"It's not if, but when," said Sylvia Devlin, director of clinical application operations at Radiology Partners, who spoke about a previous experience with a ransomware attack.

Devlin said the department’s older scanners didn’t have a way to export data, and as they needed to wait for service technicians to come onsite, they ended up using new imaging modalities, resulting in lower throughput.


“We couldn’t risk losing any of our patients’ imaging studies,” Devlin said.

Jonathan Shoemaker, administrative director, of imaging systems and services at Stanford Health Care, provided an overview of the department’s platform dataflow, which replicates all of the environments with backups in case of a system failure.

Shoemaker encouraged attendees to establish procedures to address core systems if they’re compromised.

“If you had to recover from bare metal, how would you provide clinical care for the next 30 to 60 days?” Shoemaker asked. “If you do have a backup system, can it maintain the enterprise load?”

Shoemaker noted that it was important to assess skills across a team and cross trained staff so that if certain experts are on vacation or unreachable, you can still move forward with recovery efforts, without staff working 24/7.

“Make sure that there’s a clear escalation path for them to utilize when they do have a barrier,” Shoemaker said, “and celebrate their successes daily.”

Back to HCB News

Business Affairs Homepage