UF Health Cyberattack Now Affecting Patient Care

A May 31st cyberattack on the University of Florida Health Leesburg Hospital and The Villages Regional Hospital led to EHR downtime, forcing clinicians to use pen and paper to document patient care. But recent employee reports to local Orlando news outlet WESH 2 News reveal that patient care is also being negatively impacted.

In light of the attack, the hospital’s IT staff shut down EHR systems after witnessing unusual activity. As of June 14th, employees were still using pen and paper and were experiencing delays in obtaining necessary lab reports.

WESH 2 News confirmed that the event was a ransomware attack in which employees received a phishing email resulting in locked records and a ransom demand. It is unclear whether UF Health plans to pay the ransom.

Both employees who spoke to WESH 2 News, identified only as “David” and “Andrea,” claimed that without access to patient records, they are unable to identify patient allergies and medication lists.

"God forbid that we administer something that we thought was ordered or wasn't ordered and something happens and there is a bad outcome," said David.

"We are missing medications that are due, and I have personally talked with other people who said patients were getting one medication when a different one was ordered.”

Both of the targeted hospitals had older computer systems than other UF Health hospitals, and the hospital has yet to confirm whether newer systems will replace the outdated ones. Hospital staff has resorted to calling pharmacies to obtain patient prescription information.

In a June 8th update sent to employees, the hospital said that one of its top priorities is reminding staff that “it is very important that the right lab reports are placed in the appropriate patient’s chart.”

"These are critically ill patients. They are the sickest of the sickest," Andrea commented. "And they are on life and death type of medications."

In a statement to employees, the hospital system’s CEO asserted that he does not believe patient records have been shared or compromised.

“As a team of dedicated and caring medical professionals, we understand that at its core, health care is about people taking care of people, and we remain committed to continuing to provide exceptional care to our community,” a hospital spokesman told the local news outlet.

This breach is the latest in a string of ransomware attacks being inflicted on hospitals across the nation. A recent phishing attack on Five Rivers Health Centers in Ohio impacted the data of 156,000 patients.

In addition, an Elekta data breach revealed Social Security numbers, birthdates, addresses, and treatment details of patients at the Cancer Centers of Southwest Oklahoma recently. The breach may have impacted more than 40 other healthcare organizations.

In other news, IT security company chief operating officer Vikas Singla was indicted on June 8th on 18 counts of aiding and abetting a 2018 cyberattack on Gwinnett Medical Center in Georgia. The case is still being investigated by the FBI. The cyberattack disrupted printer and phone services in an effort to obtain information for financial gain.