Four weeks on paper: what Scripps exposed about downtime plans

The week

Scripps Health, a large nonprofit health system in San Diego, detected a ransomware attack on May 1, 2021 and took many information systems offline, including access to its electronic health record and its patient portal. During the first week of May, Scripps diverted some ambulance traffic and some patients to other facilities, and clinicians worked on paper. Core systems were restored gradually over close to four weeks, with portal access returning at the end of May. Scripps later notified about 147,000 people that personal and health information had been taken from documents stored on its network, and its financial disclosures that summer put the cost at about $113 million in lost revenue and added expenses. The incident drew attention because of its length and because it hit a large, well-resourced system.

Every hospital has downtime procedures. Most were written for planned maintenance or an unplanned outage of hours, perhaps a day. Scripps showed what happens over weeks. A short-outage plan treats the problem as one thing: keep caring for patients until IT brings the system back. A long outage splits it into three fronts that move at different speeds and need different owners: clinical continuity, the ability to deliver safe care without the record; revenue continuity, the ability to capture, code and bill that care; and workforce endurance, the ability of staff to sustain manual work far longer than anyone had rehearsed.

Clinical continuity: paper works, briefly

In the first hours of an outage, paper works. Clinicians know their patients, downtime forms are printed, and read-only downtime reports give recent medication lists, allergies and results. After a few days those reports are stale. New patients arrive with no accessible history. Lab and imaging results must be walked or phoned to units. Medication administration, which depends on barcode scanning and electronic orders, becomes slower and more error-prone.

Downtime tools are snapshots, and a long outage needs a living record. That means structured paper documentation designed for reconciliation later, manual tracking boards for bed status and pending results, and clear rules on which information must be entered into the EHR when it returns. It also means an isolated, read-only copy of critical patient data that can be refreshed and accessed without the compromised network, something many organizations lacked in 2021.

Diversion is the hardest clinical decision. Leaders need criteria agreed in advance for when to stop accepting stroke, trauma or other time-critical patients they cannot safely treat. A long outage at a large system does not stay inside its walls. When Scripps diverted ambulances, neighboring hospitals absorbed the load at a time when emergency departments were already stretched by the pandemic. Referring clinics lost access to results, and patients due for infusions or procedures had to be reached by phone. Regional emergency medical services, public health agencies and nearby hospitals should be part of the plan: how diversion will be announced, how records will move when systems are down, and how mutual aid will work beyond the first few days.

Revenue continuity: the outage continues after recovery

The second front is financial. When registration, charge capture, coding and claims systems are down, care is still delivered but not billed. Paper encounters pile up. When systems return, each one must be entered, coded and submitted, often with incomplete documentation and with timely filing limits running. Cash falls during the outage and stays weak through the backlog.

That is why a four-week clinical outage can affect a health system’s finances for months. Scripps’s own disclosures showed the pattern: most of its estimated cost was lost revenue, with incident response and recovery a smaller share. Planning means knowing how many days of operating expenses the organization can cover without claims income. It also means knowing which payers might advance payments, whether a credit line can be drawn quickly, and who will staff the backlog. Some organizations pre-arrange surge coding support with outside firms. Others set rules in advance for which accounts are worked first, usually by value and filing deadline.

These are finance and revenue cycle questions, and in 2021 they rarely appeared in IT incident plans. The chief financial officer owns this front, with the revenue cycle leader running the backlog. Their plan should be exercised alongside the technical recovery plan, because the order in which systems return determines when billing can restart.

Workforce endurance: rehearsed for hours, needed for weeks

The third front is people. Manual processes take more time and attention. Nurses chart on paper and later help reconcile it. Pharmacists verify orders by phone. Registration staff rebuild patient records by hand. Physicians work without the decision support and alerts they rely on. Fatigue builds, and the risk of error rises with it.

Endurance needs explicit management. That includes extra staffing on units, shorter shifts where possible, runners to carry results and orders, and support for staff who feel unsafe practicing without familiar safeguards. Communication matters as much. Staff need regular, accurate updates on what is working, what is not and when to expect change. Patients need to know how to reach their care team when the portal is down. Leaders who treat this communication as part of the clinical response reduce confusion and frustration.

Each front therefore needs its own named owner. Clinical leaders own care continuity and diversion criteria. Finance owns cash and backlog. Nursing leadership and human resources own staffing and support. IT owns recovery sequencing, which should be agreed in advance with the other three, because the order in which systems come back decides which front recovers first. Exercises should run the scenario for several weeks, not a single shift, and should include the people who would actually carry the load.

With hindsight

From 2026, Scripps reads as a preview of larger events. In February 2024, the attack on Change Healthcare disrupted claims processing and pharmacy services across much of the US health system, turning the revenue continuity front into a national problem. In May 2024, Ascension, one of the largest US health systems, spent weeks with major clinical systems unavailable after a ransomware attack. Both reinforced the three fronts. Health systems have since expanded downtime planning: more now rehearse multi-week scenarios, keep isolated read-only copies of critical records, and include finance and workforce leaders in exercises. HHS published voluntary cybersecurity performance goals for the sector in 2024. The basic arithmetic has not changed. The longer the outage, the more the burden moves from technology teams to clinicians and finance staff, and plans have to be written with them.