In a merged health system, the network decides which hospitals go to paper

The week

In early October 2022, CommonSpirit Health, one of the largest nonprofit health systems in the United States, reported an IT security incident that began around October 2. Hospitals operating under several regional names, including in Washington, Tennessee, Iowa and Nebraska, lost access to electronic health records and other systems for up to several weeks. Some reported delayed care and ambulance diversions. Other facilities in the system were not affected. On October 12, CommonSpirit confirmed that the incident was ransomware. It had taken systems offline as a precaution while it investigated and restored them. CommonSpirit had been formed in 2019 by combining two large Catholic health systems, Dignity Health and Catholic Health Initiatives, each with its own long history of acquisitions.

Earlier in this series we looked at long downtime from the bedside: UHS in 2020, where unit leaders carried the load, and Scripps in 2021, where four weeks on paper tested downtime plans. CommonSpirit adds a question those cases did not raise as sharply. Why did some of its hospitals go to paper while others, in the same system, did not?

The answer in any merged health system lies in architecture inherited from deals. Mergers combine hospitals faster than they combine technology. For years afterward, the organization runs a patchwork: some regions on a shared directory and network, others on their own, with connections added for each integration project. That patchwork, not the corporate org chart, decides which hospitals an intruder can reach and which a precautionary shutdown will take down. Three layers set the blast radius: shared identity, shared network paths, and the authority to order a shutdown that affects many hospitals at once.

Shared identity: one directory, one compromise

Integration usually starts with identity. Leaders want one email system, one set of accounts and single sign-on to shared applications. Directory trusts or a consolidated directory make that possible. They also mean that an attacker who gains administrative control of the directory gains a path to every hospital that trusts it.

Merged systems can keep the benefits while limiting that reach. Administrative accounts for each region can be separated, so a domain administrator in one region is not one in all. The most privileged identities can live in a hardened tier with phishing-resistant authentication and dedicated workstations. Trusts between legacy directories can be reviewed and removed where integration no longer needs them. Each of these adds administrative overhead, which central IT teams resist. That overhead is the price of keeping one compromised credential from becoming a multistate outage.

Separation also pays off in recovery. When identity is tiered by region, a region with no sign of compromise can be validated and restored on its own schedule. When everything trusts one directory, every hospital waits until that directory is rebuilt and proven clean. Service accounts deserve the same scrutiny. Accounts used by system-wide applications, backup tools and monitoring agents often hold broad rights everywhere, rarely change their passwords and are seldom watched. They are among the first things an intruder looks for.

Shared network paths: integration links as attack routes

Every integration project leaves network connections behind. They include links between data centers, shared clinical applications reached across regions, file shares used by system-level departments such as finance and revenue cycle. Many were opened broadly during a deadline and never narrowed.

Segmentation turns those links into controlled paths. Regions and major hospitals become separate zones. Traffic between zones is limited to named applications and protocols, logged, and reviewed. Clinical systems such as the electronic record, imaging and lab are isolated from general office networks. The goal is a design in which losing one zone is serious but survivable for the others, and in which isolating a zone is a planned action rather than an improvised one.

Measuring this is straightforward in principle. For each hospital, the architecture team can list which other zones it depends on to deliver care, and which zones could reach it if compromised. Hospitals that depend on a shared data center for their electronic record will go down with that data center, however well segmented their local network is. The same applies to shared vendors: a remote support tool or managed service provider with access to every region is a path across zones that no firewall rule between regions will show. Knowing that in advance tells leaders which hospitals need local read-only copies of critical data and which need independent downtime capability.

Shutdown authority: one decision, many hospitals

Taking systems offline as a precaution is often the right call in a ransomware incident. It stops spread and preserves evidence. In a merged system, it is also a decision made centrally that lands on hospitals with different patient loads, different downtime readiness and different local exposure.

That calls for written decision rights. Who can order a system-wide disconnection, and who can isolate a single region? What clinical input is required before a shutdown, and within what time? When can a hospital with no sign of compromise reconnect, and who decides? The plan should specify the evidence needed to bring a zone back, such as clean scans of its servers and rebuilt credentials, so reconnection is not delayed by uncertainty or rushed by pressure.

Regional hospital leaders need a seat in those decisions. A precautionary shutdown that protects nine hospitals may cut the tenth off from its electronic record during a busy week. That trade-off is legitimate, and leaders should make it knowingly, with ambulance diversion and transfer agreements ready for the hospitals that bear it.

Merger plans can include all three layers. Integration roadmaps typically count consolidation as progress. Adding blast radius as a measure, reported to the board alongside cost savings, makes the security consequence of each integration step visible before it is taken.

With hindsight

CommonSpirit restored its systems over the following weeks. It reported to HHS that data on 623,774 individuals had been affected, and in early 2023 it put the attack’s financial impact at about 150 million dollars, later raising the estimate to about 160 million. Attacks on large, multistate systems continued. In 2024 ransomware at Ascension disrupted electronic records across many of its hospitals for weeks. HHS published voluntary cybersecurity performance goals for health care in January 2024 and proposed updates to the HIPAA Security Rule, including network segmentation, in early 2025; their final form remains uncertain. Consolidation in health care has continued. By 2026 more health systems treat segmentation and identity tiering as integration requirements, and boards of acquisitive systems more often ask how far a single incident could spread.