From Health 201FailSystems

Cybersecurity event at UNM Health diverts ambulances and cancels clinic appointments and outpatient surgeries for a day

On 26 October 2026 a cybersecurity event at the University of New Mexico Health Sciences Center led UNM Health to divert ambulance traffic to other area health systems for about two hours. It also suspended outpatient surgeries and appointments for the rest of the day. UNM said critical systems were restored in phases from that afternoon, and clinics resumed scheduled care on 27 October.

Lexington, Massachusetts nursing home evacuated after recurring electrical failure; building de-energised

On the night of 24 October 2026 more than 100 residents were evacuated from a nursing and rehabilitation centre in Lexington, Massachusetts, after electrical problems that had recurred over several days. Officials ordered the building de-energised because other building systems, including sewage, were tied into the electrical system.

dcm4chee-arc-light imaging archive: CISA advisory on image deletion, forged studies and unauthenticated patient merges

CISA disclosed six vulnerabilities in the dcm4chee-arc-light medical imaging archive. According to the advisory, they could let an attacker delete stored images, file forged studies, reassign studies to another patient or cause a denial of service. CISA reported no known exploitation and recommends updating to version 5.35.2 or later.

Missed security update to a shared DNS service disrupts all three Singapore public healthcare clusters for about nine and a half hours

On 13 October 2026 a disruption across Singapore's three public healthcare clusters (NHG Health, NUHS and SingHealth) affected appointment booking, visitor registration, medication dispensing and billing for about nine and a half hours. In its reply to parliamentary questions, the Ministry of Health said the cause was a required security update to a shared Domain Name System (DNS) service. Synapxe had contracted a service provider to do the update, and it was not done before a scheduled global change.

PathConnectivity & data → Human handoff

Network outage takes computers offline across Mass General Brigham; hospitals move to downtime procedures

On 8 October 2026 a network outage took some computers and digital devices offline across Mass General Brigham. Its hospitals moved to downtime procedures, including paper forms, and some elective outpatient procedures did not go ahead. MGB said the outage was not linked to a cyberattack; the cause had not been stated.

Northern Territory government network outage reaches hospitals and emergency call handling

A fault in the Northern Territory government's core IT network disrupted every government agency for most of 8 October 2026. Hospitals including Royal Darwin Hospital started continuity plans, and officials said clinicians faced delays and could not reach some systems.

Manzanillo maternity hospital's backup microsystem and generator fail together during Cuban grid outage

During a national grid outage in Cuba in September 2026, the Fe del Valle Ramos maternity hospital in Manzanillo said its electrical microsystem failed at the same time as its generator. The hospital said the situation was resolved in a short period and that no complications among pregnant women, postpartum women or newborns were recorded.

Under review

VOCSN ventilators: loose internal flow-transducer connector can cause reboots; FDA early alert and Class I recall

React Health (Ventec Life Systems) warned that the internal flow transducer cable connector in VOCSN ventilators can unseat and cause reboots and recurring System Fault 10 alarms, which could interrupt ventilation. FDA called it a potentially high-risk device issue, and the VOCSN+Pro entry is classified Class I.

Philips Lumify ultrasound demands online re-registration and blocks scanning in pre-hospital settings

FDA issued an Early Alert in October 2026 after Philips reported that its Lumify ultrasound app may stop recognising a registered transducer and block scanning until re-registration, which requires Wi-Fi or cellular access. As of 29 September 2026 Philips had reported eight serious injuries and four deaths associated with the issue.

PathConnectivity & data → Devices

Nashville hospital pharmacy dispenses potassium phosphate labelled as anaesthetic; state report says barcode scanning could be overridden

On 14 August 2026 four joint-replacement patients at Ascension Saint Thomas Midtown received potassium phosphate instead of the anaesthetic mepivacaine. NewsChannel 9 reported that a state survey report found the pharmacy system let technicians override barcode scanning, and that the pharmacist's final check also missed the wrong drug.

LATITUDE Clarity server software can hold back AF Burden alerts from LUX-Dx implantable cardiac monitors

Boston Scientific notified clinics that its LATITUDE Clarity remote-monitoring server can delay AF Burden alerts from LUX-Dx insertable cardiac monitors until the next full device interrogation when a non-default threshold is set. The implanted monitors keep detecting and transmitting data; one complaint and no injuries were reported.

StatStrip Gen 2.0 hospital glucose meters can file a result under the previously scanned patient; Class I recall

Nova Biomedical's StatStrip Gen 2.0 hospital glucose meters can keep a previously scanned patient or quality-control barcode on screen. If the operator accepts it, the glucose result is filed under the wrong patient. FDA classified the recall as Class I, and as of 5 October 2026 Nova had reported one serious injury and no deaths.

Survey of UK GPs: a third of ambient AI scribe users report errors often or always

In a nationwide online survey of 1,003 UK GPs in August 2025, 141 used ambient AI scribes. Of these users, 32% reported errors often or always, and 14% reported errors with significant-to-critical implications. All figures are self-reported.

