Curbside Consult with Dr. Jayne 5/13/24
I have friends who work for Ascension. The concerns coming out of their facilities, which are offline due to a ransomware attack, are quite serious. It sounds like they haven’t done adequate downtime preparation, let alone preparation for a multi-day incident that has taken nearly all of its systems out of commission.
Mr. H reported in the Monday Morning Update about a patient who left one facility because it had been two days and he still hadn’t been seen by a physician. This is completely unconscionable. I hope regulators step in immediately.
Any hospital leaders in any organizations who are not aware of the current ransomware and cyberattack landscape should be removed from their positions of authority immediately. Hospitals need to be drilling for the eventuality on a regular basis. Not annually, but monthly.
I’ve written about this before, but one of the most serious near-misses of my career, which to me will always be a full miss, occurred during an EHR downtime, when the environment in my facility can only be described as chaos. No one knew where the downtime forms were. They were reluctant to engage downtime procedures due to a misplaced fear of “having to fill out a bunch of paperwork” that is required when they formally call a downtime.
I was working in what was essentially a freestanding emergency department at the time, although it was licensed as an urgent care. Due to that licensing, we could have easily stopped taking new patients while we got things sorted. However, the fear of repercussions from management was too great. They continued to bring patients into the exam rooms, leaving the clinical teams scrambling.
Once I found out what was going on and that we were still taking new patients, I called the downtime and demanded we stop bringing in new patients. There’s no need to worry about diversion, EMTALA violations, or turning people away when you’re not licensed as an emergency facility. I’ve been around long enough and practiced in enough challenging environments, including in a tent and out in the field with no support, to know that sometimes you just have to take charge.
Shame on these facilities that are putting patients at risk through lack of planning, lack of leadership, and focusing on the bottom line instead of focusing on the patients who are in front of them. I hope they’re providing counseling for the clinical team members who are experiencing profound moral injury as they are expected to continue to just do their jobs in an untenable situation. One person who reached out to me described it as a “battlefield” situation.
For those of you who are in administrative positions, I urge you to walk to the front lines in various clinical departments in your facility and start asking questions about downtime. It’s not enough to simply trust the reports that are coming out of planning committees and safety assessment committees. My free consulting advice: you need to put your proverbial boots on the ground to find out whether people know what to do or not. It’s not enough to perform phishing tests and to look at the reports that show that people are becoming less likely to click on sketchy links or to visit dodgy websites. People have gotten really good at watching those cybersecurity videos and picking the correct answer on a bland, five-question test.
What you need to know, though, is that when push comes to shove and someone has taken control of your infrastructure, do your employees know how to see patients? Kind of like when you’re drilling for an inspection by The Joint Commission and you expect everyone to be able to explain the PASS acronym for how to use a fire extinguisher (Pull, Aim, Squeeze, and Sweep for those of you who might not be in the know) you need to ensure that everyone knows how to successfully execute a downtime.
Back to PASS, though. Knowing the acronym isn’t enough. Does your team even know where the fire extinguishers are? If a random person came up to them during a time when there was no inspection, could they verbalize where to find them? A downtime is no different. All staff should be able to articulate what are the conditions that require that a downtime be called, how to initiate a downtime, the various roles of the team during downtime, how to find the “downtime box” or whatever supplies they need to use, what the downtime communication plan is, and how to manage critical patient care tasks in the near-term while the entire downtime procedure is put into place.
Every single healthcare facility needs to know how it will handle a multi-week downtime. News flash: no one is immune to this, and anyone who thinks otherwise needs to seriously reevaluate their leadership readiness. Our facilities need staffing plans to help workers cope with prolonged downtime, including adequate double-checks and safety procedures to account for the loss of systems we’ve all grown to rely on, such as bar code medication administration (BCMA), allergy and interaction checking, and electronic time-out checklists.
At this point, and especially after the Change Healthcare debacle, no one has any excuse for keeping their heads in the sand and thinking, “It couldn’t happen to me.”
This weekend marked the opportunity to cross something off my bucket list without having to leave my home state to do it. The raging Level 5 geomagnetic storms are the first to hit Earth since October 2003, which was a time when I was knee-deep in building my practice and didn’t know a solar cycle from the citric acid cycle. Being involved in amateur radio for the last several years has taught me quite a bit about the former, and every day that I move farther from medical school has allowed me to forget more details about metabolic cycles than I care to admit.
As a “science person,” I’m happy to see this month’s expanded Northern Lights phenomenon capture the attention of so many people. I personally learned that the aurora comes in all different colors besides the most-often featured green. I hope there are children being inspired by it and considering future careers that involve exploring our universe and all the fantastic phenomena around us. Kudos to my favorite college student for capturing this amazing pic.
Were you able to see the aurora, or do you still have a trip to the northern latitudes on your bucket list? Leave a comment or email me.
Email Dr. Jayne.


I was born roughly 2 months after the US space program began (Explorer 1), and I've followed it all my…