Ransomware made the EHR inaccessible; the hospital moved to paper within an hour and restored computers after 36 hours.
Sources checked when written 26 September 2026
TierEHR and email down; paper and pen for medication and lab orders for about 36 hours. How tiers are assigned.
What happened
As recounted by the Joint Commission, staff arrived to find Petya ransomware notices. The EHR was inaccessible and email was down. Within an hour, the hospital activated its incident response plan and moved to paper and pen for medication and lab orders. It stayed open but diverted emergency cases. Surgeries and diagnostics continued, except for a few patients whose allergy information could not be accessed. IT had computers running again 36 hours after the attack using cloud backup and disaster-recovery software, but had to replace hard drives (TJC SEA 67, citing Healthcare IT News, Aug. 2017).[1,2,3]
Documented harm
none documented
What it teaches
A rehearsed plan got the hospital to paper within an hour.
Tested backups set how long you stay at tier 2.
Allergy information was the gap that stopped some procedures, so make sure it is in the downtime snapshot.
Information only, not advice. FailSystems is an aggregation and synthesis of published sources. It is not consulting, engineering, legal, regulatory or medical advice, and using it creates no professional relationship. Health systems are complex and no approach fits every organisation: anything you adopt is your own decision, at your own risk, and should be checked against the current official sources and by qualified people who know your setting. Full disclaimer.
Dealing with an incident right now? This site is a reference, not an incident-response service. Activate your organisation's emergency operations plan and incident command, and:
Power loss, disaster or resource needs: go through your local or county emergency management. They escalate to the state, and the state requests FEMA support; hospitals do not call FEMA directly.
A medical device problem: report it to the manufacturer and to FDA MedWatch.
Outside the US: your national emergency number and national cyber agency (in the UK, NCSC).