UH restores patient access to MyChart system that was shut down by cybersecurity incident

University Hospitals has brought its MyChart system back online after digital services were knocked out for over three weeks, according to WKYC, Cleveland.com, and FOX 8 News. The hospital system first detected unusual activity on its servers on Oct. 22 and disconnected its systems from the internet out of an abundance of caution, Ideastream reported. During the outage, patients faced longer phone waits as disruption continued across digital services, according to News 5 Cleveland WEWS. Ideastream noted that virtual visits were moved to phone, Zoom, or in-person appointments, while providers had to call in prescriptions by phone or write receipts by hand. Patients received phone calls with laboratory results and appointment reminders instead of using MyChart. Cory Scott, Executive Director of the Cybersecurity Center at Cleveland State University’s College of Law, stated that a study looking at ransomware attacks on U.S. hospitals found it takes an average of 16 and a half days to recover from such cyberattacks. Scott noted, "This is not, unfortunately, an unusual amount of time yet." University Hospitals has not responded to questions regarding the type of attack detected, though a spokesperson confirmed the intranet allowing doctors to access patient records was fully operational. UH CEO Cliff Megerian thanked providers in internal emails for adjusting routines and workflows, stating, "We cannot repeat it enough. Thank you to each and every one of you who have adjusted your routines and workflows to continue to serve our patients." Scott explained that vague internal communications are standard protocol because attackers often monitor public statements, keeping information close to the chest to keep attackers in the dark. Meanwhile, University Hospitals is facing a proposed class-action lawsuit alleging that personal information was compromised during the cybersecurity incident and that the system failed to implement reasonable cybersecurity safeguards or policies to protect sensitive information. University Hospitals has not commented on whether any personal information was accessed during the incident. Hospital systems have 60 days to report data breaches that put personal health information at risk to the Department of Health and Human Services, and University Hospitals has not yet made any such disclosures.