A cybersecurity incident doesn’t have to stop patient care to seriously disrupt a healthcare organization.
The recent Luminis Health incident is a good example:
On September 1, Luminis reported that a cybersecurity incident had made certain systems unavailable. Hospitals and care locations remained open, but MyChart and other digital services were affected, some processes took longer, and patients were told they might need to complete paper forms.
And recovery wasn’t immediate.
Luminis relied on downtime procedures while systems were unavailable. Phone service was restored in stages, MyChart returned later in September, and even after systems were restored, teams were still reconciling and entering documentation from visits that happened during the downtime.
That’s an important reminder: Cyber incident response isn’t only about getting systems back online. It’s about keeping the organization functioning while they’re unavailable.
What Would Your Team Do?
If your EHR suddenly went down today:
- Do employees know where to find downtime procedures?
- Can patient care continue using approved processes?
- Does everyone know who to contact?
- Is there a plan for reconciling information once systems return?
Those are much easier questions to answer before an incident begins.
Preparedness Has to Work in the Real World
The Luminis incident shows why healthcare organizations need more than a plan sitting in a file.
Employees need to understand what to do when normal systems aren’t available, and how to keep work moving without creating new privacy or security risks.
Cybersecurity Awareness Month may be ending, but preparedness can’t be seasonal.
HIPAA Secure Now’s Healthcare Security & Privacy Incident Response Checklist can help your organization think through the people, processes, and decisions that matter before an incident happens.
Don’t wait for downtime to find out whether your plan works.
Download the Healthcare Security & Privacy Incident Response Checklist
Leave a Reply