What a nationwide EHR outage at UHS asked of nurses and unit leaders

The week

Late on Sunday, September 27, 2020, Universal Health Services, one of the largest hospital and behavioral health operators in the United States, was hit by a cyberattack that took systems offline across its network. The company operated around 400 facilities in the U.S. and the United Kingdom. Staff at many sites reported reverting to paper charting, manual orders and phone calls, and some facilities diverted ambulances or delayed procedures. Media reports widely attributed the attack to the Ryuk ransomware.

UHS said it had shut down its systems as a precaution, that patient care continued using established backup procedures, and over the following weeks it restored systems site by site. The company later reported that the incident had a material financial impact on its results.

Hospitals have had downtime procedures for as long as they have had electronic health records. Most were written for a short, local event: one hospital, one system, a few hours. The UHS attack tested them at a different scale, with a national network losing core systems for days and, at some sites, weeks. Readiness turned out to be held less in documents than in people. We look at four distinct pieces of that capability: the workflows that degrade first, the staff who carry the extra load, the clinical information that goes missing, and the work of returning to electronic operation.

The workflows that degrade first

Processes do not fail at the same rate. In an extended outage, the most dangerous gaps tend to appear in three places.

• Medication administration. Barcode scanning and electronic records normally catch wrong-patient and wrong-dose errors. On paper, those checks depend on a second person and a legible order.
• Results. Laboratory and imaging results stop flowing to clinicians automatically. Someone has to phone, print or carry them, and track who has seen what.
• Orders. Orders revert to paper and must be transcribed, interpreted and followed by hand, often by staff who rarely wrote one.

Behavioral health facilities, a large part of the UHS network, add their own concerns. Observation rounds, restraint and seclusion documentation and medication timing are tightly regulated and safety-critical. Each needs a tested manual equivalent. A binder that has not been opened since it was written is not a tested equivalent.

The staff who carry the extra load

Many nurses, residents and pharmacists working in 2020 had trained entirely on electronic systems. Paper ordering, manual medication reconciliation and handwritten notes were unfamiliar. In an outage, unfamiliar work is slower and raises the cognitive load on people already at capacity.

That makes downtime a workforce matter in three ways. It needs training, including drills long enough to surface real problems, such as a full shift with a medication pass and a handoff. It needs staffing flexibility, because the same census takes more people and more time without systems. And it needs attention to fatigue across a long event, when strain accumulates day after day and agency staff unfamiliar with local paper forms arrive to help.

Nurse managers and unit leaders decide whether a unit functions during downtime. They choose who runs the paper medication record, who walks results and when to call for help. Giving them ownership of readiness, with IT and clinical informatics in support, puts accountability where the decisions are made. A practical measure is the share of staff on each unit who have worked a drilled downtime shift in the past year.

The clinical information that goes missing

Clinicians in an outage lose history: allergies, recent results, current medication lists, code status and advance directives. Some organizations keep read-only downtime viewers, or periodic printed or locally stored summaries per unit, to bridge the gap. Those tools help only if they are refreshed often, stored where the same attack cannot reach them, and known to the people who need them at 3 a.m.

Communication fails in the same way. If email, paging, secure messaging and the phone system share infrastructure with clinical systems, one attack can silence them all. Hospitals need out-of-band ways to reach staff and coordinate across sites, tested before they are needed. A list of cell phone numbers in a locked drawer is a start, not a system.

There is also a patient flow dimension. Bed boards, transfer center tools and ambulance status systems are often electronic. Without them, house supervisors manage capacity on whiteboards and phone calls, and decisions about diversion become harder to coordinate with EMS.

The return to electronic operation

Recovery is its own workload, and often a longer one than the outage. Paper records created during downtime must be entered or scanned into the record. Orders must be reconciled, charges captured and results matched to the right patients. Without a plan, back-entry creates a second wave of risk, including duplicate orders, missing allergies and gaps in medication history. It also delays billing, which strains finances already hit by the incident.

Sequence needs clinical judgment. Which systems return first, which units go live first, and how to confirm that restored data is complete and untampered are decisions that need both technical and clinical input. A staged return, with a clear cutover time per unit and a rule for which record is authoritative during the transition, avoids two sources of truth.

Back-entry also needs people. Health systems that pre-identified a pool of staff, such as clinical documentation specialists, informatics nurses or trained agency staff, could start reconciliation without pulling nurses off the floor. Those that had not found the backlog competing with patient care for the same hours.

The practical test of readiness is short. Can a unit run a full shift, including a medication pass and a shift handoff, without its electronic systems? Can it do so on a weekend night with normal staffing? Can the hospital put that shift’s paper back into the record within a set time? If any answer is no, the plan on file is not the plan that will run.

With hindsight

The UHS attack was followed by a long run of attacks on U.S. health systems. In late October 2020, CISA, the FBI and HHS jointly warned of an increased and imminent ransomware threat to hospitals. Several large health systems suffered multi-week electronic record outages in the years that followed. The 2024 attack on Change Healthcare extended the problem to shared infrastructure, pushing providers and pharmacies back to manual claims and prescription workflows they had not used in years.

Extended downtime is now treated as a realistic scenario, and recovery often takes weeks. HHS’s voluntary cybersecurity performance goals for the health sector, published in January 2024, emphasize incident planning and preparedness. The organizations that have fared best treat downtime as a clinical operations competency, with regular drills, protected downtime data, out-of-band communications and staffed plans for back-entry.