It is still too early to say if confidential patient information, either recent or historical, has been compromised as a result of the cyber attack on the Health Service Executive’s IT systems, according to the chief executive of the Saolta University Health Care Group which runs the seven public hospitals in the west and north-west of the country.
Tony Canavan says that the health authority is examining if patients’ medical records may be among the data affected by the attack which has caused major disruption to the health service and is having “a very significant impact” on patient care.
“Unfortunately, what we cannot do right now is give people an assurance that all is fine,” he says. “We don’t know how our systems have been compromised. It will be a number of days before that assessment will be completed. We are doing our best to protect sensitive patient data if we can.”
Disruption
.
The disruptions at University Hospital Galway caused by the ransomware attack are expected to continue for the rest of this week. All outpatient clinics, all diagnostics including X-rays, CT scans, MRI appointments, and cardiac investigations, endoscopy, and radiotherapy have been cancelled. Patients who are due to have radiotherapy this week should contact (091 ) 542618 or (091 ) 542607 from 9am to 4pm for advice. All elective inpatient and day case procedures are also cancelled. A small number may go ahead and, if this is the case, people will be contacted directly.
Patients can expect significant delays in the emergency department as existing IT systems are not in use and the manual workarounds in place are time-consuming. The hospital is asking patients to contact their GP or out-of-hours GP service in the first instance if their health problem is not urgent.
.
If possible, patients should bring their existing patient number or board number with them when they come to the hospital. This number appears on appointment letters, test results, or blood test results. Maternity services and dialysis treatment will go ahead. Patients who are due to attend the haematology/oncology day ward for chemotherapy treatment this week are asked to telephone (091 ) 544890 or (087 ) 9200753 from 9am to 5pm for advice on their appointment. Ongoing updates on service disruptions will be provided on hse.ie and on saolta.ie
“This cyber attack is not just an administrative inconvenience, it goes to the heart of patient care and the implications are huge for patients’ health"
Speaking to this newspaper, Mr Canavan, who took over as Saolta chief in September 2019 and presides over an annual budget of almost one billion euro, says the health service never experienced anything like this cyber attack before. “It has been our biggest challenge without a doubt”. Even if the damage caused to the HSE’s IT systems is repaired this week, the incident will still have had a major effect on patient services, he says.
.
“This cyber attack is not just an administrative inconvenience, it goes to the heart of patient care and the implications are huge for patients’ health. It’s not that we had one big system attacked, lots of systems we have were attacked. We still don’t have any clinical IT system of any shape back in place operating [in the public hospitals] in the west and north-west.
'Doctors do not have access to any historical patient information. Radiotherapy is one of our services which is highly dependent on a computerised system'
"Our IT people took the correct decision to shut all our IT systems down. When the time is right, they will bring all the systems back, one at a time. Hopefully, we will be able to prioritise the important ones. The three most important are radiology, laboratory, and radiotherapy. But that’s not to say that the others are not important.
.
“It is incredibly difficult regarding chemotherapy, for example. We wanted to prioritise some patient groups. We could do that earlier in the week but it is getting progressively difficult. Doctors do not have access to any historical patient information. Radiotherapy is one of our services which is highly dependent on a computerised system. If someone is going for radiotherapy, they meet their consultant and a treatment programme is all worked out and planned on the system. For these patients, that plan cannot be implemented now. People who were expecting to receive radiotherapy last Monday, for example, have not received it.
“The best example [of the current situation] is you have a patient in a hospital bed who is waiting for a radiology result. It goes on to the computer system, that means that clinicians can see these results on any of the computers in the hospital. That’s how normal patient care takes place. In the case of an MRI scan, for instance, subsequently the image and the report are on the computer system for the doctor. Now, none of this can happen. Tests can be requested and results can be delivered manually. We literally have ‘runners’, staff bringing test results to various parts of the hospitals.”
Duration
.
The uncertainty regarding the duration of this crisis and the continuing fallout from it are a major concern, according to the head of Saolta which runs seven public hospitals on five sites, in Galway (UHG, Merlin Park, and Portiuncula ), Mayo, Roscommon, Sligo and Donegal and is also responsible for the operation of the Covid-19 vaccination programme in the west and north-west.
