power, with a local printer and encrypted local storage. It receives the summary on a schedule and is otherwise isolated. The device then holds sensitive health information outside the main record, so it needs physical security, encryption and an access log. Those obligations under the HIPAA Security Rule are manageable but should be designed in, not discovered.

Getting into the backup tools

A downtime workstation is useless if nobody can log in. When the attacker has compromised the central directory, ordinary credentials stop working or cannot be trusted. Plans need local accounts on downtime devices, with credentials stored offline in sealed envelopes or an offline vault and changed after each use. Break-glass accounts for critical systems need the same treatment. The security team will reasonably worry about shared credentials, so access should be logged and reviewed after every event.

Communications

Communication fails in the same way. If email, paging, secure messaging and the phone system share infrastructure with clinical systems, one attack can silence them all. Hospitals need out-of-band ways to reach staff and coordinate across sites, meaning channels that run outside the affected systems, tested before they are needed. A list of cell phone numbers in a locked drawer is a start, not a system.

Stronger options include a mass notification service hosted separately from the hospital’s own identity system, two-way radios for key roles, satellite phones for the command center, and printed call trees refreshed each quarter. Each has a cost and an owner. The test is whether the incident commander can reach every unit manager within minutes of the network going dark.

Patient flow and the region

Patient flow suffers too. Bed boards, transfer center tools and ambulance status systems are often electronic. Without them, house supervisors, the senior nurses who manage the whole hospital’s capacity overnight, work from whiteboards and phone calls, and decisions about diversion become harder to coordinate with EMS.

Diversion also moves the load to neighbors. When one hospital diverts, nearby emergency departments absorb the ambulances. Regional healthcare coalitions, supported by the federal Hospital Preparedness Program, exist partly to coordinate that. A downtime plan that names who calls the coalition and the EMS agencies, and how often status is updated, protects the region as well as the hospital.

The return to electronic operation

Recovery is its own workload, and often a longer one than the outage. Paper records created during downtime must be entered or scanned into the record. Orders must be reconciled, charges captured and results matched to the right patients. Without a plan, back-entry creates a second wave of risk, including duplicate orders, missing allergies and gaps in medication history. It also delays billing, which strains finances already hit by the incident.

Sequencing the restore

Sequence needs clinical judgment. Which systems return first, which units go live first, and how to confirm that restored data is complete and untampered are decisions that need both technical and clinical input. A staged return, with a clear cutover time per unit and a rule for which record is authoritative during the transition, avoids two sources of truth. A nurse holding a paper chart and a newly restored screen that disagree needs to know, without debate, which one to believe.

The technical order is usually fixed by dependencies. Identity and core network services come first, then the record and its database, then the interface engine, then the ancillary systems that feed it. Clinical leaders decide the order of units within that frame. Emergency, intensive care and pharmacy often come early, because the safety value of the record is highest there.

Hosted and self-hosted records

Where the record runs changes the recovery. Some health systems host their record in their own data centers. Others use a vendor-hosted or cloud arrangement. A hosted record may survive an attack on the hospital’s network, but staff still cannot reach it until local devices, identity and connections are trusted again. A self-hosted record puts more of the rebuild on the hospital’s own team. Either way, the contract should say who restores what, in what order and to what timetable, and the downtime plan should match it.

Bringing devices and interfaces back

Medical devices and interfaces need their own checks. Dispensing cabinets must be taken out of override mode and their inventories reconciled. Infusion pumps need current drug libraries. Each interface should be tested with a sample message before live traffic flows, so that results do not land on the wrong patient. Biomedical engineering and the interface team usually own these steps, and they compete for time with everything else.

Data integrity

Data integrity is the other recovery question. Before staff rely on a restored system, someone has to be confident that the data in it is complete and has not been altered by the attackers. In practice that means comparing restored records against known-good backups, checking that recent entries are present, and giving clinicians a clear way to flag anything that looks wrong. It is slower than simply switching back on, and it is the difference between recovering and recovering safely.

Back-entry and the legal record

Back-entry needs rules as well as people. Health information management, the department that owns the legal medical record, should decide in advance what is entered as discrete data and what is scanned as an image. Medications given and allergies discovered usually need discrete entry, because future safety checks depend on them. Progress notes can often be scanned. Every back-entered item should carry the time it happened as well as the time it was entered.

Back-entry also needs people. Health systems that had identified a pool of staff in advance, such as clinical documentation specialists, informatics nurses or trained agency staff, could start reconciliation without pulling nurses off the floor. Those that had not found the backlog competing with patient care for the same hours.

Revenue, privacy and the regulators

Revenue cycle teams face their own recovery. Charges from paper must be captured and coded, and claims must still meet payers’ timely filing limits. Contracts with major payers sometimes allow extensions for documented disasters, which is worth confirming in advance with the managed care team.

