Chicago-based CommonSpirit, the second-largest nonprofit hospital chain in the U.S., has confirmed a cybersecurity incident has disrupted medical services, IT systems and EHR systems at its facilities across the country.
Undisclosed IT incident
A CommonSpirit spokesperson told Becker's in an emailed statement on Oct. 4 that an "IT security issue" is affecting some of its affiliated facilities and that the incident has caused some patient appointments to be rescheduled and IT systems at several hospitals to be taken down.
The spokesperson did not detail what happened or if patient information was compromised due to the breach but said the health system is taking "precautionary" measures to minimize the disruption.
Patients are being notified by their provider if their appointments are being affected, according to CommonSpirit.
Extent of the disruption
CommonSpirit's Nebraska-based subsidiary, CHI Health, reported IT system and EHR outages across its Omaha hospitals, including Lakeside Hospital, Creighton University Medical Center-Bergan Mercy and Immanuel Medical Center.
In addition, some surgeries have been delayed at CHI Health facilities due to the cybersecurity incident.
One CHI Health patient who was scheduled for a colonoscopy Oct. 3 was told his appointment was canceled upon arriving at the hospital.
"We drive to Bergan Mercy, go in the procedure center, walk up to the front counter, and I'm like 'I'm here to check-in,' and there was some stammering and stuttering and they're like, 'Well all the procedures have been canceled today,'" the patient told NBC affiliate WOWT.
Seattle-based Virginia Mason Franciscan Health providers, including St. Michael Medical Center and St. Anthony Hospital, have also been affected.
One woman who had taken her sister to get treatment at St. Anthony Hospital told the KitSap Sun that staff members at the hospital were unaware of her appointment and that the hospital "can't put anything in the computer."
The woman further explained that medical providers were shifting to a makeshift paper system of record keeping and using phones to connect with other providers and insurance companies.
Another affiliate, MercyOne Des Moines Medical Center, also had to shut down some of its IT systems, including access to its EHR system.
This incident also caused MercyOne to divert ambulances from its emergency department to other medical facilities for a short period of time Oct. 3.
Houston-based St. Luke's Health IT systems and patient appointments have also been affected.
A nurse at St. Luke's, who asked to remain anonymous, told KHOU that some facilities are fully paper charting at the moment, with some patients' lab work not being processed, and their appointments are being canceled.
CommonSpirit operates 140 hospitals and more than 1,500 other healthcare sites across 21 states.
CommonSpirit said it would continue to provide Becker's with updates on the incident.