“One of the difficulties is nobody knows how long we will be in this position. If we get out of it this week, it will have had a very significant impact on patient care. The real risk is if it goes on for another week. The length of time it goes on for is the real risk to patients. Most people understand if you have a serious illness like cancer, time is important in terms of getting a diagnosis and being treated quickly.”
Badly hit
Hospitals in the west are understood to have been particularly badly hit in terms of the cancellation of services. Mr Canavan says this is “probably true”. The western and north-western hospitals are statutory HSE hospitals whereas in the east of the country most of the hospitals, such as Beaumont, St James’, Tallaght, St Vincent’s, and the Mater Hospital are voluntary hospitals.
“All of the hospitals on this side of the country are owned by the HSE and are managed by the Saolta group. That is important from an IT perspective as we share the same radiology, financial, and patient administration system. The large voluntary hospitals are funded entirely by the HSE but technically are not owned by it.
“A lot of the large voluntary hospitals have their own IT systems. That meant that when this [cyber] attack happened last Friday the voluntary hospitals could shut down their systems and restart quite quickly. We could shut down but not restart quickly.”
Monitoring the situation
Saolta is constantly monitoring the current situation and revising its plans accordingly. “We set up a planning horizon or timeline of one week and looked at what arrangements we could put in place to keep the show on the road for one week. By this Friday we need to look at these plans to see if we need to change them.”
The health chief is concerned that the cancellations of hospital appointments is adding to an already significant backlog of cases due to the pandemic.
“My concern is for patients who perhaps have been waiting significant periods of time for operations or diagnoses due to these being delayed because of Covid-19 and now this. That’s the main thing that is concerning.”
Salaries
.
Another important issue is ensuring that Saolta’s 11,000 staff in the west and north-west get paid today (Thursday ). “That is definitely an issue of concern. We expect for this week it won’t be a major problem, the pay date for Thursday is OK. If the IT issues are not resolved, we don’t know yet how we will manage next week.”
The relationship continues between Saolta and Galway’s private hospitals, the Bon Secours and the Galway Clinic. They came to the aid of University Hospital Galway by offering patient accommodation and services during the Covid-19 crisis.
'The full impact of this ransomware attack is not yet known, but it is likely to be felt across the public health system for many weeks to come'
“We still have patients in the Bon Secours Hospital,” he says. “That is very good because UHG was getting very busy with people awaiting admission on trolleys in the emergency department. We have 13 ‘frail elderly’ patients in the Bon Secours.” These were transferred from UHG to the Renmore hospital for rehabilitation before they return home.
“We have an ongoing relationship with the Bon Secours and the Galway Clinic and we trigger this if we need to. Both hospitals have been very supportive.”
Galway Clinic
The Galway Clinic says it is assisting cancer patients impacted by the ransomware attack on the HSE’s IT systems. Geoff Moylan, the CEO of the hospital, said it is ready to do more if necessary.
“The Galway Clinic has played its part throughout the Covid-19 pandemic assisting our colleagues in the public health system whenever it was needed. We are doing the same now in the face of this senseless ransomware attack.
“Radiotherapy has been particularly badly hit by the cyber attack but because the Galway Clinic’s IT system is completely separate from the HSE we are unaffected and are ready to provide whatever help is needed to this cohort of cancer patients, some of whom are very ill, to ensure they receive continuity of care.
“The full impact of this ransomware attack is not yet known, but it is likely to be felt across the public health system for many weeks to come. All IT systems in the Galway Clinic have been reviewed and they have not been impacted in any way by the cyber attack on the HSE.”
.
Meanwhile, despite the pressure on the Saolta group this week, its Covid-19 vaccination programme is progressing well. On Tuesday almost 4,200 vaccinations were administered in the region. Its vaccinations centres are located in Galway, Sligo, Letterkenny, Castlebar, Carrick on Shannon, and Roscommon.
“All of our centres are ramping up and the numbers are accelerating quite significantly,” says Mr Canavan. Saolta is currently recruiting additional staff in the west and north-west for its vaccination teams. Since Christmas it has recruited 560 people, mainly vaccinators, a lot of clerical staff, pharmacists, and “wellness checkers”, who ensure people are feeling OK after being vaccinated.