Privacy runs in parallel. Under guidance from the HHS Office for Civil Rights, a ransomware attack that encrypts protected health information is presumed to be a reportable breach. The presumption holds unless the organization can show, through a documented risk assessment, a low probability that the information was compromised. That analysis depends on forensic evidence, so the clinical recovery and the investigation have to share information without slowing each other. Organizations should work through notification questions with counsel.

A week on paper, day by day

The following composite, set in a hypothetical 200-bed hospital, shows how an extended outage feels from the inside. Each stage reflects the problems described above.

Hour one. Screens freeze or show a ransom message. The IT team, following its playbook, shuts systems down to contain the attack. The house supervisor declares downtime, and runners carry boxes of paper forms to every unit. Most staff assume it will be over by morning.

Day one. Adrenaline carries people through. Paper medication records are copied out by hand from the most recent printouts. Lab results arrive by phone, and the unit clerk keeps a log of who was told what. The emergency department slows down, and the hospital asks the ambulance service to divert some patients. Senior leaders meet every few hours, mostly in person, because the email system is down.

Day three. The forms are running low and the photocopier queue is long. Night staff who missed the first briefing are unsure which forms to use. A nurse discovers that a patient’s allergy, recorded in the electronic chart last month, is not on the paper summary. The pharmacy, without its usual checking software, has slowed to a careful crawl. Managers start to see fatigue: people are working harder for longer, and the end date is still unknown.

Day seven. Some systems are back, but not all. One unit is live on the restored record while the unit next door is still on paper, and patients moving between them carry two kinds of chart. Billing has captured almost nothing for a week. A stack of paper orders, notes and results waits to be entered, and the people who would normally do that work are the same exhausted nurses.

Week three. The hospital is fully back on its systems, and the back-entry backlog is still being worked down. Finance is trying to rebuild a week of charges. The board asks what happened, and the honest answer is that the binder existed but the hospital had never practiced a week like this.

Every stage of that story can be improved in advance. Drilled staff help on day one and protected summaries on day three. A fatigue and staffing plan matters by day seven, and a named back-entry team in week three.

The same week in a behavioral health hospital

A freestanding psychiatric hospital would feel the week differently. Its patients stay longer, so paper records accumulate for days on the same people. Fewer results and imaging studies are involved, but observation rounds and medication timing carry more weight, and documentation of restraint and seclusion must stay complete for surveyors. Staffing is often leaner, so the extra paper work falls on fewer people. A plan built for an acute hospital and copied across a behavioral network will miss those differences.

A cost that lands on the income statement

The UHS episode makes the business case plainly. The company reported a material financial impact. Part of any such cost is obvious: recovery, investigation and lost activity when ambulances are diverted and procedures delayed. Part is less obvious: overtime and agency staff to run paper processes, the weeks of back-entry, and the delayed billing that follows when charges cannot be captured.

The risks go beyond money. Regulators and accreditors expect hospitals to keep patients safe whatever happens to their systems. Staff who feel abandoned during a chaotic week remember it, and in a tight labor market that matters. Patients and communities judge a hospital by whether it stayed safe and honest during a crisis.

Insurance and contracts

Cyber insurance can offset some of the cost, but policies vary widely. Business interruption cover often has a waiting period before it applies, and it may require detailed evidence of lost revenue and extra expense. Insurers also increasingly ask about backups, multifactor authentication and incident plans when writing or renewing cover. A finance team that understands the policy before an event can collect the right records during it, such as overtime logs, agency invoices and diversion hours.

The case for spending on prevention instead

A finance committee could fairly ask why money should go to paper drills when it could go to stopping attacks. Prevention does deserve most of the security budget: phishing-resistant authentication, patching, privileged access controls and detection all reduce the odds of a week like UHS’s. But no hospital can drive those odds to zero, and a supplier can fail without the hospital being attacked at all. Downtime readiness is the cheaper of the two investments and pays off in planned outages too.

The case against shutting everything down

A clinician could reasonably argue that shutting systems down causes more immediate harm than the malware would. The trade-off is real. A precautionary shutdown stops spread but guarantees disruption. Keeping systems running risks a far worse, uncontrolled outage and possible tampering with clinical data. The answer is to decide in advance, with clinical leaders present, which systems can be isolated rather than switched off, and who makes the call at 3 a.m.

All of this points the same way. Downtime readiness is a clinical operations competency that belongs on the same dashboard as infection control and staffing, with a named executive owner, rather than a technical appendix to the IT disaster recovery plan.

The test of a real plan

The practical test of readiness is short. A unit should be able to run a full shift, including a medication pass and a shift handoff, without its electronic systems, on a weekend night with normal staffing. The hospital should then be able to put that shift’s paper back into the record within a set time. If any of that fails, the plan on file is not the plan that will run.

The test should be specific. Pick a time such as 2 a.m. on a Sunday, assume every screen has gone dark, and ask how each unit would give medications safely for the next week. For behavioral health units, observation rounds and restraint documentation need to have been tested on paper as well as written down. And during a staged return, every unit should know in advance which record is authoritative.

