Three weeks after a cyber attack led to a network outage at Scripps Health, employees say some systems are coming back online.
According to reporting from ABC News, several Scripps Health workers said they’d regained access to “read-only” medical records from before May and payroll systems, along with some computers, emails, and X-rays. Its Epic-powered patient portal, MyScripps, was still down as of Thursday.
“While some features on our website are still being worked on and are not quite ready for use yet, most of scripps.org is back up and running,” said the health system in an update on the Facebook page.
Attempts to reach the organization by phone and email for comment were not successful.
After detecting a security incident on May 1, Scripps suspended user access to its IT applications.
The San Diego-based health system continues to keep mum about the specifics of the attack.
In a statement posted to the website, Scripps said, “In response to the cybersecurity incident on May 1, our team immediately took steps to contain the malware by taking a significant portion of our network offline.”
“We also immediately engaged outside consultants and experts to assist us in our investigation and other experts to help us restore our systems and get back online as soon as possible,” the organization added.
The breadth of potentially exposed personal information remains unclear, Scripps said.
“The investigation into the scope of the incident, including whether data were potentially affected, remains ongoing,” the statement said.
“Depending on the investigation’s findings, we will be sure to provide notifications to affected individuals in accordance with all applicable laws,” it continued.
The statement reiterated that in-person care was still available and that patients could and should confirm appointments via phone. It noted that the Scripps team had backup workflows and paper processes in place, and that care providers currently had “view-access” to patient history and records. Virtual visits were also still available.
“Physician and staff leadership at each site are reviewing scheduled surgeries, infusions, imaging, lab and all other patient care services regularly. If certain services and appointments need to be rescheduled, we are reaching out to patients directly when possible,” read the statement.
It advised that requests for medical records should be completed by mail.