HSE cyberattack leaves patient management and radiology systems exposed

The biggest risk the Health Service Executive is facing as a result of the cyberattack that began on Friday is that its core patient management system and core radiology system are both out of action, the organisation’s chief operations officer has said.

Anne O’Connor said on Sunday that radiology services had been particularly badly hit across the country and that the radiation oncology system for patients with cancer has been compromised across the board.

She said in some cases hospitals had reverted to manual, paper-based systems.

The attack, by a criminal gang believed to be based in eastern Europe, has seen health service data encrypted and possibly stolen, Ms O’Connor said, and the criminal gang has demanded a ransom in return for a code to release the encrypted data.

British ‘policy of non-intervention’ was a key factor in Irish Famine, says President

---

Department of Health hit by cyberattack similar to that on HSE

---

Retailers look forward to resuming normal trading tomorrow

---

‘Nature’s gentleman’: Taoiseach pays tribute to former Cork mayor Tim Falvey

---

Ms O'Connor said the HSE was not responsible for any decision on paying the ransom, the amount of which has not been revealed. It is State policy not to pay ransom demands.

Speaking on Newstalk's On the Record with Gavan Reilly, Ms O'Connor said the HSE did have some clean back-up data from which it could rebuild its servers, but that this would be a slow process.

As a result of the cyberattack, a number of HSE hospitals have cancelled all out-patient appointments. However, the country's large voluntary hospitals, which operate a slightly different computer system, have not been as badly affected.

These include Beaumont, the Mater, St James's, Tallaght and St Vincent's in Dublin as well as Mercy University Hospital and Cork University Hospital, she said. "They have not had the same effect on the patient management system but they are impacted on radiology."

Disconnecting machines

Ms O’Connor said the HSE was trying to disconnect machines so that individual pieces of equipment could work in isolation. “Our priority has to be patient management system. The biggest risk at the minute relates to the fact that our core patient management system is down, as is our core radiology system. All of our diagnostic capability in terms of radiology has gone,” she said.

“If you have somebody coming into a hospital, we have no capability to look back at previous tests or previous scans. We cannot order lab tests or radiology electronically.

“We have people in hospitals delivering pieces of paper around with lab results, so it is going back many, many years for us and there is a risk in that in terms of how we can do our business.

“Our priority has to be get a patient management system back that gives us access to people’s information so even things like blood transfusion, matching bloods, looking at previous records for medication, allergies, etc, we do not have any access.”

Ms O’Connor told the programme that the HSE’s system had been very significantly compromised, and at this stage it did not know how much data had been accessed by hackers.

HSE chief clinical officer Colm Henry said the diagnostic service was most severely affected because the service relies heavily on IT systems for ordering and imaging tests and comparing previous history.

Hospitals and GPs were focused on emergency time critical care, he told RTÉ’s This Week programme, adding that anyone who had any doubts or concerns should look at the HSE website, which has local and national information.

He could not say when services would be re-established but reiterated that the disruption would go well into next week.

Slow work

Dr Henry added that it was also still “too early to say” if patient information had been compromised. It would be slow work to assess each server and establish if it had been corrupted.

“The longer this goes on, there is certainly a greater risk. Even compiling a list of people to cancel is difficult because they’re on an IT system.”

Ms O'Connor urged patients with forthcoming hospital appointments to check with the HSE website, which was being updated throughout the day with information on cancellations.

She said virtually all radiology appointments across the board for procedures such as X-ray, an MRI or CT scan have been cancelled.

The HSE website said radiation machines had been temporarily closed and treatment stopped at St Luke’s Hospital, Beaumont Hospital, St James’s Hospital, Galway University Hospital and Cork University Hospital – the country’s five radiology centres. However, a plan to treat all urgent radiation patients in the private sector began on Friday and is continuing.

The Rotunda Hospital said outpatient maternity appointments and scans in public/private, and semi-private clinics for women less than 36 weeks gestation would be cancelled for the week ahead.