Ardent took one network offline, and emergency departments in six states had to answer for it

The week

On November 27, 2023, Ardent Health Services, a Nashville-based operator of 30 hospitals in six states, confirmed that it had been hit by ransomware on Thanksgiving Day, November 23. Ardent took its network offline. Emergency departments at several hospitals went on diversion, asking ambulances to take patients elsewhere, and some elective procedures were rescheduled while staff worked on downtime procedures. Affected facilities included Lovelace hospitals in Albuquerque, Hackensack Meridian Health Mountainside Medical Center in New Jersey and UT Health East Texas, several of them run with partners whose names were on the building. Ardent said patient care continued and that it was working with law enforcement and outside experts. By November 30, it said all of its emergency departments were again accepting ambulances, with systems restored in stages after that.

Earlier articles in this series looked at what a hospital’s diversion does to its region and how a large system’s hospitals fail together when shared platforms go down. Ardent’s attack adds a governance problem specific to multi-state operators. The decision that mattered most, disconnecting a shared network, was made centrally, as it should be. Its effects arrived in hospitals that sat in different state emergency medical systems, under different health department expectations, often with an academic or health system partner as co-owner and brand. And it happened over a holiday, when the people who normally make and explain such decisions are hardest to reach. We look at the problem in three parts, following the path of the decision: the central call to disconnect, the local calls that follow it, and the obligations owed to partners and public bodies.

The central call to disconnect

Taking a network offline is a defensible response to ransomware, because it can stop encryption and exfiltration from spreading. In a multi-state operator, it is also the single largest clinical decision of the incident, because every hospital on that network loses the electronic record, imaging access, lab interfaces and often phones at once. It is usually made by a small group, such as the CISO, CIO and chief executive, within hours.

Preparation makes that decision cheaper. An operator should know which clinical systems at each hospital depend on the shared network and which can run locally. It can then segment so that a disconnect can be partial where evidence allows, for example cutting corporate systems and wide-area links while leaving local clinical networks running. That segmentation is expensive and takes years, so it belongs in the capital plan, not the incident plan. The decision authority should be written down with named alternates for holidays, because a decision delayed while executives are reached by phone is a decision made by the attacker. And the incident command structure should include a clinical leader from the first call, so the person deciding to disconnect hears what it will mean in emergency departments before it happens.

The local calls that follow

Once the network is down, each hospital faces decisions that cannot be made at headquarters: whether to go on diversion, for which services, and for how long. Stroke and trauma care, which depend on imaging and rapid lab results, are typically the first to divert. Those calls need to be made by people at the hospital who can see the emergency department and talk to local emergency medical services.

That requires pre-delegation. Each hospital’s on-call incident commander, usually a senior nurse or physician leader, should hold written authority to set diversion status for named services, and to lift it, using criteria agreed in advance with clinical leadership. They need the contact details for the regional EMS medical director, the state or regional diversion system and neighboring hospitals, held on paper or on devices outside the corporate network. Across six states, those systems and contacts differ, which is why a single corporate playbook is not enough. Ardent’s recovery was reported market by market, with some emergency departments back on ambulance traffic days before others, which is what local decision-making looks like.

Holidays make this harder. Staffing is thin, executives travel, and some hospitals run on the minimum. A useful test is to pick a holiday weekend on the calendar and ask, for each hospital, who would hold diversion authority at 6 a.m. that day and whether they know it.

The obligations to partners and public bodies

Many hospitals in multi-state systems are joint ventures or carry a partner’s brand. Ardent’s model included partnerships with academic medical centers and health systems. When a joint venture hospital goes on diversion, the partner’s name is in the local news, and its own leadership, board and patients want answers. The joint venture agreement may set notice obligations, information rights and decision rights that apply in an incident, and few were written with ransomware in mind.

Operators should review each agreement for incident notice timing, who may speak publicly, access to forensic findings, and responsibility for costs, and agree a short incident protocol with each partner before one is needed. The same logic applies to public bodies. State health departments generally expect notice of significant service disruptions, and the rules and contacts differ by state. Health care is also in scope for federal incident reporting under the 2022 cyber incident reporting law, whose rules were still being written in 2023. A matrix listing, for each hospital, the partner, the state agency, the EMS authority and the notice expectation, kept offline, turns a holiday scramble into a checklist.

The three parts reinforce one another. A central decision made with clinical input, local leaders who already understand their authority, and partners who know what they will hear and when: together they shorten the period in which patients bear the cost of a network decision.

With hindsight

Ardent restored its systems over the following weeks. In 2024, the attacks on Change Healthcare and Ascension showed the same tension between central decisions and local consequences on a larger scale. Ascension’s hospitals in several states spent weeks on paper with diversions in some markets. Holiday and weekend timing remained common among ransomware attacks on hospitals. CISA’s proposed incident reporting rule, published in 2024, would cover many hospitals, though its final form and timing were revisited after that. Ardent itself went public through an initial stock offering in July 2024, and its disclosures described cybersecurity incidents among its risks. For multi-state operators, the matrix of partners, state agencies and EMS authorities described above is a modest piece of work that still determines how the first night of an incident goes.