[BreachExchange] Canada Hospital Enters EHR Downtime After Discovering Computer Virus

[Audrey McNeil]

https://ehrintelligence.com/news/canada-hospital-enters-ehr-downtime-after-discovering-computer-virus

Health Sciences North (HSN) and 20 other hospitals across Ontario, Canada
recently entered into a period of EHR downtime following the discovery of a
computer virus affecting the hospitals’ MEDITECH EHR system.

HSN officials initiated the stint of EHR downtime as a preventative
measure, according to Sudbury.com.

Hospital officials shut down 75 percent of its computer network as part of
an effort to contain the security incident, called the Zero-Day Virus. The
hospital first noticed problems with its EHR system at 8 am Tuesday.

The virus and resulting period of EHR downtime contributed to longer wait
times for patients visiting the hospital’s emergency department.
Additionally, some elective procedures and surgeries within 48 hours of the
breach were rescheduled.

While the virus has affected hospital operations, HSN CEO Dominic Giroux
stated in a series of tweets that there exists no evidence to suggest the
privacy of patient information has been breached.

In addition to HSN, 23 other hospitals across Northeastern Ontario have
been affected by the virus. The virus is not a ransomware attack, according
to hospital officials.

All told, 21 of the 24 affected hospitals have shut down their MEDITECH EHR
systems as part of an effort to protect patient health information. A
separate EHR system used for cancer treatment at 12 affected hospitals has
also been shut down as a result of the virus. The virus also affected back
office emails and servers at four Ontario hospitals.

HSN began working to restore its EHR system on January 18, and rescheduled
several chemotherapy and radiation treatments that were cancelled following
the security incident.

The virus also affected radiation treatments at Sault Area Hospital (SAH).
According to SooToday.com.

“At this time, Sault Area Hospital is experiencing some disruption in
service at our Algoma District Cancer Centre,” SAH Manager of
Communications and Volunteer Resources Brandy Sharp Young told
SooToday.com. “The Algoma District Cancer Centre is a satellite clinic of
the North East Cancer Centre at Health Sciences North. HSN’s technical
difficulties are resulting in delays in treatment for some patients
receiving radiation treatment.”

Hospital IT staff across the HSN network and Sault Area Hospital have been
working with a third-party IT security company to restore affected parts of
the EHR system. The team also installed patches and new anti-virus software
to resolve the breach.

“We apologize for any inconvenience this may cause our patients,” stated
Sharp Young. “We are working closely with HSN to support them while their
IT issues are being resolved. Once we are able to reconnect to HSN, we will
notify our patients.”

“All other areas of SAH remain open and accessible to the public,” Sharp
Young added.

HSN successfully contained the computer virus by January 19, according to
North Bay Nugget.

The health center is currently working to restore hospital operations to
normal.

“This has created significant disruption across the hospital,” HSN Senior
Vice President In Charge of Patient Experience and Digital Transformation
Mark Hartman told North Bay Nugget. “It’s going to take some time to be
completely back to normal. We do expect most of the core services will be
back to a normal schedule by the end of the weekend.”

Patients receiving treatment at North Bay Hospital as part of the North
East Cancer Centre at Health Sciences North rescheduled treatments for the
weekend as a result of the breach.

“As a result of the technical difficulties, NBRHC’s satellite chemotherapy
clinic was cancelled Wednesday, Thursday and Friday of this week,” said
North Bay Hospital spokeswoman Kim McElroy. “To minimize the impact on our
patients, arrangements have been made to reschedule these patients for
treatment this weekend.”

Hospital officials maintain the virus was not a deliberate attack on Health
Sciences North.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20190122/cc75e980/attachment.html>