St. Joseph’s/Candler Suffers Ransomware Attack, EHR Downtime

St. Joseph’s/Candler (SJ/C), a large hospital system in Savannah, Georgia, suffered a ransomware attack on June 17th, according to a report by local news station WSAV. The attack led to EHR downtime, and all documentation is being done on pen and paper until the attack is contained.

Computers went down at 4:00 AM on Thursday morning. St. Joseph’s/Candler has not canceled any imaging, primary care, surgery, or special physician appointments, but has requested that oncology patients contact their doctors to check on appointment and procedure status.

In a statement posted to Facebook on June 17th, the hospital stated: “On the morning of June 17, St. Joseph’s/Candler became aware of suspicious network activity. As a security measure, SJ/C took immediate steps to isolate systems and to limit the potential impact.”

“We also promptly initiated an investigation into the scope of the incident, which is ongoing and in its early stages, although SJ/C has confirmed that the incident involved ransomware. Law enforcement has been notified. If we determine that personal or health information is involved in this incident, we will notify those individuals in accordance with applicable law.”

Law enforcement is still actively investigating the ransomware attack, and it is unclear how long the hospital’s systems will remain in downtime.

“Nothing is more important to us than continuing to provide the care our patients expect. Patient care operations continue at our facilities using established back-up processes and other downtime procedures,” the hospital’s statement continued.

“Our physicians, nurses and staff are trained to provide care in these types of situations and are committed to doing everything they can to mitigate disruption and provide uninterrupted care to our patients.”

Cyberattacks on the healthcare industry are becoming more commonplace and can even impact patient care. Employees reported that a May 31st attack on the University of Florida Health Leesburg Hospital and The Villages Regional Hospital is now negatively impacting patient care by causing confusion over lab reports and incorrect prescription information.

In order to combat a string of ransomware attacks across multiple industries, President Biden recently issued an executive order outlining steps that must be taken to improve the country’s cybersecurity. In addition, the new Ransomware and Digital Extortion Task Force aims to address threats to the growing number of ransomware attacks.

The FDA recently voiced concerns over medical device cybersecurity in a paper responding to NIST’s request for comments on President Biden’s executive order, further conveying the government’s intention to use its extensive resources to prevent additional ransomware attacks.

“Publicly noted cybersecurity incidents in 2021 include ransomware disabling the Irish Healthcare Service, ransomware disrupting a hospital for weeks, and a fundamentally new problem where ransomware remediation disrupted the cloud services necessary for critical function of cancer radiation therapy rather than simply disrupting electronic health record systems and other, more traditional hospital IT infrastructure,” the FDA emphasized.

In addition, the National Institute of Standards and Technology (NIST) released a preliminary draft of its “Cybersecurity Framework Profile for Ransomware Risk Management.” The draft provides organizations with a step-by-step approach to preventing and responding to ransomware attacks. NIST identifies preventative measures and recovery tactics that can be adopted by any organization to mitigate the damage done by a cyberattack.