Cyberattack forces Massachusetts hospital into ‘Code Black’
Last week’s network outage at an independent community-owned healthcare system in Massachusetts was confirmed to be the result of a cyberattack. The incident briefly caused one hospital to enter “Code Black,” signaling to the public and emergency responders that it was unable to accept emergency patients. Details are still a little fuzzy.
On the morning of Oct. 12, Heywood Healthcare posted on Facebook, claiming a “network outage” had rendered multiple systems inoperable, including Internet access, email and phone lines. Two facilities, Heywood Hospital and Athol Hospital, were said to be affected—the former so much so that it had to divert all emergency care.
By Oct. 15, local ABC affiliate WCVB 5 reported that ambulances were still being temporarily diverted, though both hospitals were operational enough to care for patients and accept a limited number of new ones.
Some services, such as radiology imaging and labs, were reported by Heywood to be locked down and unusable, contributing to hesitancy around accepting new emergency patients. However, the nonprofit health group did not say if and when those departments went back online.
It also confirmed that the intrusion on its network caused disruptions for Heywood Medical Group, its primary and specialty care services wing—though how many patients experienced care delays remains a mystery.
Its next public statement came in the form of another Facebook post on Oct. 16, in which Heywood confirmed a “cybersecurity incident” was responsible for the downtime. In that update, it added that “certain systems” were still “not currently available.”
“[Heywood and Athol Hospital] are open and safely caring for patients,” the post reassured the public. “If you have an appointment scheduled with a Heywood Medical Group provider this week and need to reach the practice, please use the Athena portal to communicate.”
“If you are unable to access the Athena portal, the answering service is open and will deliver messages to your provider. We appreciate your patience and understanding as we carry out our downtime processes,” the group added.
Heywood also said it was working with a third-party cybersecurity company to investigate the situation, assess the damage and restore operations as “quickly and safely as possible.”
However, it has since posted no further updates on its current status. Neither its website nor Facebook contains any word on the present state of disruptions.
A list of unknowns
The nature of the cyberattack—and whether or not it resulted in a data breach that exposed protected health information—is also unclear. However, the law firm Shamis & Gentile was quick to announce it was looking into the facts, paving the way for a potential lawsuit.
No known hacker cell has claimed credit for the attack and no data trove has been found on the dark web.
This is a developing story. HealthExec reached out to Heywood for more details.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.