SCOTT SIMON, HOST:
U.S. hospitals have seen a record number of cyberattacks over the past few years. Getting hacked can cost a hospital millions of dollars, but it also puts the lives of patients at risk. Side Effect (ph) Public Media's Farah Yousry went inside one Midwest hospital to learn how a cyberattack touched every aspect of patient care.
FARAH YOUSRY, BYLINE: At Johnson Memorial Health in central Indiana, the obstetrics nurses work out of a central hub across from patient rooms. Some type medical notes on their computers as they keep a close eye on the maternal and fetal monitors.
UNIDENTIFIED NURSE: Yeah, something's going on, so we need to go into the room and, like, make sure the baby's heart rate, you know, is tracing well and...
YOUSRY: This is what it's like when things are running smoothly. But a year and a half ago, the hospital was thrust into a nightmare. Stacey Hummel manages the obstetrics unit.
STACEY HUMMEL: I got a call Friday morning - or Saturday morning at, like, 5. Did you know that the - that our computers went down? And I'm like, no, I didn't.
YOUSRY: It was October 2021, and the hospital was under cyberattack. Hummel couldn't do simple tasks like access medical records. The hackers posted their demand on the hospital servers - a ransom of $3 million. Hospital leaders were advised by cybersecurity experts not to pay the ransom and to limit the hackers' access to critical systems. So the entire hospital went offline. The staff went back to paper notes. They had runners go back-and-forth between different departments to share orders and lab results. It was almost like the clock was turned back a few decades. Hummel says the cyberattack was the hardest thing she went through in her 24 years as a nurse - even worse than COVID.
HUMMEL: You know, we're, like, sitting here. Oh, I hope the fetal monitors don't shut down. I hope they don't shut down. And then, they did.
YOUSRY: Suddenly, they worried they'd miss critical data points like dangerously low fetal heart rates.
HUMMEL: But once that happened, we had to station a nurse in every single room. So staffing was a nightmare because you had to stand there and watch the monitor. We couldn't watch it out at the desk, so...
YOUSRY: The cyberattack upended even the simplest tasks they once took for granted. Hummel tells me the nurses were struggling with a patient in labor.
HUMMEL: That was a refugee from Afghanistan.
YOUSRY: And the woman did not speak English.
HUMMEL: We had no way to communicate with them because our language line is on the iPad (laughter).
YOUSRY: Oh, wow. Yeah.
HUMMEL: So people are using their personal cellphones to Google Translate with this Afghan refugee, who's in labor. It was very difficult.
YOUSRY: Other departments at Johnson Memorial were affected, too. For weeks, the ER had to divert ambulances with the sickest patients to other hospitals. John Riggi is the national cybersecurity and risk adviser at the American Hospital Association. He says ransomware attacks on hospitals are increasing.
JOHN RIGGI: We've had cyberattacks impacting - direct attacks on hospitals then resulting on the impact of other hospitals - probably affecting over 250 hospitals just last year.
YOUSRY: Studies suggest that a cyberattack can cost a hospital more than $10 million excluding any ransom payments. Patient complications may also increase following an attack.
It took nearly six months for Johnson Memorial in Indiana to get their systems back to normal after the attack. But they still deal with the fallout. The hospital had to beef up staffing levels, which cost money. With computers down, they couldn't bill for services, so money wasn't coming in. Most hospitals have insurance to protect them against cyberattacks, but they can still be on the hook for millions of dollars. Here's Johnson Memorial's CEO, Dr. David Dunkle.
DAVID DUNKLE: It's tough. I mean, you know, that was a huge financial hit to the organization in 2021. Here we are in 2023, and our claim has still not been processed.
YOUSRY: Meaning they're still waiting for their payout from their cyber insurance nearly two years later. And because they were attacked, that insurance premium has more than doubled. Dunkle says his hospital has been doing more to train staff and invest in resilient cybersecurity systems. But...
DUNKLE: I tell people, if the Pentagon can be hacked, don't think you can't be.
YOUSRY: Federal agencies have successfully gone after some big hacker groups. Still, hospital leaders want more government resources to help hospitals prevent attacks and recover afterwards. For NPR News, I'm Farah Yousry in Indianapolis, Ind.
SIMON: And that story comes from NPR's partnership with WFYI and KFF Health News. Transcript provided by NPR, Copyright NPR.
