Two weeks ago a cyberattack hit Vermont’s largest hospital, taking down many systems and radiating outward to impact several affiliated health care facilities.
The hack left the University of Vermont Medical Center without access to patients' electronic medical records, its scheduling system and even knocked out phone and email programs. The hospital is still working to get everything back online.
The disruptions caused by the cyberattack have also resulted in delays in care for some seriously ill patients.
Andy, a 48-year-old Burlington resident, is used to going to the hospital. Two years ago he was diagnosed with stage 4 colon cancer. The disease has spread throughout his body, and chemotherapy is the only thing keeping the cancer at bay.
“I’m a so-called ‘chemo-for-life patient,’” Andy said. “I have an un-receptable organs from metastasis. So every two weeks I go in and get chemo, and things have been pretty stable for a while.”
But last week, as Andy was getting ready for his treatment at UVM Medical Center, he was told not to come in.
“They told me that some doctors are taking appointments, some are not, and all I could do is leave my name and number and they would ostensibly call me back, but that has not happened yet,” he said last week. “So I’m just kind of hanging in limbo.”
Andy is not the only person to have trouble getting into UVMMC. Sean McCaffrey of Monkton said he and his wife are both struggling to reschedule appointments.
"I am concerned. I really wanna figure out what my next steps are for my health." — Sean McCaffrey, patient at UVMMC
McCaffrey said he was having chest pains and his blood pressure was high, so his doctor scheduled a stress test. It was supposed to happen about two weeks ago, the same day UVMMC got hacked. But McCaffrey says the appointment got cancelled and he has no idea when it will be rescheduled.
“Having chest pains is really scary,” McCaffrey said. “I’m feeling a little better than I was a few weeks ago with the chest pains, but it kind of went away on its own without medical intervention... I am concerned… I really wanna… figure out what my next steps are for my health.”
The cyberattack knocked out a range of systems at UVM Medical Center: email is down and its phone system has limited functionality. One big problem is that the computer systems hospital staff rely on, like the one that houses electronic medical records, aren't working. That’s forced the hospital to switch over to doing everything on paper.
UVM Medical Center officials have maintained that the hospital is still be able to offer patients the same quality of care. But they recently admitted that there have been delays, particularly for those being treated for cancer.
UVMMC President and Chief Operating Officer Stephen Leffler said last week during a press call that the cyberattack had affected radiation and chemotherapy appointments.
Leffler said people were still getting treatment, but that the hospital's capacity is limited.
“We are doing chemotherapy but, unfortunately, we can normally do 40-to-60 patients when we have full efficiency with all our systems and right now we can do about 15 a day,” he said.
Leffler said the hospital plans to start offering chemo every day, including three evenings a week, to reduce the backlog.
While the cyberattack hit UVM Medical Center the hardest, it also disrupted operations at six affiliated facilities, including Porter Medical Center in Middlebury, Central Vermont Medical Center in Berlin and Champlain Valley Physicians Hospital in Plattsburgh.
Maggie Gardner, a nurse midwife at Porter, says they still have access to records for some patients because Porter uses two different systems to access them. One is not connected to UVMMC and it’s working.
"Everything is just incredibly manual right now." — Maggie Gardner, nurse midwife at Porter Medical Center
But Gardner says they’re still relying on paper for a lot of things.
“We’re making paper charts for our clients again, which is something we haven’t had in six years,” she said. “Everything is just incredibly manual right now.”
Gardner said the most difficult issue has been the limited access providers and staff have to appointment schedules. UVMMC has one computer back online and faxes schedules to Porter, according to Gardner.
“We have our schedules for a few days but not much further out than that,” she said. “I can imagine that would be frustrating for patients — I know it's frustrating for us.”
The cyberattack against UVMMC came as other hospitals around the country were targeted by similar attacks, including ransomware. Some reportedly paid the hackers, but Leffler, UVMMC's president, says he hasn’t been contacted by anyone asking for money.
Federal authorities are currently looking into the UVMMC cyberattack, though an FBI spokesperson this week declined to comment.
In the meantime, no one knows exactly long it will take to completely restore operations. Gov. Phil Scott deployed members of the Vermont National Guard cybersecurity unit to help the hospital. Leffler is hopeful that each day they’ll be able to bring more systems back online.
“Our IT team is making good progress on our priority list but I still think we have multiple days in front of us,” Leffler said.
Andy, the stage 4 colon cancer patient, recently got some good news. The hospital finally called him back and on Monday he went in for his chemotherapy.
“It was pretty normal,” he said. “But it was still all paper and they’re asking questions about drugs: Do I get this drug, do I not get this drug? So it’s less than ideal still.”
But McCaffrey, who's waiting for a cardiology appointment, hasn’t been so lucky. He said he’s still trying to reschedule.
Have questions, comments or tips? Send us a message or get in touch with reporter Liam Elder-Connors @lseconnors.
We've closed our comments. Read about ways to get in touch here.