CoChat
Sign Up
Cited by 60Emergency and Acute Care StudiesDisaster Response and ManagementCOVID-19 and healthcare impacts

Ransomware attack associated with disruptions at adjacent emergency departments in the US.

Open access
Dameff, Christian, Tully, Jeffrey, Chan, Theodore C., Castillo, Edward M., Savage, Stefan, Maysent, Patricia, Hemmen, Thomas M., Clay, Brian J. +1 more·2023·JAMA Network Open
DOI 10.1001/jamanetworkopen.2023.12270PMC PMC10167570
Open this paper in CoChat — free accountOpen PDF

Abstract

Importance: Cyberattacks on health care delivery organizations are increasing in frequency and sophistication. Ransomware infections have been associated with significant operational disruption, but data describing regional associations of these cyberattacks with neighboring hospitals have not been previously reported, to our knowledge. Objective: To examine an institution's emergency department (ED) patient volume and stroke care metrics during a month-long ransomware attack on a geographically proximal but separate health care delivery organization. Design, Setting, and Participants: This before and after cohort study compares adult and pediatric patient volume and stroke care metrics of 2 US urban academic EDs in the 4 weeks prior to the ransomware attack on May 1, 2021 (April 3-30, 2021), as well as during the attack and recovery (May 1-28, 2021) and 4 weeks after the attack and recovery (May 29 to June 25, 2021). The 2 EDs had a combined mean annual census of more than 70 000 care encounters and 11% of San Diego County's total acute inpatient discharges. The health care delivery organization targeted by the ransomware constitutes approximately 25% of the regional inpatient discharges. Exposure: A month-long ransomware cyberattack on 4 adjacent hospitals. Main Outcomes and Measures: Emergency department encounter volumes (census), temporal throughput, regional diversion of emergency medical services (EMS), and stroke care metrics. Results: This study evaluated 19 857 ED visits at the unaffected ED: 6114 (mean [SD] age, 49.6 [19.3] years; 2931 [47.9%] female patients; 1663 [27.2%] Hispanic, 677 [11.1%] non-Hispanic Black, and 2678 [43.8%] non-Hispanic White patients) in the preattack phase, 7039 (mean [SD] age, 49.8 [19.5] years; 3377 [48.0%] female patients; 1840 [26.1%] Hispanic, 778 [11.1%] non-Hispanic Black, and 3168 [45.0%] non-Hispanic White patients) in the attack and recovery phase, and 6704 (mean [SD] age, 48.8 [19.6] years; 3326 [49.5%] female patients; 1753 [26.1%] Hispanic, 725 [10.8%] non-Hispanic Black, and 3012 [44.9%] non-Hispanic White patients) in the postattack phase. Compared with the preattack phase, during the attack phase, there were significant associated increases in the daily mean (SD) ED census (218.4 [18.9] vs 251.4 [35.2]; P < .001), EMS arrivals (1741 [28.8] vs 2354 [33.7]; P < .001), admissions (1614 [26.4] vs 1722 [24.5]; P = .01), patients leaving without being seen (158 [2.6] vs 360 [5.1]; P < .001), and patients leaving against medical advice (107 [1.8] vs 161 [2.3]; P = .03). There were also significant associated increases during the attack phase compared with the preattack phase in median waiting room times (21 minutes [IQR, 7-62 minutes] vs 31 minutes [IQR, 9-89 minutes]; P < .001) and total ED length of stay for admitted patients (614 minutes [IQR, 424-1093 minutes] vs 822 minutes [IQR, 497-1524 minutes]; P < .001). There was also a significant increase in stroke code activations during the attack phase compared with the preattack phase (59 vs 102; P = .01) as well as confirmed strokes (22 vs 47; P = .02). Conclusions and Relevance: This study found that hospitals adjacent to health care delivery organizations affected by ransomware attacks may see increases in patient census and may experience resource constraints affecting time-sensitive care for conditions such as acute stroke. These findings suggest that targeted hospital cyberattacks may be associated with disruptions of health care delivery at nontargeted hospitals within a community and should be considered a regional disaster.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1001/jamanetworkopen.2023.12270

Cites

31 of 31 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • On May 1, 2021, a four-hospital HDO was infected by a ransomware cyberattack, resulting in loss of electronic medical records and systems for one month.

    “On May 1, 2021, a four-hospital HDO was “infected” by a ransomware cyberattack, resulting in the loss of electronic medical records and systems for one month (3).”

    From Ransomware Cyberattack Associated With Cardiac Arrest Incidence and Outcomes at Untargeted, Adjacent Hospitals (2024) · cites this paper as [3]

    The Introduction reports that a four-hospital HDO was infected with ransomware on May 1, 2021, causing acute loss of electronic health records and other systems. It says operational disruptions persisted for four weeks, but does not establish that the records and systems themselves remained unavailable for that entire month. (LLM, conf=0.83)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 32 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A.
Affiliations
  • University of California San Diego (US)
  • Department of Biomedical Informatics, University of California, San Diego
Corresponding author
Dameff, Christian
ORCID
Venue
JAMA Network Open
Publisher
American Medical Association (AMA)
Published
2023-05-08
Volume
6
Issue
5
Pages
e2312270
ISSN
2574-3805 (ISSN-L)
DOI
10.1001/jamanetworkopen.2023.12270
PMC
PMC10167570
OpenAlex
W4375858893
Cited by
60
References
32
Citations by year
2026: 24 · 2025: 17 · 2024: 15 · 2023: 4
FWCI
18.42
Type
journal article
Language
en
Open access
Licence
cc-by
Locations
  • JAMA Network Open (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
Funders
  • National Institutes of Health
  • National Institute of Biomedical Imaging and Bioengineering (K08EB032477)
Topics
  • Health Sciences › Medicine › Emergency Medicine › Emergency and Acute Care Studies
  • Health Sciences › Health Professions › Emergency Medical Services › Disaster Response and Management
  • Health Sciences › Medicine › Oncology › COVID-19 and healthcare impacts
Keywords
ransomware, emergency department, patient volume, pre-post test comparison
MeSH terms
Adult, Child, Emergency Medical Services, Emergency Service, Hospital, Female, Hospitalization, Hospitals, Humans, Male, Middle Aged, Cohort Studies

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review