Anatomy of a Cyberattack: Part 3: Coordination in Crisis, Development of an Incident Command Team, and Resident Education During Downtime

Abstract

Objectives: Our institution was subject to a multi-institutional, systemwide cyberattack that led to a complete shutdown of multiple major patient care, operational, and communication systems for more than 25 days. The electronic health record computer system was taken offline, as was the hospital email and authentication systems, internet access, and the laboratory information system. The impact on the hospital and patient care was substantial, and our laboratories were crippled.

Methods: Our laboratory endured challenges in communication because of the loss of connectivity and difficulties in laboratory management, and we recognized a need to restructure leadership to maintain operations during the crisis. As an academic institution, residents and trainees were also significantly affected by the disaster.

Results: We developed an incident command team (ICT), alternative methods of communication, and innovative management strategies to remain operational. Trainees were incorporated into the disaster-relief efforts, with negative impacts on resident education.

Conclusions: This paper focuses on the challenges in communication and lab management as well as the need for an alternative leadership structure during the crisis. We also highlight the unique experience of our trainees during this prolonged downtime, underscoring the importance of incorporating resident trainees into the daily ICT's administrative activities as an invaluable lab management experience.

Keywords: Coordination; Cyberattack; Downtime; Incident command; Lab management; Malware; Ransomware; Resident education.