UVM Health Network Cyberattack Interrupts Crucial Treatment for Some Patients | Health Care | Seven Days | Vermont's Independent Voice

News + Opinion » Health Care

UVM Health Network Cyberattack Interrupts Crucial Treatment for Some Patients


Published November 11, 2020 at 10:00 a.m.

  • Sean Metcalf

Kat Mooney had been warned against reading the automated email containing her husband's latest scan results before his oncologist looked them over.

But how could she not? It had been a year since her husband was diagnosed with bone cancer — and after a major surgery, a lifetime dose of chemotherapy and one clean scan, they hoped he was in the clear. So when a message from the University of Vermont Medical Center arrived on October 26, she opened it. 

There was little room for misinterpretation: "highly concerning for recurrence."

"It was like a punch to the gut," she told Seven Days last week. 

Mooney was told that a second set of scans on October 30 would help confirm whether the cancer had returned. But two days before that appointment, a cyberattack struck the UVM Medical Center's server, crippling many of its computer systems, including the one needed to perform her husband's scans. Mooney said the couple repeatedly called the hospital to figure out next steps but were met with "radio silence."

"Last time, [his cancer] grew up to three inches in a matter of months," Mooney said last week. "If it's growing right now, we don't know." 

The Orleans County couple are among an untold number of families whose care plans have been upended since October 28 as the UVM Health Network races to counter the cyberattack. Though the hackers targeted the UVM Medical Center in Burlington, the damage rippled through most of the five other network hospitals in Vermont and northeastern New York.

As of Tuesday, some offices were still depending on pencil and paper to carry out many tasks. Many appointments have been postponed indefinitely while a key electronic medical records system remains off-line, effectively locking up vital patient information in a digital prison.

For days, hospital administrators said their care providers were coping well with the situation. They stressed that all six hospitals were open for most procedures — such as operations, baby deliveries and emergency treatment — and said patient care remained largely unaffected. "We have been caring for people without issue," Dr. Stephen Leffler, president and chief operating officer of the UVM Medical Center, said on Vermont Public Radio last week. 

But some patients have told Seven Days that the shutdown has affected their lives in personal and upsetting ways. Some recalled the frustration of arriving for a long-awaited test only to learn it was postponed. Others detailed agonizing waits to resume cancer treatments or receive test results. All understood that the attack was out of the medical staff's hands. But they felt the network had downplayed the disruptions and failed to communicate adequately with patients.

"They just left people completely stranded," Mooney said.

Although it has been two weeks since the cyberattack, the public knows little about the nature of the malware used — or whether it was part of a coordinated strike on hospitals around the country. Cybersecurity experts have said Russian criminals were perpetrating similar attacks, using ransomware to hold health care data and systems hostage. 

But UVM Health Network officials have deferred all questions about the nature of the attack to the Federal Bureau of Investigation, which has, in turn, disclosed nothing about the suspected perpetrators or what they are after. Even when the flow of information seemed to loosen, the network quickly tightened the valve. During his VPR interview last week, Leffler said the FBI was calling the attack "ransomware," the first such confirmation. A hospital spokesperson later said that Leffler "misspoke."

This lack of clarity is common at early stages of cyberattacks, according to Henry Collier, a Norwich University professor who specializes in cybersecurity. "They may not have the full details yet," he said last week. "It's entirely possible that over the course of the next several days, as they continue to ... dig into what's going on, that they identify exactly what the attack was."

Collier commended the network for immediately disclosing the problem instead of hiding it, as some major institutions have done. Officials say the health group's information technology team acted swiftly, shutting down computer systems to prevent the malware from spreading.

The network must now sift through thousands of devices to determine whether they were infected. A digital team from the Vermont Army National Guard has been deployed to aid those efforts. No one knows when the systems will be fully restored.

As recovery efforts unfold, officials have struggled to articulate the full extent of the shutdown. Some of that difficulty stems from the network's size. The hospital group has grown rapidly over the last decade. It includes dozens of doctors' offices and outpatient clinics, as well as the six hospitals, and employs a combined 3,000 physicians, nurses and other clinicians.

But there also has been a strategic effort to keep some information under wraps, at least while the investigation is ongoing. In his VPR interview last week, Leffler was asked to describe what systems the UVM Medical Center was able to preserve from the attack. "We're being quiet about that," he said. "But what I can tell you is that ... we are working our way through this problem."

What's clear is that the attack and response efforts have affected the affiliates differently, and the worst disruptions have impacted hospitals that run a new medical records system called Epic.

