Ascension hit by cyberattack
The attack has disrupted clinical operations for one of the largest health systems in the country.
Photo: Studio 642/Getty Images
Ascension has reported a cybersecurity attack that has disrupted clinical operations.
"At this time we continue to investigate the situation," the health system reported Wednesday. "We responded immediately, initiated our investigation and activated our remediation efforts. Access to some systems have been interrupted as this process continues."
Ascension has engaged Mandiant, a third-party expert, to assist in the investigation and remediation process.
The health system said it detected unusual activity on select technology-network systems on Wednesday that it now believes was due to a cybersecurity event. It urged its business partners to sever online connections to its system, according to the Detroit Free Press.
"We are reaching out to our business partners to ensure they are aware of the situation so they can take appropriate steps to safeguard their systems," the health system said by statement. "We encourage all business partners to coordinate with the Ascension Technology partners to address any specific questions."
It is unknown whether patient information was affected.
"Together, we are working to fully investigate what information, if any, may have been affected by the situation," Ascension said. "Should we determine that any sensitive information was affected, we will notify and support those individuals in accordance with all relevant regulatory and legal guidelines."
Care teams, which are trained for these kinds of disruptions, have initiated procedures to ensure patient care is impacted as minimally as possible, the health system said.
Ascension said it is continuing to assess the impact and duration of the disruption.
"This is an ongoing situation and we will provide updates as we learn more," it said.
WHY THIS MATTERS
The cyberattack has affected one of the largest health systems in the country, on the heels of a February ransomware attack that continues to impact Change Healthcare. Change is owned by Optum, which is affiliated with the largest insurer in the nation, UnitedHealthcare.
Change, which offers claims management, was immediately taken offline after the ransomware attack. While systems are coming back online, the disruption continues to affect hospital and physician practice revenue due to delays in claims payment.
Last week, UnitedHealth Group CEO Andrew Witty appeared before a House subcommittee to answer questions about how such a large company could have been caught off guard and without appropriate safeguards, such as multifactor authentication, or even two-factor authentication.
THE LARGER TREND
As of 2021, Ascension was the largest nonprofit and Catholic health system in the nation, consisting of 140 hospitals in 19 states and the District of Columbia.
Healthcare cyberattack risk is increasing due to an expanded threat surface, the interconnectedness of systems, as shown by the Change attack, and the incentive by bad actors to access the wealth of personal information available in medical records.
Email the writer: SMorse@himss.org
