HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Hardin Memorial Health Cyberattack Results in EHR Downtime

Hardin Memorial Health in Kentucky has experienced a cyberattack which caused disruption to its IT systems and EHR downtime.

The cyberattack started on the evening of Friday April 5. A statement issued by a spokesperson for the health system confirmed that IT systems were disrupted as a result of a security breach. Details of the cyberattack have not yet been released so it is unclear whether this was a hacking incident, malware or ransomware attack.

The health system has been working round the clock to restore affected systems and servers. Hardin Memorial Health’s IT team has already brought most IT systems back online and has restored access to its EHR system in some units.

Despite the lack of access to its EHR system, business continued as usual and the hospital did not have to cancel appointments. All 50 of its locations remained open. “At no time during this event has the quality and safety of patient care been affected,” said HMH Vice President and Chief Marketing and Development Officer, Tracee Troutt.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Upon discovery of the security breach, emergency procedures were implemented, and an IT assessment was conducted to determine the nature and extent of the incident. That assessment is ongoing, but most of the issues associated with the attack were resolved within 24 hours.

Extra staff were brought in over the weekend to assist with its remediation efforts and to conduct administrative processes manually until systems could be brought back online.

“A combined team of some 40 internal IT and patient care specialists, complemented by external experts, importantly including our Baptist Health partners, worked over the weekend to resolve issues quickly and is working on the assessment,” said Troutt.

The hospital was well prepared for system downtime. The Hardin Memorial Health IT team regularly tests emergency procedures to make sure they can be implemented quickly and are effective at preventing disruption to patient services. Extra protocols have already been implemented to reinforce system security.

This incident shows that while it may not be possible to prevent all cyberattacks, with tried and tested backup and emergency response plans it is possible to recover from a cyberattack quickly and prevent disruption to patient services.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.