What Sutter Health's computer outage teaches healthcare about EHR vulnerabilities

After a communications outage struck Sacramento, Calif.-based Sutter Health, knocking out access to its EHR, a Medscape report shines light on the frequency of these events in healthcare and the need to prepare for them.

Sutter's outage lasted for more than 24 hours, and during that downtime, staff reverted to paper-based charts. As a result of the outage, some elective surgeries were delayed or rescheduled.

An investigation revealed a fire-suppression system activated at one of Sutter's data centers triggered the outage. Sutter hasn't disclosed what activated the system, but noted it was neither a fire nor a data breach, and no property had been damaged.

Outages, like the one that affected Sutter, are a relatively common occurrence in healthcare, according to a 2014 study led by Dean Sittig, PhD, a professor at the University of Texas Health's School of Biomedical Informatics. Dr. Sittig's team found nearly all (96 percent) of the 50 large, integrated institutions surveyed experienced at least one unplanned system downtime in the past three years.

In Sutter's case, Dr. Sittig explained that when a fire-suppression system is activated, an alarm sounds and forces people out of the room. The system then locks all doors and sucks the oxygen from the room to replace it with fire retardant gas that must be flushed out before the computers can be restarted — a process that could take a minimum of four to six hours.

That downtime isn't cheap, either. "A big hospital probably loses at least $1 million per hour when they're down," Dr. Sittig said, suggesting hospitals invest in the right insurance policies to address any unforeseen downtime costs.

Andrew Gettinger, MD, chief clinical officer for HHS' ONC, told Medscape it is important that all health systems have backup plans. He noted the Joint Commission's recommendations for annual disaster drills as an important consideration. However, he said physicians and patients shouldn't be too worried about downtime.

"It's no different from what happens when the power in the building goes out or the water supply goes out or you're no longer able to get compressed oxygen or nitrous oxide," he told Medscape.

All hospitals should review the Safety Assurance Factors for EHR Resilience guidelines, which focus on EHR safety, Dr. Gettinger added.

Click here to access the complete Medscape report.

More articles on EHRs:
New AMA policy encourages EHR training in medical schools
The Sequoia Project updates patient matching framework
Epic adds HealthPay24 payment tool to App Orchard

© Copyright ASC COMMUNICATIONS 2019. Interested in LINKING to or REPRINTING this content? View our policies by clicking here.

 

Top 40 Articles from the Past 6 Months