Dealing with digital paralysis: Surviving a cyberattack in a National Cancer center.

INTRODUCTION: Cyberattacks represent a growing threat for healthcare delivery globally. We assess the impact and implications of a cyberattack on a cancer center in Ireland. METHODS: On May 14th 2021 (day 0) Cork University Hospital (CUH) Cancer Center was involved in the first national healthcare ransomware attack in Ireland. Contingency plans were only present in laboratory services who had previously experienced information technology (IT) failures. No hospital cyberattack emergency plan was in place. Departmental logs of activity for 120 days after the attack were reviewed and compared with historical activity records. Daily sample deficits (routine daily number of samples analyzed - number of samples analyzed during cyberattack) were calculated. Categorical variables are reported as median and range. Qualitative data were collected via reflective essays and interviews with key stakeholders from affected departments in CUH. RESULTS: On day 0, all IT systems were shut down. Radiotherapy (RT) treatment and cancer surgeries stopped, outpatient activity fell by 50%. hematology, biochemistry and radiology capacity fell by 90% (daily sample deficit (DSD) 2700 samples), 75% (DSD 2250 samples), and 90% (100% mammography/PET scan) respectively. Histopathology reporting times doubled (7 to 15 days). Radiotherapy (RT) was interrupted for 113 patients in CUH. The median treatment gap duration was six days for category 1 patients and 10 for the remaining patients. Partner organizations paused all IT links with CUH. Outsourcing of radiology and radiotherapy commenced, alternative communication networks and national conference calls in RT and Clinical Trials were established. By day 28 Email communication was restored. By day 210 reporting and data storage backlogs were cleared and over 2000 computers were checked/replaced. CONCLUSION: Cyberattacks have rapid, profound and protracted impacts. While laboratory and diagnostic deficits were readily quantified, the impact of disrupted/delayed care on patient outcomes is less readily quantifiable. Cyberawareness and cyberattack plans need to be embedded in healthcare. POLICY SUMMARY: Cyberattacks pose significant challenges for healthcare systems, impacting patient care, clinical outcomes, and staff wellbeing. This study provides a comprehensive review of the impact of the Conti ransomware attack on cancer services in Cork University Hospital (CUH), the first cyberattack on a national health service. Our study highlights the widespread disruption caused by a cyberattack including shutdown of information technology (IT) services, marked reduction in outpatient activity, temporary cessation of essential services such as radiation therapy. We provide a framework for other institutions for mitigating the impact of a cyberattack, underscoring the need for a cyberpreparedness plan similar to those made for natural disasters and the profound legacy of a cyberattack on patient care.

Room to Improve: An Audit of In-Hospital End-of-Life Care for Oncology Patients in a Tertiary Cancer Centre in Ireland During the COVID-19 Pandemic.

The COVID-19 pandemic compounded isolation for patients through social distancing measures and staff shortages. We were concerned about the impact of COVID-19 on the quality of care provided at end-of-life in 2021 in a national cancer centre, and instigated the first ever review of the care of the dying. Quality of care was assessed retrospectively using a validated instrument developed by the United Kingdom's National Quality Board. Sixty-six patient deaths occurred in our cancer centre in 2021. The 'risk of dying' was documented in 65.2% of records. Palliative care services were involved in 77%, and pastoral care in 10.6%. What was important to the patient was documented in 24.2%. The 'quality-of-death' score was satisfactory for most but poor in 21.2%. Our study prompted change, including appointment of an end-of-life coordinator, development of a checklist to ensure comprehensive communication, expansion of the end-of-life committee to include junior doctors, and regular audit.