Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
A large system’s hospitals normally cover for each other with beds, staff and shared services. When ransomware took Ascension’s shared platforms down across its markets, that internal mutual aid failed together, and the help had to come from outside.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On May 8, 2024, Ascension, one of the largest nonprofit health systems in the United States, detected unusual activity on its network and took systems offline. It later confirmed a ransomware attack. Its electronic health record, pharmacy systems and other clinical applications went down across most of the 19 states where it operates about 140 hospitals. Staff moved to paper and manual processes, and some hospitals diverted ambulances for a period. News reports linked the attack to the Black Basta ransomware group, though Ascension did not confirm the attribution. In June, Ascension said the intrusion began when an employee downloaded a malicious file believing it was legitimate. Access to the electronic health record was restored market by market through May and June, and Ascension said on June 14 that clinical workflows were functioning much as before.
Earlier articles in this series looked at extended downtime from the unit level, after the outages at UHS, Scripps and CommonSpirit: paper skills, clinical ownership and the backlog afterward. Ascension added a system-level problem. A large health system’s resilience plan quietly assumes that if one hospital is in trouble, the others are not. Sister hospitals take diverted patients, central teams send staff, and shared services keep running. Shared platforms mean a single intrusion can switch off all three at once. The exposure splits into three: patient capacity, people, and shared services.
Patient capacity: where diverted patients go
Diversion plans in multi-hospital systems usually point first to other hospitals in the same system. Transfers are easier when beds, physicians and records sit under one roof. When every hospital in a market is on paper, that pathway loses most of its value. The receiving hospital is working without its electronic record too, and a transfer adds a paper chart to a paper chart.
The workable alternative is regional. Emergency medical services agencies, regional health care coalitions and competing hospitals make the diversion decisions that matter in a market-wide outage. That needs groundwork. Systems can agree in advance with neighboring hospitals and EMS on how a cyber-driven diversion will be declared, how long it can last and how it will be lifted. They can also agree what clinical summary travels with a diverted patient when the sending hospital cannot print from its record.
The trade-off is commercial. Sending patients to a competitor costs revenue, and some leaders delay diversion for that reason. Pre-agreed clinical triggers, such as loss of medication administration records or imaging results for a set number of hours, take that decision out of the moment and give it a documented basis.
People: who comes to help
Large systems handle local staffing shortfalls by moving people: float pools, travel staff, central nursing resources and clinical informatics teams. In a system-wide outage, every market needs those people at the same time. Central informatics staff, who know both the record and the downtime forms, are pulled toward restoration work just as the hospitals need them most.
Two adjustments reduce the strain. First, systems can define in advance which central roles stay with hospital operations and which move to recovery, so the same handful of experts is not double-booked. Second, staffing agencies and contract labor arrangements can include terms for a cyber event, with response times and the skills required, including experience with paper charting. These arrangements cost money in quiet years, and that is the decision a board has to make knowingly.
Help can also come from unaffected health systems. Clinical informatics staff and nurses familiar with the same record vendor can shorten the learning curve, especially during restoration and reconciliation. Arranging that in the middle of an incident raises questions about credentialing, liability, privileged access and confidentiality. Settling them in a standing agreement beforehand, with counsel involved, turns a favor into a plan.
Communication is also a people resource. Front-line staff need a single source of current downtime procedures for their market, refreshed each shift. A central command structure that issues one set of instructions for nineteen states will miss local differences in forms, lab couriers and pharmacy routes. Market-level command posts with clear authority, coordinated centrally, fit an outage of this shape better than either extreme.
Shared services: what stops everywhere
Centralization put more than the clinical record on shared platforms. Pharmacy systems, scheduling, patient portals, supply chain and revenue cycle typically run as shared services across a large system. Ascension’s own disclosures pointed to pharmacy and other clinical systems as well as the record, and its fiscal 2024 results cited delays in revenue cycle processes caused by the incident.
Each shared service needs its own answer to the question of what happens when it is unavailable in every market at once. For pharmacy, that means verified paper or standalone workflows for dispensing and controlled substances, and arrangements with outside pharmacies for discharge prescriptions. For supply chain, it means par levels and manual ordering routes that do not depend on the shared platform. For revenue cycle, it means a documented way to capture charges during downtime and a plan for the billing backlog.
Architecture choices sit underneath all of this. Segmenting shared platforms by region, keeping read-only copies of key patient data available per market, and isolating identity and backup systems from the main network all reduce the blast radius. Each adds cost and complexity, and centralization’s efficiency case rarely prices in the scenario where everything fails together. A useful exercise is to list every shared service, ask whether its loss in all markets for three weeks is survivable, and record who decided the answer.
None of this argues against scale. A large system can buy expertise, monitoring and recovery capacity that small hospitals cannot. Planning should simply stop treating the network as the backup for itself.
With hindsight
Electronic health record access was restored across Ascension’s markets by mid-June 2024, about five weeks after the attack. Ascension reported an operating loss of about $1.8 billion for its fiscal year ended June 30, 2024, and its filings cited revenue cycle delays and remediation costs from the incident among the factors. In December 2024 it reported to HHS that data on about 5.6 million people had been affected, taken from a small number of file servers rather than the clinical record, according to the company.
Other large health systems and their regulators took the multi-market scenario more seriously afterward. HHS’s proposed HIPAA Security Rule update, published in January 2025, included a 72-hour restoration expectation for critical systems, which sharpened the question of whether shared platforms can be restored market by market. The underlying tension remains: centralization lowers cost and raises the stakes of a single compromise, and that trade-off needs an explicit owner.