The University of Mississippi Medical Center (UMMC) closed all 35 of its clinic locations statewide and canceled most appointments on Thursday, Feb. 19 due to a ransomware cyberattack that hit its information technology systems.
“Due to a cybersecurity attack, many UMMC IT systems are down, including access to our electronic medical records, Epic,” the center said in a social media post on Thursday morning. “Today, all UMMC clinic locations statewide are closed.”
UMMC also reported that elective, non-emergency appointments were canceled due to the attack.
“Outpatient and ambulatory surgeries/procedures and imaging appointments are canceled and will be rescheduled,” the center said. “Hospital services are continuing for our patients using downtime procedures.”
At a press conference in Jackson, Miss., on Thursday afternoon, LouAnn Woodward, vice chancellor for health affairs and dean of the school of medicine of UMMC, clarified that the attack was a ransomware attack, that the center is in contact with the attackers and that it is working with authorities, including the Federal Bureau of Investigation, the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency on how to proceed.
“The attackers have communicated to us and we are working with the authorities and specialists on next steps,” Woodward said. “We do not know how long this situation may last.”
Woodward also shared that it was unclear if patient information or payment information was compromised during the attack.
Robert Eikhoff, special agent in charge of the FBI’s Jackson Field Office, was also in attendance at the press conference.
“It is too early to communicate what we do and don’t know,” Eikhoff said. “We are in the process of surging resources both locally and nationally into this incident to make sure we are standing alongside UMMC and their vendors as we look to understand the extent of this attack and then the actions we need to take to help them on the path to recovery, with the number one priority being helping them get their systems up and providing services to their patients.”
The center also clarified that they would not handle elective procedures Thursday, meaning operations scheduled in advance or that do not require emergency or urgent medical care.
“We are just trying to minimize the amount of operational turbulence that there is by doing elective things,” Dr. Alan Jones, associate vice chancellor for health affairs at UMMC, said.
Emergency patient care and UMMC class instruction remains unchanged, the center clarified.
“Patients in our hospital and our emergency department are being cared for. Clinical equipment and operations remain functional,” Woodward said. “We are using our downtime procedures. For our students, in-person classes will continue as scheduled.”
Jones also added that the center has worked without emergency medical records before, as scheduled downtimes for maintenance or software updates are common.
“We have downtime procedures, so we know how to take care of patients without EMR and I can assure you that at the point of care, all of our processes are intact,” Jones said. “All of our equipment works. All of our patients are being taken care of safely. There will be no patient impact as a result of this downtime.”
Jones also clarified that Mississippi MED-COM, the emergency communications system of UMMC, remains operational, and that it is designed to function independently from the center.
University Health Services, which provides health services for students and faculty at the UM campus in Oxford, was not affected by the attack.
UMMC officials said that more information will be released as it becomes available.
