| | November 20199UTLOOK Healthcare Tech depended on Internet access was rendered unavailable. As an example, even though our EHR remained functional, the ability for providers to electronically send prescriptions to pharmacies was temporarily impacted, and manual workarounds had to be implemented. Had the outage lasted longer, other more fundamental operational tasks would have required workarounds as well--for example, the ordering of medical supplies to maintain sufficient par levels throughout the enterprise, or even sending employee payroll information to banks.We also experienced direct attacks on exposed firewall ports and services, requiring us to shut down patient and provider portals, research projects and philanthropy sites, all as a means of protecting ourselves from these attacks. All of these actions, while necessary to ensure the security of our network, had significant disruptive effects on our communication with our patients and referring providers, research collaborators around the world, and to potential donors to our organization. Finally, we experienced a massive influx of malware-laden, spear-phishing emails, designed to provide a means for the attackers to get access to the portion of our network behind the firewall, and in turn to sensitive applications and data. We needed to ensure all malicious email was quarantined appropriately, and an alert was sent out to staff about the absolute importance of not clicking links or opening attachments unless absolutely sure that they were safe. To this end, we took a proactive step, and temporarily shut down our entire email system. As with the shutdown of our external web sites, this was an extremely disruptive action, though one which we felt necessary. Communication in a large organization is severely impacted without email, and though we all sometimes wish for an "email holiday," many critical operational functions rely on email as their mechanism for communication. It was only because we had fortuitously recently implemented a secure internal texting platform (for HIPAA compliance) that we had an alternative means of electronically communicating critical information to our staff during this email downtime period. These examples serve to highlight that strong defenses as well as operational contingency plans need to be put in place to safeguard our organizations and our ability to ensure clinical operations. Although protection of data is clearly a high priority, I submit that ensuring that we are able to effectively and safely provide care for patients is priority number one. HTDuring our anonymous attack experience, we withstood a number of different disruptions, each of which caused different operational challenges for usDaniel Nigrin
< Page 8 | Page 10 >