How plans usually fail

Plans tend to fail in the same few ways. They assume an outage of hours, so forms run out, summaries go stale and staff tire on day three. They are drilled for minutes, and a fifteen-minute tabletop discussion does not reveal what a twelve-hour paper shift does. Downtime viewers and summaries run on the same network as everything else and fail with it. Nobody plans or staffs back-entry, so the backlog lands on the same nurses who just carried the outage. And when readiness is treated as IT’s problem, nobody on the ward owns it.

Exercising with partners

A hospital cannot test its plan alone. Ambulance services need to practice receiving diversion notices. Reference labs and blood suppliers need to know how orders will reach them. The record vendor and the managed security provider need to rehearse their roles in a restore. A yearly exercise that brings in at least some of these partners shows where the hand-offs fail, before a real event does.

Measures worth tracking

• The share of staff per unit with a drilled downtime shift in the past year.
• The age of the most recent downtime summary on each unit, checked at random times.
• Days of paper forms on hand for a week-long event, by unit.
• Time for the incident commander to reach every unit manager through out-of-band channels in a test.
• Hours to complete back-entry after a planned downtime, as a proxy for capacity in an unplanned one.

Each measure has an owner: unit leaders for the first and third, informatics for the second, emergency management for the fourth, and health information management for the fifth.

Readiness the board can check

A board does not need to know how an interface engine works. It does need a few answers that show whether the four parts are in place.

• What share of nurses on each unit have worked a full, drilled downtime shift in the past year?
• Where are our downtime summaries stored, how fresh are they, and could the same attack reach them?
• How would we reach staff across all our sites if email, paging and phones were down?
• Who will do back-entry and reconciliation when systems return, and have we named them in advance?
• Which executive owns downtime readiness as a clinical capability, and when did the board last see a measure of it?

A board that hears confident answers to all five, backed by drill records and measures, can be reasonably assured that the hospital would carry a week on paper. A board that hears only about backups and firewalls has been told about half of the plan.

With hindsight

More attacks on U.S. health systems followed. In late October 2020, only weeks later, CISA (the federal Cybersecurity and Infrastructure Security Agency), the FBI and HHS jointly warned of an increased and imminent ransomware threat to hospitals. The advisory named Ryuk and the TrickBot malware used to deliver it. A joint warning from those three agencies was a clear signal that the risk was not confined to one company.

Earlier that month, Microsoft and partners had used a court order to disrupt TrickBot’s infrastructure. The operators adapted, and attacks on hospitals continued. Disruption bought time without removing the threat, a pattern repeated with later ransomware groups.

UHS itself reported in its annual filing that applications had been restored at its acute care and behavioral health hospitals. It said it had found no evidence of unauthorized access to patient or employee data. It also continued to list cyber incidents as a material risk to its business.

Ryuk’s operators were widely linked by researchers to the later Conti ransomware group. In May 2021, Conti struck Ireland’s national Health Service Executive, forcing hospitals across the country onto paper for weeks. That attack showed the UHS pattern at the scale of a whole national health service.

Several large health systems suffered multi-week electronic record outages in the years that followed. Scripps Health in California spent weeks on downtime procedures after an attack in 2021. CommonSpirit Health was hit in 2022, and Ascension in 2024, each with weeks of disruption across many hospitals. Each case repeated the UHS pattern: paper charting, diverted ambulances, slowed pharmacies and a long tail of back-entry.

The 2024 attack on Change Healthcare extended the problem to shared infrastructure, pushing providers and pharmacies back to manual claims and prescription workflows they had not used in years. That episode showed that a hospital can be thrown into downtime without being attacked itself, simply because a company it depends on has gone dark. UnitedHealth Group later said the breach affected the data of roughly 190 million people. Federal officials responded to the cash-flow crisis among providers by offering accelerated and advance Medicare payments, a sign of how far a single supplier outage reached into hospital finances.

Extended downtime is now treated as a realistic scenario, and recovery often takes weeks. HHS’s voluntary cybersecurity performance goals for the health sector, published in January 2024, emphasize incident planning and preparedness. In January 2025, HHS proposed changes to the HIPAA Security Rule that would, among other things, require written procedures to restore certain critical systems and data within 72 hours. The proposal drew strong objections from hospital groups over cost, and organizations should check its current status with counsel.

What was once a binder on a shelf has become something regulators and boards expect to see exercised.

The organizations that have fared best treat downtime as a clinical operations competency, with regular drills, protected downtime data, out-of-band communications and staffed plans for back-entry. None of the four is expensive in the way new technology is expensive. They mostly cost time, attention and leadership.

What has held up less well is the assumption that downtime is a single-hospital problem. Consolidated networks share identity systems, record instances and data centers, so one attack can take down dozens of hospitals at once, as UHS showed. Planning that stops at the hospital door misses the network effect.

Resilience lives on the ward as much as in the data center. Prevention matters, and so do backups. But when the screens go dark, what keeps patients safe is a nurse manager who has run this before, a team that knows the paper forms, and a plan for putting it all back. Those can be built in advance, and they cannot be built during the outage.