UMMC reopens clinics shut down by ransomware attack as recovery progresses
A Feb. 19 ransomware attack on the University of Mississippi Medical Center (UMMC) left it operating on paper backups, forced to close its clinics across the state. On Monday—over a week later—the health system was finally able to reopen them and address its patient care backlog.
In an update posted to Facebook on Friday, UMMC said its clinics “will resume normal operations and scheduled appointments,” but it added that it’s still dealing with the effects of the breach of its network.
That cyberattack, committed by as-yet unknown actors, resulted in its Epic electronic health record system being taken offline. Communication systems were also shut down, including emails and phones.
As a result, UMMC had to prioritize emergency care, and ended all elective services. This includes shutting down all its clinics until further notice.
To make up for lost time, the health system said its now reopened clinics will operate on “extended hours and extra days to accommodate patients as soon as possible,” as it looks to reschedule patient primary and specialty care appointments.
In a separate update posted Monday, UMMC said its phone lines were once again operational, allowing it to reach out to patients directly regarding canceled service dates. It was the first mention that communications were back online since the cyberattack occurred on Feb. 19.
Slow, steady progress
With its hospitals having limited interaction with the outside world beyond patients showing up at their doorstep, UMMC alerted people to an automated triage phone line they can use for time-sensitive needs, including urgent care.
The post, dated Feb. 25, says this care would be scheduled as a clinic visit, implying they were still operational during the shutdown, albeit at a very limited capacity.
At that time, UMMC set a goal of Monday for them to reopen to the public, a target window it seems it achieved.
Full recovery will still take some time, it added, as it is still necessary to fully restore its EHR access and bring patient records up to speed by merging backups into primary records.
The data breach is still being investigated by authorities. How a nefarious third party was able to deploy ransomware is unknown, as is the scope of their access.
It’s also not clear at this time if sensitive patient data was taken during the attack. If accessed, UMMC will be required by federal law to notify victims. However, that won't happen until investigators have finished looking into all then details surrounding the incident.
This is a developing story.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.