On Saturday, May 1, 2020, barely 30 days after the highest surge of COVID inpatients, a malware attack hit Scripps Health, a five hospital, 28 ambulatory clinic system. With two trauma centers, four emergency departments and three urgent cares, the Scripps system is the second largest in San Diego County. Within two hours, the hospitals were on an internal disaster plan with bypass in place for trauma, emergency departments, stroke, STEMI and obstetrics. Both backup servers were impacted, and 90 applications were affected. Computers, phones, all clinical communication systems, monitoring, all imaging modalities, Pyxis medication equipment, the electronic medical records and every interventional platform were adversely impacted. It took almost four weeks to bring the system back online with our EMR–EPIC being brought up last on May 27, 2021 at 04:00 a.m.

This presentation will review the initial attack, management of operations, mitigation and restoration, and lessons learned.

• Initial attack focuses on systems failure and shutdown, stand up command center, communication, and messaging.
• Management of operations includes incident command, patient safety, staffing impacts, and physician issues.
• Develop clinical processes for medications, labs, imaging. Downtime procedures affected our ability to perform surgeries and procedural volumes. Tracking of census and patient movement, as well as county and state reporting and the impact to the community due to prolonged bypass.
• Mitigation and restoration reviews the 24/7 heroic IT efforts, complex planning for cutover, resource and equipment needs, and incremental applications programs restoration.
• Lessons learned puts in perspective the enormity of the impact of a cyberattack.

Learning Objectives:

• Examine the impact and process development around downtime procedures with no computer or internet capabilities.
• Identify how to plan strategically to minimize operational disruption.

Speakers:

Kimberlee Roberts, FACHE
Senior Director Clinical Services, Scripps Health

Tamara Winkler, RN, FACHE
Senior Director Clinical Services, Scripps Memorial Hospital

This session was originally presented at the 2022 Congress on Healthcare Leadership.

Continuing Education Credit

ACHE Qualifying Education Credit

This recording is eligible for 1 ACHE Qualifying Education credit.

ACHE Education credits will be automatically updated in your My ACHE account upon completion of the recording.

Interprofessional Continuing Education Credit

In support of improving patient care, the American College of Healthcare Executives is jointly accredited by the Accreditation Council for Continuing Medical Education (ACCME), the Accreditation Council for Pharmacy Education (ACPE), the American Nurses Credentialing Center (ANCC), and the American Academy of PAs (AAPA) to provide continuing education for the healthcare team.

This activity was planned by and for the healthcare team, and learners will receive a maximum of 1 Interprofessional Continuing Education (IPCE) credit for learning and change. For further information about Joint Accreditation credits and certificates, please click here.

Physician Continuing Medical Education

The American College of Healthcare Executives (ACHE) designates this live activity for a maximum of 1 AMA PRA Category 1 Credits^™. Physicians should claim only the credit commensurate with the extent of their participation in the activity.

Continuing Nursing Education

The American College of Healthcare Executives designates this live activity for a maximum of 1 contact hours of continuing nursing education.

Continuing Pharmacy Education

The American College of Healthcare Executives designates this knowledge-based activity for a maximum 1 contact hours of continuing pharmacy education credit. 

Continuing Social Work Education

The American College of Healthcare Executives designates this knowledge-based activity for a maximum 1 contact hours of continuing social work education credit.

Continuing Education for Dietitians

The American College of Healthcare Executives designates this knowledge-based activity for a maximum 1 contact hours of continuing education credit for Registered Dietitians and Dietetic Technicians, Registered. RDs and DTRs should enter activities offered by jointly accredited providers as type 102 on Professional Development Portfolio (PDP) activity logs. CPEUs awarded must be commensurate with participation in the activity.

Physician Associate/Physician Assistant Continuing Education

The American College of Healthcare Executives has been authorized by the American Academy of PAs (AAPA) to award AAPA Category 1 CME credit for activities planned in accordance with AAPA CME Criteria. This activity is designated for a maximum of 1 AAPA Category 1 CME credits. PAs should only claim credit commensurate with the extent of their participation.