Ransomware attacks and patient mortality: 8 things to know

Report findings and a current lawsuit allege that ransomware attacks and patient outcomes have a direct link.

Eight things to know:

1. A team from the Cybersecurity and Infrastructure Security Agency launched a study to determine if there is a link between ransomware attacks and patient deaths. Early CISA findings suggest that once an area had a certain percentage of intensive care unit beds filled, it was more likely to see excess deaths two to six weeks later — known as the inflection point.
   
   
2. The CISA looked at the excess death data in Vermont during an October 2020 ransomware attack on the UVM Health Network in Burlington. The team found that during the same time period, hospitals affected by ransomware reached the inflection point between two and six weeks faster.
   
   
3. A report by the Ponemon Institute surveyed 597 IT and IT security professionals in healthcare delivery organizations to analyze how COVID-19 and ransomware attacks have affected healthcare delivery. Twenty-two percent of healthcare organizations reported increased mortality rates resulting from ransomware attacks.
   
   
4. Seventy-one percent of survey respondents said ransomware attacks cause patients to have longer lengths of stay. Seventy percent of respondents said the attacks cause delays in procedures and tests that result in poor outcomes.
   
   
5. More than one-third (36 percent) of respondents said there was an increase in complications from medical procedures after a ransomware attack.
   
   
6. A lawsuit alleges a July 2019 ransomware attack on Springhill Medical Center in Mobile, Ala., resulted in a baby's death. Amid the attack, the hospital said it was operating without the full function of its computer systems. Springhill shut down its network for nearly eight days because of a ransomware attack.
   
   
7. The attack allegedly is linked to the first hospital death caused by a ransomware attack if the suit holds up in court.
   
   
8. The hospital has denied wrongdoing. Jeffery St. Clair, CEO of Springhill Medical Center, told The Wall Street Journal, "We stayed open and our dedicated healthcare workers continued to care for our patients because the patients needed us and we, along with the independent treating physicians who exercised their privileges at the hospital, concluded it was safe to do so."