AnMed closed its offices on Monday and reopened them on Tuesday under downtime procedures as employees use paper-based records and other manual processes to continue providing care. In the meantime, the healthcare organization has been using transfers, diversions and triage to manage the impact on operations while cybersecurity experts work to secure its systems.
This incident serves as yet another reminder that ransomware-related cybersecurity incidents can disrupt the critical operations of healthcare organizations long after the initial financial and technological repercussions.
Without access to electronic health records and other digital applications, clinicians may find it much harder to access patient health information or make timely decisions, which increases the likelihood of diagnostic and treatment errors. A similar consequence can also be observed in pharmacies, where the inability to access digital databases and communication platforms can cause delays in dispensing medication.
AnMed has opened phone lines for patients to request prescription refills while its normal operations are suspended, and it has asked patients to rely on its online portal for more information about the closure.
AnMed has revealed limited information about the ransomware incident, confirming that it is a cyber security incident involving malicious software while noting that it is working with federal and state officials to secure its network and resume normal operations.
The healthcare organization has not commented on how the ransomware infiltrated its system or if patient data was compromised or encrypted.
The ransomware attack comes at a time when healthcare organizations are being targeted with unprecedented cybersecurity aggression worldwide. Cybercriminals are increasingly using ransomware to interrupt the critical operations of healthcare organizations by encrypting or stealing patient data and threatening to make the information public unless a ransom is paid.
Threat actors typically infiltrate healthcare systems through phishing attacks, compromised credentials, insecure remote access tools, or system vulnerabilities before deploying ransomware or encrypting data to demand payment of a ransom.
Healthcare systems and organizations can be especially vulnerable to such an incident, considering the fact that they cannot halt their operations to mitigate the ransomware attack or contain it while working to restore normal operations. Hospitals and clinics typically rely on interconnected systems that facilitate the exchange of patient health information and other operations, including scheduling, laboratory tests, pharmacy operations, billing and communication platforms.
All these systems and applications can be disrupted during a ransomware attack, forcing medical professionals to rely on manual, paper-based alternatives.
Cybersecurity experts typically recommend multifactor authentication, regular software updates, network segmentation, monitoring, security awareness training and offline backups to secure interconnected systems and ensure business continuity following a ransomware attack.
However, those measures cannot offer absolute protection, which means that organizations need to respond appropriately to ransomware incidents while strengthening their defenses. It is increasingly evident that ransomware incidents are no longer just technology issues but also patient safety ones.
That is why healthcare organizations should focus on responding to ransomware incidents by identifying the point of infiltration and ransomware type, isolating affected systems and applications, determining if any patient data was compromised, and taking appropriate mitigation steps.
