In February, Allina Health made the strategic decision to transfer approximately 2,000 IT and revenue cycle employees to UnitedHealth Group's Optum. This move proved to be highly advantageous when the CrowdStrike IT outage impacted the organization.
"The CrowdStrike incident was a major event for us," Dave Ingham, DO, CIO of Allina Health, told Becker's. "The most significant moment was at 5 a.m. when I received a call from my chief information security officer. It's never a good sign when your security leader is calling you at that hour."
Fortunately, the Minneapolis-based health system experienced minimal direct impact on patient care. Dr. Ingham noted that for hospital patients scheduled for surgery or with clinic appointments, there were no significant disruptions to their care. However, the health system did face operational challenges internally.
"About 20% of our computers were down — what we refer to as 'bricked' or 'blue screened,'" Dr. Ingham said. "Despite this, we managed to bring most of our systems back online relatively quickly throughout the day. Although there was considerable scrambling on our end, we were fortunate that patient care remained largely unaffected."
Dr. Ingham credited the swift recovery in part to the decision to outsource to Optum.
"Earlier this year, we transitioned the majority of our IT staff to Optum employees, and this was our first major test with them," he said. "I have to say, working with them was truly impressive. From the moment we got that 5 a.m. call, they stepped up in a big way. Shortly after, we were mobilizing our teams to assess not just the impacted systems, but also any potential issues affecting frontline patient care."
Initially, Allina Health had to physically reboot every computer and remove problematic drivers, which necessitated a large number of technical experts on-site.
"Optum responded swiftly, deploying all available technical staff and even rallying volunteers from other areas within Optum — not just the rebadged or transitioned employees. These volunteers were eager to assist, helping us keep patient care running smoothly and recover our systems," he said.
Additionally, Dr. Ingham said Optum's coordination with UnitedHealth Group was a huge advantage.
"We were able to communicate with other infrastructure and security teams within Optum to align our response efforts and gauge our performance against theirs," he said. "This close communication and collaboration were invaluable in navigating the situation and determining the best path forward."
Overall, Dr. Ingham said he was quite pleased with Allina Health's response to the incident as it reinforced the effectiveness of its updated processes.
"We have a rolling update system for these kinds of situations, and the combination of that system and our robust alert mechanisms ensured the right people were mobilized even in the middle of the night," he said. "This was a key factor in minimizing disruptions to patient care."
By midday on July 19, the same day the CrowdStrike outage began affecting hospitals nationwide, Allina Health had largely returned to normal operations, including internal back-office functions.