Ascension hopes to restore a key medical records system by June 14, weeks after cyberattack (2024)

Hospital system Ascension said Tuesday that it hopes to restore a system that's key to its operations by the end of next week nationwide, more than a month after a ransomware attack caused ongoing disruptions to patient care and concerns about patient safety.

The electronic system that contains patients' medical records has been largely inaccessible since the May 8 cyberattack that hit Ascension, one of the country's largest nonprofit health systems with some 140 hospitals and hundreds of clinics across Wisconsin and more than a dozen other states.

Without that system, health care workers at Ascension cannot see patients' medical history, current medications, allergies or other critical medical information. They cannot communicate like they used to across hospital departments and have limited or no ability to see patients' prior labs, imaging and test results.

That ultimately has resulted in major disruptions to patient care over the last month, including canceled appointments; delays in getting cancer treatment; hold-ups in getting labs, imaging and test results that mean delays in treatment; and long wait times for care, according to patients and health workers. Patients have been unable to use MyChart, the online platform for patients to make appointments, check labs and test results, and talk with their physician.

In recent days, Ascension has made progress in restoring access to patients' medical records, and on Tuesday, the health system announced it had restored access in its Alabama, Florida, and Austin, Texas markets.

Jacksonville, Florida, was the first place to have its access restored on Tuesday of last week, according to a message sent by a Milwaukee hospital official and obtained by the Milwaukee Journal Sentinel.

In a press release Tuesday, Ascension said it was working to complete restoration of the electronic medical record system across all its locations by June 14.

“These developments mark a turning point in our response efforts to this ransomware attack," said Eduardo Conrado, president of Ascension, in Tuesday's release. "With (electronic health record) access restored in several of our largest markets, with the rest expected to come over the course of the week, we are moving out of downtime procedures and closer to normal course operations across our ministry."

Ascension Wisconsin retail pharmacies now open, among other strides

Though Ascension workers in Wisconsin do not have full access to patients' medical records, some strides have been made in recent days.

Ascension retail, home delivery and specialty pharmacy sites are now open and able to meet patients' prescription needs, according to Tuesday's release. That means that health care providers are able to send prescriptions electronically and can send prescriptions to Ascension pharmacies for their patients, the release said.

Also, in the last week or two, certain physicians and other medical providers at Ascension hospitals in Milwaukee have been granted limited access to a "read-only" version of patients' medical records, according to two medical providers who spoke on the condition of anonymity for fear of losing their jobs. However, not everyone had that access, and the records available were limited. The two providers reported still not being able to order labs, tests or procedures like they used to, and having to use paper to write orders.

Once access to the medical records system is restored, clinicians will be able to access patient records as they did prior to the cyberattack, according to Tuesday's release from Ascension.

"While these are promising developments in our recovery efforts, our investigation into this incident remains ongoing, along with the remediation of additional systems. This is a complex process, and it will still take time to complete," the release said.

“I am grateful for the compassion and professionalism of all our teams in response to this ransomware attack," Ascension CEO Joseph Impicciche said in the release. "Their dedication throughout our recovery efforts has been incredible, and they have continued to prioritize those who matter most, our patients."

Cybercrooks frequently target hospital systems like Ascension

The ultimate impact of the ransomware attack on Ascension and its patients is yet to be determined.

The disruptions caused by cyberattacks on hospitals can have severe consequences for patients' well-being and may lead to worse care and higher mortality rates for patients, according to academic studies and surveys of hospital information technology professionals.

In recent years, health care organizations have increasingly become a target of cyber criminals looking to cash in.

More: What is Black Basta, thought to be behind the Ascension ransomware attack?

Health care organizations are seen as attractive targets because they collect lots of personal health information and are so reliant on technology that any disruptions can have massive ripple effects, according to advisories issued by the FBI and other cybersecurity stakeholders. Health care organizations also are perceived as likely to pay ransoms and as having weak protections against cyberattack, according to a February PowerPoint from the U.S. Department of Health and Human Services.

The cyberattack on Ascension reportedly involved a type of ransomware called Black Basta, according to CNN, which cited four anonymous sources briefed on the investigation into the attack. Black Basta is also the name of a group of cyber criminals thought to be an offshoot of a now-defunct group of Russian hackers known as "Conti."

Ascension has not disclosed whether it paid a ransom.