Case report: chatbot affirmed a manic patient's delusions and discouraged his antipsychotic; care plan restricted its use

A BMC Psychiatry case report describes a man in his 30s with substance-induced manic psychosis whose ChatGPT conversations, according to the authors, affirmed his perceived 'spiritual awakening' and discouraged his prescribed antipsychotic. His inpatient care plan restricted AI chatbot use; the authors state that any contribution of the chatbot to his illness cannot be determined.

Update pending

Ontario auditor: all 20 approved AI scribes produced inaccurate notes in testing

Ontario's Auditor General found every AI scribe on the province's approved vendor list had fabricated, wrong or missing content in procurement tests, including 12 of 20 recording the wrong drug.

Pharmacy AI phone agent garbled drug names and placed wrong and duplicate refills

A pharmacy chain's AI voice and text assistant for refills mispronounced medications, ordered wrong dosages and duplicate refills, and gave callers no keypad alternative; after hundreds of complaints the chain pulled it back.

Under review

Medicare's AI-assisted WISeR prior-authorization pilot: records and reporting describe long delays and erroneous denials

CMS's WISeR model, in which technology vendors use AI and machine learning to review prior-authorization requests in traditional Medicare, launched in January 2026 in six states. CMS records obtained by EFF and reporting by KFF Health News describe long delays, an erroneous denial and a vendor that said it would auto-approve requests until its system was fully functional.

Update pending

FreeStyle Libre 3 sensors report falsely low glucose

Some Libre 3 and 3 Plus continuous glucose sensors read lower than actual glucose; FDA classified the correction Class I after reports of 860 serious injuries and 7 deaths.

AWS us-east-1 DynamoDB DNS failure disrupts cloud-hosted clinical systems

A race condition in DynamoDB's DNS automation broke a core AWS region for about 15 hours. Some cloud-hosted EHR users slowed or went to paper; others saw nothing.

Endoscopists detect fewer adenomas without AI after AI is introduced

After AI polyp detection was introduced, the adenoma detection rate of standard non-AI colonoscopy fell from 28.4% to 22.4%.

Under review

Coding agent deleted a production database during a code freeze, then misreported recovery (non-clinical analogue)

Non-clinical analogue. An AI coding agent with write access ran destructive commands against a live database despite an instruction to freeze changes, then said rollback was impossible when it was not.

BD Alaris infusion sets perform worse than previously disclosed at low rates; Class I recall updated

BD recalled certain infusion sets used with the Alaris Pump Module 8100 after its testing showed performance could differ from the user manual, and in 2026 disclosed that some sets perform worse than previously stated. FDA identifies the recall as Class I, the most serious type.

Iberian Peninsula blackout

A grid collapse cut power to continental Spain and Portugal for about ten hours. Hospitals largely held on generators; care outside them did not.

Under review

Sepsis alert nearly led to fluid loading of a dialysis patient

An automated sepsis alert triggered a protocol for large-volume IV fluids in a dialysis patient; the nurse objected, was told to follow the protocol, and a physician intervened.

Update pending

Alaris infusion interoperability backlog can load outdated pump orders

A Class I software correction found that backlogged EHR-to-pump automated programming requests could load stale rate, dose or volume parameters.

Contec CMS8000 patient monitors: hidden remote-access function disclosed by CISA and FDA

CISA and FDA reported that a low-cost patient monitor's firmware contained hidden functionality that could allow remote access and sent patient data to an external address; independent researchers later judged it an insecure design rather than an intentional backdoor.

Update pending

Whisper-based medical transcription invents text, and the audio is deleted

Researchers and an AP investigation found OpenAI's Whisper speech-to-text model inserting fabricated sentences, and a Whisper-based clinical scribe used by over 30,000 clinicians erased the source audio, removing the way to check.

CrowdStrike Falcon content update crashes Windows hosts, including hospital systems

A faulty Rapid Response Content update to CrowdStrike's Falcon sensor crashed about 8.5 million Windows devices worldwide. Outside-in measurement found disrupted services at 759 of 2,232 US hospitals studied.

PathDevices → Connectivity & data → Human handoff

Synnovis pathology ransomware, South-East London

Ransomware hit Synnovis, the pathology provider for several south-east London NHS trusts and GP practices. Blood testing and matching collapsed, more than 11,000 appointments and procedures were postponed, O-type blood ran short nationally, and one death was later partly attributed to a delayed result.

PathConnectivity & data → Human handoff

Ascension ransomware and multi-week EHR downtime

A ransomware attack took Ascension's electronic records offline for about five weeks. Clinicians told KFF Health News of medication errors and delayed lab results, and one said he had no training for the attack; Ascension said its care teams were trained for such disruptions.

Update pending

Change Healthcare ransomware and national claims/pharmacy clearinghouse outage

Attackers used stolen credentials on a Change Healthcare Citrix remote-access portal that had no multi-factor authentication, then deployed ransomware nine days later. Disconnecting the clearinghouse stalled pharmacy claims, medical claims and payments across the US.

PathConnectivity & data → Human handoff

Update pending

Post-acute care denials rose as UnitedHealthcare automated prior authorization; lawsuit targets nH Predict

A class action alleges UnitedHealth used naviHealth's nH Predict model to cut off post-acute care; a Senate investigation found UnitedHealthcare's post-acute denial rate nearly tripled while it automated prior authorization.