The $150 million system has been rolled out in waves across the network and is now used in outpatient settings at four hospitals: Central Vermont Medical Center in Berlin, Porter Medical Center in Middlebury, Champlain Valley Physicians Hospital in Plattsburgh, N.Y., and the UVM Medical Center.

IT staffers took Epic off-line as soon the attack hit. Since then, all four hospitals have been unable to access outpatient clinical medical records. The UVM Medical Center, the network's flagship hospital, also uses Epic for inpatients, deepening the disruption. And because the attack originated on the Burlington hospital's server, even departments that don't run off Epic have had issues.

Perhaps the patients most affected have been those who receive cancer care at the UVM Medical Center. The attack has greatly limited the hospital's capacity to administer chemotherapy. Many treatments were canceled in the initial days of the shutdown. More than a week later, the hospital could only provide the crucial therapy to about 15 patients daily, rather than as many as 60 in normal circumstances. Radiation treatments — which run on computer-based systems — were interrupted and did not resume until last Friday. The hospital hopes to quickly expand its capacity to address the backlog of those awaiting treatment, but there's no clear timeline yet.

The hospital group finally acknowledged the impact on cancer treatments last Friday, nine days into recovery efforts, saying that it "deeply apologize[d] for any distress this may have caused." By then, some patients had lacked answers about their care for more than a week.

Carol McDowell, a 63-year-old South Burlington resident battling stage IV gastric cancer, had her biweekly chemo appointment canceled on November 2. She spent the next two days trying to reach someone at the hospital who could explain her options.

"I could go three weeks [without chemo] and probably be OK," she said at the time. "But I don't know, because I can't ask anybody if this is going to affect my treatment." 

McDowell eventually dropped off a handwritten note at the cancer center asking for guidance. A nurse called later that day and said McDowell's oncologist had affirmed that the delay would not set her treatment back. The answer brought some relief, and McDowell is tentatively optimistic she may get in this week. But there is no guarantee.  

"It's just the frustration of no communication," she said. "You don't know if it's going to be a week or a month. You don't know." 

Other patients who were seeking diagnostic tests at the Fanny Allen Campus in Colchester shared similar complaints. Foresta Castañeda, 40, called four different numbers to check the status of her November 2 test at the UVM Medical Center's urgent care site.

She didn't reach anyone, but hospital officials had said for days that most appointments were still on, so Castañeda drove the 40 minutes from Monkton. She arrived only to learn that her appointment had been canceled. Staff apologized, explaining that they were unable to find her phone number to let her know. Her test has not been rescheduled.

Neither has a stress test that Castañeda's husband had scheduled for the day of the cyberattack. Sean McCaffrey, 37, received a call an hour before his appointment to inform him that Fanny Allen's computers were down. He was told he would get a new appointment date in a day or two. When he called five days later, he was told all cardiology tests had been postponed indefinitely. 

"I'm concerned about my health, and I want to get it checked out, but I don't have any options right now," he said.

While he empathized with frontline workers, McCaffrey said the hospital should be doing more to inform patients regarding which departments are off-line. "Patients are really getting shafted here," he said.

The hospital says patients who are struggling to reach specific providers or clinics should call a central number: 847-8888. Those with "nonurgent" matters are encouraged to wait until the hospital is back up to full speed, while patients needing cancer care have been asked to call to confirm their appointments.

As for Mooney, she and her husband were advised on November 4 that it would be best to schedule his remaining bone scans at another facility. By then, they had made an appointment at Massachusetts General Hospital in Boston, where her husband had surgery last year.

On Monday, they made the 220-mile drive south. Mooney, unable to join her husband during his four hours of scans, walked down to the city's waterfront and waited for news. When it finally came, there was cause for relief: Her husband's doctors determined the cancer had not spread. In fact, they were not convinced that it had even returned and suspected that what appeared to be a malignancy on the initial MRI may actually have been signs of bone recovering from his previous surgery.

"I don't want to get my hopes up too high, because I do not want to get crushed," Mooney said. "But I'm cautiously optimistic."

The Boston doctors want to compare her husband's concerning MRI from the UVM Medical Center with a previous one to confirm the theory. The Mooneys will wait a few days to see if the Burlington hospital makes any progress in restoring systems so that the scan can be sent over. If not, Mooney said, they will return to Boston and have another MRI done — whatever it takes to find answers.

The original print version of this article was headlined "Collateral Damage | UVM Health Network cyberattack interrupts crucial treatment for some patients"