Cyberattack disables computer systems, electronic services for Appalachian Regional Healthcare

McDowell ARH Hospital-McDowell, Kentucky

Appalachian Regional Healthcare, a hospital system in Kentucky and West Virginia, is operating without electronic services after a virus-based cyberattack disabled its computer systems and electronic communication devices.

Federal authorities are investigating the breach, which has been ongoing since Saturday. Systems still appear to be down, including voicemail, according to an employee who answered the phone there Thursday.

So far it is unclear whether any patient information was compromised, but for right now the system says it does appear any information was stolen. ARH shut down their computers to prevent further spread of the virus.

"ARH would like to emphasize that we presently have no reason to believe that the protected health information or any financial information of our patients or employees has been accessed. Please be assured that ARH will investigate this fully, and will take prompt action to notify and protect patients and employees if it appears that their private information has been accessed."

[Also: Banner Health huge cyberattack, up to 3.7 million people affected]

The hospital is currently working on an Emergency Operations Plan in which all patient-care, registration, medication, imaging and laboratory services are being handled manually. Critical patients were being assessed to determine whether they should be transferred to another facility, and advised that anyone coming in for care that administrative processes could take longer than usual.

"ARH is closely monitoring patient care processes during this time to determine when areas might require extra staff and resources to make the patient care process as smooth as possible. When visiting our facilities all patient-care, registration, medication, imaging, and laboratory services are being handled manually, which could result in the process taking slightly longer than when relying on computers for such processes. To help expedite this process, ARH asks that any patient bring prescribed medications and any medical history information with them when visiting physician practices or the emergency department."

[Also: As count of cyberattacks swells, healthcare orgs seek extra insurance against losses]

It's not entirely clear which locations have been affected by the breach, but the system said eastern Kentucky and southern West Virginia locations are open.

Calls for comment have not been returned. There is no word on whether any kind of ransom has been demanded.

Twitter: @BethJSanborn