Ascension hospital in Indy struggles to provide some care after ransomware attack

Just four days after Ascension St. Vincent's operations were upended by a ransomware attack earlier this month, Mark Hammond, 74, was admitted to the health system's flagship hospital on 86th Street in Indianapolis for life-threatening symptoms.

Quickly, his family, including his daughter who is trained as a nurse, realized that things were going very wrong. What typically should have been a weeklong treatment for a blood clot and bacteria in his blood has dragged on into an 11-day stay and counting. Throughout Hammond's time in Ascension St. Vincent, he has watched as his health care providers have struggled to determine the best way to help him heal. Doctors and nurses couldn't access his electronic health records, which spell out instructions for imaging tests that are safe since he has a medical device implanted in his heart. His caregivers could not make necessary decisions about what dosage of medicine he needed without rapid lab results, and the lab was delayed due to the hack, his family said.

"I've been here for too long," Hammond said from his hospital room Tuesday. "This is costing me every day for something that's not my fault."

Since the ransomware attack on May 8, doctors, nurses and other staff across Indiana and 18 other states have lost access to important health care technology. In the absence of computer records, they have turned to keeping medical records, prescriptions, vital signs, doctors notes and other key information on paper and in binders, according to patients and employees at the network. The massive change in workflow has delayed everything from lab work and imaging results to discharging patients and sending prescriptions to pharmacies.

The situation has most affected people with complicated cases requiring inpatient care, like Hammond. Patients who have routine appointments with primary care or specialists or patients with straightforward health care needs may not see a significant change in their care. Ascension said the situation may change day by day as hospital officials work to restore technology.

Ascension has warned patients that there may be delays and rescheduled appointments but has declined to provide specifics about changes in the way providers deliver care.

"We are also working diligently on our restoration efforts. We are making progress, however, it will take time to return to normal operations," an Ascension spokesperson said in an email. "As systems and services come back online, we will share those updates so that our patients and communities can plan accordingly."

Hospital workers scrambling

The tectonic shift to paper and fax from bedside technology has put some health workers, who already feel spread thin, on edge and in fear of making critical mistakes.

The wrong dosage. The wrong vital sign. The wrong diagnosis.

"A simple task that is crucial to patient care is now a long process with a lot of room for error," said one nurse at Ascension who asked not to be identified because she fears losing her job.

"The consensus among all of us are bad things are going to happen."

While some veteran health care providers may remember days before computers, it's been a decade or two since that was a routine practice at hospitals.

The lack of health information and records, which are critical for diagnosis and treatment, can "cause a lot of harm," said Tinglong Dai, a professor at Johns Hopkins University's Carey Business School with expertise in health care operations.

"You're shooting in the dark," he said.

Although they have little control over the situation, patients and insurers are often left paying for the delays and extended stays, Dai said.

Staff need more help

In recent years, two Ascension health workers said, they would turn to paper charts for several hours during scheduled down times, when technology required an update. Then it was back to normal.

Whenever staff have to resort to paper, charting takes far more time than with computers, time that nurses and other providers just don't have, employees say.

"Staffing is really tight and has been tight," she said. "... Now is not the time to have unsafe staffing."

Over the past few harrowing days, said another provider who spoke anonymously due to fear of losing her job, the team has figured out workarounds. However, she expressed surprise that the hospital has continued to accept high-risk cases despite the challenges.

Health care has become a lucrative target for cyber criminals because such facilities have massive amounts of personal data, making them easy to extort or sell for profit, said John Nicholas, a professor at Ball State University with expertise in cybersecurity.

Attacks like these on hospital systems are becoming more common. Last year, Community Health Network had a data breach. In 2021, Eskenazi Health suffered a ransomware attack.

Cyberattacks have become so common in health care that the U.S. Department of Health and Human Services announced this week it would invest $50 million to develop tools to protect hospitals from such attacks.

Some may not notice a difference

But not everyone is experiencing a change in care.

Sue Squiller wouldn't have known anything was wrong during her May 9 doctor's appointment, the day Ascension announced it had been hacked, if her doctor didn't take notes by hand during it.

The discharge was fast and she picked up her medication from CVS without delay.

While she is worried about inpatient delays in the future, she said she will continue to seek care at the health system.

"I do feel confident in them," she said.

Ascension told patients that doctors' offices and urgent care clinics are open but patients may experience delays. The network recommended patients bring in notes on symptoms and a list of medications, including prescription numbers or bottles.

The network's retail pharmacies can't fill prescriptions, so providers are looking for alternatives.

The network is updating the latest information for patients on its website: https://about.ascension.org/cybersecurity-event/regional-pages/indiana

Patients are left waiting

On Monday, eight days after Hammond was admitted, he finally got an MRI scan he needed to see whether the bacteria in his blood affected his other organs.

Rebekah Hammond White, Hammond's daughter who works in health care, said that the delay is dangerous for someone in his condition. About eight years ago, Hammond had sepsis, a serious complication to an infection and his family worries he has the same infection now.

"He could have bacteria in his spine," White said, adding that an infection could lead to paralysis, heart failure and even death. They're still waiting for the MRI results, White said.

Because delayed lab work meant he couldn't take fast-acting medication, he instead was prescribed a more expensive antibiotic that he will likely have to continue to taking even after he is discharged.

But Hammond does have one thing on his side. His family, familiar with his medical history, has been advocating for him at the hospital. White drove up from Texas and took family leave from her work.

"I got a call from my sister on Monday morning, 'I need you up in Indiana,'" she said. "No one was listening to her."

Wednesday is the 11th day since Hammond was admitted and he still isn't sure when he will be discharged.

Binghui Huang can be reached at 317-385-1595 or Bhuang@gannett.com

This article originally appeared on Indianapolis Star: Ascension St. Vincent still seeing care delays after cyber attack