Wrong AI suggestions pull radiologists' mammogram ratings off

In a controlled experiment, 27 radiologists' accuracy on mammograms fell sharply when a purported AI suggested an incorrect BI-RADS category.

Guy's and St Thomas': heatwave cooling failure takes down both data centres

Air conditioning tripped at both trust data centres on the UK's record-heat day. Clinical IT went down and the trust ran on paper for weeks.

Under review

Philips Respironics ventilator, BiPAP and CPAP recall over degrading sound-abatement foam

Philips recalled about 15 million breathing devices because PE-PUR foam could degrade into particles and chemicals the patient could inhale; remediation ran years and ended in a consent decree.

Epic Sepsis Model missed two-thirds of sepsis cases in external validation

An independent validation of Epic's proprietary sepsis score found it far less accurate than the vendor reported: it missed 67% of sepsis cases while alerting on 18% of all hospitalizations.

Ransomware spillover to adjacent San Diego emergency departments

A month-long ransomware attack on a health system with about 25% of regional inpatient discharges drove patients and ambulances to two unaffected academic EDs, raising their census, waits and stroke activations.

PathConnectivity & data → Human handoff

Texas winter storm: record load shed, hospitals lose water and heat

Freezing weather knocked out generation and forced the largest controlled load shed in US history. Power loss spread to water systems and hospitals, and to patients at home on powered medical equipment.

PathPower → Devices → Human handoff

Pulse oximeters overestimate oxygen saturation in patients with darker skin

Paired SpO2/SaO2 data showed occult hypoxemia missed by pulse oximetry about three times as often in Black as in White patients, delaying treatment decisions.

VA Oracle Cerner EHR 'unknown queue' silently dropped clinical orders

After go-live, the new EHR routed more than 11,000 clinical orders to a hidden queue instead of the intended service, without telling the ordering clinician; VHA identified 149 adverse events.

Universal Health Services enterprise-wide IT shutdown

A security incident led UHS to suspend user access to IT applications across its US operations; facilities ran on offline documentation for up to several weeks.

Sepsis model switched off after COVID-19 changed the patient mix

Weeks after its first COVID-19 admissions, the University of Michigan paused Epic sepsis alerts because dataset shift produced spurious alerting; its clinical AI committee decommissioned the model.

Care-management algorithm under-referred Black patients because it predicted cost, not illness

A widely used commercial risk algorithm assigned Black patients the same scores as healthier White patients, because it was trained to predict health-care spending, which is lower for Black patients at the same level of need.

Under review

Uber automated test vehicle kills pedestrian while safety operator is distracted (non-clinical analogue)

Non-clinical analogue. The human operator meant to back up an automated driving system was looking at her phone; the NTSB cited automation complacency.

Hurricane Irma: nursing home loses air conditioning while power stays on

Irma knocked out the transformer feeding a nursing home's air conditioning. 14 residents died; 12 deaths were ruled homicides.

Update pending

WannaCry ransomware across the NHS in England

A self-spreading ransomware worm infected 34 English trusts and 603 primary-care and other NHS organisations, and at least 46 more trusts were disrupted. Thousands of appointments were cancelled and five hospitals diverted ambulances.

PathConnectivity & data → Devices → Human handoff

Princeton Community Hospital Petya ransomware

Ransomware made the EHR inaccessible; the hospital moved to paper within an hour and restored computers after 36 hours.

LeadCare blood lead analyzers return falsely low results; malfunction concealed

Magellan's LeadCare devices, used for more than half of US blood lead tests 2013-2017, gave falsely low results on venous samples; the company delayed telling FDA for 21 months.

Update pending

Superstorm Sandy: NYU Langone and Bellevue lose backup power and evacuate

Storm surge flooded basements holding fuel tanks and pumps at two Manhattan hospitals whose generators sat on upper floors. Both hospitals evacuated.

Patient dies while a heart monitor's crisis alarm is switched off

A patient on a cardiac monitor died after the monitor's crisis alarm had been left off; lower-level alarms sounded at the nurses' station but went unheeded.

ICU patient dies after alarms go unanswered for an hour

A 60-year-old ICU patient's monitor alarmed for rising heart rate and falling oxygen saturation; staff responded only after about an hour, when he had stopped breathing.

Update pending

Air France 447: autopilot hands a stalled aircraft back to a crew (non-clinical analogue)

Non-clinical analogue. Iced pitot probes caused inconsistent airspeeds, the autopilot disconnected, and the crew did not recognise or recover from a stall.

Update pending

Hurricane Katrina: Memorial Medical Center loses all power

After city power failed, Memorial ran on generators that failed as floodwater rose. 45 bodies were later recovered from the hospital.

Under review

Northeast blackout: New York City hospital generators fail

During the 2003 blackout multiple NYC hospital emergency generators failed. The outage was associated with about 90 excess deaths citywide.

Beth Israel Deaconess network collapse

A network loop took down clinical applications at an academic medical centre for about four days, forcing a return to paper it had abandoned years earlier.