Cyberattack cripples UMMC systems, forces clinic closures

Um, I’m Louann Woodward, vice chancellor here at the Medical Center, and with me, I have Doctor Alan Jones, who’s the Associate Vice Chancellor for Health Affairs, and Mr. Rob Ickoff, who is the Special Agent in Charge with the FBI locally. So we are Pleased to have assistance from the FBI here. So, this morning, early this morning, we sustained *** cyberattack, which impacted our IT network and many of our systems, including our electronic medical record, Epic. We have triggered plan This impacts all medical center locations. We have canceled clinics and any elective procedures for today, and those will be rescheduled. Patients in our hospital and in our emergency department are being cared for. Clinical equipment and operations remain functional. We are using our downtime procedures. For our students, in-person classes will continue as scheduled. We have notified appropriate authorities and other specialists about this breach, including the FBI, Homeland Security, the US Cybersecurity and Infrastructure Security Agency. We have communicated to local hospitals, health systems, and ambulance providers. The attackers have communicated to us and we’re working with the authorities and the specialists on next steps. We do not know how long this situation may last. At this time we do not know how long this will continue. As *** precaution, all of our IT systems have been taken down. And risk assessments will be conducted before we bring things back up. There are *** lot of questions that I have that we all have that you have that we don’t know the exact answers to at this point. There’s *** lot we don’t know. The assessment is still underway, but this is the status as it stands right now. We are available for some questions, Mark, if you want to moderate that. Yes. So is this *** ransomware attack? Yes. Is this perhaps Carnegie Ransomware or *** specific brand? Or where the state At this point in the incident that it’s too early for us to communicate what we do and don’t know, but we are in the process of surging resources both locally and nationally into this incident to make sure that we are standing along. with UMMC and their vendors as we look to understand the extent of this attack and then the actions we need to take to help them on the path of recovery with our number one priority being helping them get their systems up and providing services to their patients. Say, say your name and and title just so they have that on the record. Robert Ickoff, Special Agent in Charge for the FBI office here in Mississippi. Do you know how this impacts uh patients’ privacy? So, those are the pieces that are still being determined, but as I said earlier, we have taken our systems down. We are working to mitigate all the risks that we know of. When was the last time the system was updated to try to prevent something like this from happening? So we have routine activities that happen in *** backup type, um, methodology, and that occurs every 6 hours. Uh, two pieces. One, since it’s only level 1 trauma center, what does that mean for those patients? And two, is Medcom affected in terms of coordinating care for other transfers around. So we are taking patients, we are still taking patients. Certainly those level 1 trauma patients and others that definitely need our services. We are operating in *** downtime situation, so we are trying to not take elective patients or clinic schedules at this point, but for those emergency patients that need our care, we, our emergency department is open. I don’t know if you want to add something to that. I’ll just say, uh, we have plans and processes in place. If the electronic medical record goes down, we actually take the electronic medical record down routinely for scheduled maintenance, and then we have unplanned downtime. So we have downtime procedures, so we know how to take care of patients without an EMR and you know, I can assure you that at the point of care, all of our processes are intact. All of our equipment works. Patients are being cared for safely, so there will be no patient impact as *** result of this down. So just to give you an example of that, if there’s *** patient in the critical care unit, and of course we have hundreds of patients in our critical care unit, their vital signs are still being monitored. The bedside equipment is working. It is just not connecting into the EPIC program. We’re on *** manual process right now. Some of us in the room have been here long enough that we remember taking care of patients with pen and paper. Tell me, once the ransomware attack is dealt with, how long do you expect the repercussions of this attack to be impacting UMC services? We, we just can’t answer that at this point. Yeah, Med, yeah, so Medcom operates really in *** manner in which it can be *** stand-alone operation. So we have dedicated resources that are just for Medcom so that they can continue to function. In the state of emergency, usually that state of emergency is external to UMMC if it’s *** statewide emergency, but we can use it for internal purposes. So we have dedicated phone lines and assets that MedCcom can take incoming calls about and if needed, if we need to do something to move or transfer patients, that’s all functional. We have routine systems that are affected, but we can take those down and isolate them and then use the emergency systems only.