DNP 825 Module 6 Privacy, Security and a Breach Example

Eleven Days on Paper: A Ransomware Attack, Patient Safety and the Nursing Informatics Leader's Responsibilities

Student Name

Doctor of Nursing Practice Program, Aspen University

DNP 825: Health Information Management and Informatics

Instructor Name

Month Day, Year

Eleven Days on Paper: A Ransomware Attack, Patient Safety and the Nursing Informatics Leader's Responsibilities

Health information security was once treated as a technical matter for information technology departments. Ransomware has changed that. When attackers encrypt a hospital's systems and demand payment, clinicians lose access to records, orders, results and monitoring, and patients' care is disrupted. This paper analyzes a composite ransomware attack on a 240-bed community hospital, places it in the context of national trends, examines the effects of both the attack and the response on patient care, and sets out the responsibilities of a nursing informatics leader for prevention, response and recovery.

The Event

An employee in the finance department opened an email that appeared to come from a vendor and entered their credentials on a fake login page. Two weeks later, attackers who had used those credentials to move through the network encrypted servers supporting the electronic health record, laboratory, pharmacy and imaging systems at 3 a.m. on a Saturday. The hospital activated its downtime procedures, diverted ambulances for 36 hours, postponed elective surgery for four days and operated on paper for eleven days until systems were restored from backups. Data on about 180,000 patients were copied by the attackers before encryption, requiring breach notification to patients and federal regulators.

National Context

The composite event reflects a national pattern. Between 2016 and 2021, 374 ransomware attacks on hospitals, clinics and other U.S. care providers put the health records of close to 42 million patients at risk, and attacks per year rose from 43 to 91 over the period. Close to half of the attacks interrupted care, usually because electronic systems went down, and some caused cancellations of scheduled care or ambulance diversion. As the period went on, a growing share of attacks hit organizations with many facilities, and fewer were resolved by restoring from backups (Neprash et al., 2022).

Effects on Patient Care

The clinical effects of such attacks are measurable. After the 2017 WannaCry ransomware attack on the English National Health Service, hospitals directly infected had about 6% fewer total admissions per day during the attack week, with 4% fewer emergency and 9% fewer elective admissions, and lost activity was valued at several million pounds, although no difference in mortality was detected (Ghafur et al., 2019). In the composite hospital, nurses reported delays in medication administration because pharmacy verification was manual, difficulty knowing which results were pending, and transcription errors when orders were copied by hand.

The response to a breach can also affect care. A study of U.S. hospitals that experienced data breaches found that in the three years afterward, the time from arrival to electrocardiogram for patients with chest pain increased by as much as 2.7 minutes and 30-day mortality after heart attack rose by as much as 0.36 percentage points, which the authors attributed to remediation efforts, such as new login and access controls, that slowed clinical work (Choi et al., 2019). Security measures that ignore clinical workflow can harm the patients they are meant to protect.

Responsibilities Before an Attack

The nursing informatics leader has specific prevention responsibilities. Phishing, the entry point in the composite event and many others, is a human vulnerability, so the leader ensures that nursing staff receive practical training and simulated phishing exercises. Downtime procedures, including paper forms, medication administration records, printed patient lists updated regularly by downtime computers, and processes for manual result reporting, must be current and practiced, not only written. The leader also participates in risk assessments required under federal security rules, bringing knowledge of which systems are clinically critical and how long each unit can function without them.

Responsibilities During and After

During the attack, the nursing informatics leader coordinates clinical downtime: confirming that each unit has current patient lists, activating runners for results, establishing manual medication verification with pharmacy and prioritizing which systems to restore first from a clinical perspective. After restoration, the leader oversees reconciliation, entering paper documentation into the electronic record, checking that orders and allergies were transferred correctly, and reviewing medication errors during downtime. The leader also participates in the after-action review and in choosing security enhancements, advocating for measures such as multifactor authentication designed with clinical workflows in mind, including rapid badge-based login at shared workstations, so that security does not slow emergency care.

Lessons From the After-Action Review

The composite hospital's after-action review identified several lessons. Printed patient lists on the downtime computers were current only to the last automatic update, four hours before the attack, so admissions after that time had to be reconstructed by asking patients and staff. Some units had outdated paper forms, including a medication administration record that lacked fields for high-alert drug double checks. Pharmacy could not see which doses had been given before the downtime, so several patients received duplicate doses of scheduled medications in the first hours. And staff who had never practiced downtime relied on the few experienced nurses who remembered paper charting.

The hospital responded by increasing the frequency of downtime report updates to hourly, auditing downtime kits quarterly, adding a downtime medication reconciliation step at the start of any outage, and running a four-hour downtime drill on every unit twice a year. The nursing informatics leader now reports downtime readiness to the patient safety committee alongside other safety measures.

Privacy Obligations

Because data were copied, the hospital must notify affected patients and federal regulators within the timelines set by federal breach notification rules, and offer support such as credit monitoring. Nurses need clear guidance on how to answer patients' questions, and patient-facing communication should be plain and honest about what was taken and what patients should do.

Conclusion

Ransomware attacks on health care organizations have grown in number and sophistication and disrupt care in nearly half of cases. The composite attack, which began with one phishing email and ended with eleven days on paper, shows that security is a patient safety issue with human, technical and clinical dimensions. Evidence that both attacks and poorly designed remediation can harm care places nursing informatics leaders at the center of prevention, downtime response, recovery and the design of security that protects patients without slowing their care.

References

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Ghafur, S., Kristensen, S., Honeyford, K., Martin, G., Darzi, A., & Aylin, P. (2019). A retrospective impact analysis of the WannaCry cyberattack on the NHS. npj Digital Medicine, 2, Article 98. https://doi.org/10.1038/s41746-019-0161-6

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873