Hospital technology leaders are pressing a message that reads oddly in an era of digitization: clinical teams have to be able to keep treating patients with the network dark. The push, reported this week and attributed to Jefferson Health chief information officer Luis Taveras, reflects an uncomfortable arithmetic – every system a hospital adds also becomes a way for care to stop.
An intruder inside a hospital network does not need to touch a ventilator. Losing the EHR takes away records, diagnostic reports, medication lists and care plans at once, which slows decisions and raises the odds of error in emergency departments and intensive care units where minutes decide outcomes.
The recommended posture is unglamorous. Offline backups that ransomware cannot encrypt, printed downtime documentation kept current, staff drilled on paper workflows, and exercises run often enough that the switch is muscle memory rather than improvisation. Security teams are also moving from quarterly patch cycles to continuous monitoring and faster update cadence.
There is a measurement argument behind the urgency. A study in the American Economic Journal: Economic Policy linked cyberattacks at hospitals to a rise in mortality, from 28% to 34%, though the methodology deserves scrutiny before anyone quotes it as a forecast.
For a healthcare CISO the practical question is blunt: if the network went down at 2 a.m., could your hospital run until noon without it?
