You’ll see more focus on preventing and responding to healthcare system cyberattacks...in the aftermath of recent major outages.
And it’s a matter of when...not if...an attack will happen again.
Follow your provincial laws, pharmacy policies, and common sense to best serve your patients during an outage...and guard against future threats.
Prevent. Be aware that over 90% of all cyberattacks start with a phishing email...which often looks like it’s from a company or person you know, such as a wholesaler or leader in your organization (CEO, etc).
Report signs of phishing, such as misspellings, poor grammar, etc.
Minimize other vulnerabilities. Use strong, unique passwords at least 12 characters long...and ensure security software is current.
Be familiar with your pharmacy’s downtime plan...or help devise one, if needed. Make sure all staff members know where these plans are located...so they can access them ASAP when systems go offline.
Respond. Keep the lines of communication open during an outage.
But choose your words carefully when talking with patients...to limit panic. Saying something like “Computer systems nationwide aren’t working” is less alarming than saying “There’s a cyberattack” or “The computer system has been hacked.”
Empathize...and offer options. For example, let patients know how to get reimbursed for an Rx if they pay out of pocket...ask the pharmacist if they can give a few doses...or offer to call when systems are back up.
Document as necessary...such as by noting “emergency supply” for Rxs dispensed in good faith to provide continuity of care. This can help your pharmacy recoup payment and limit audit issues.
Remember that MANY safeguards may be unavailable...on top of unfamiliar workflows. Ensure med lists are current if computer alerts (interactions, etc) are down.
Recover. Watch for mix-ups during the recovery phase...such as if both fax and paper versions of the same Rx were issued. Work with your pharmacist to resolve issues...especially with controlled substance Rxs.
Dig into our resource, Dealing With Disasters, for more tips.
- Office of Information Security: Securing One HHS. Ransomware & Healthcare. January 18, 2024. https://www.hhs.gov/sites/default/files/ransomware-healthcare.pdf (Accessed March 5, 2024).
- Pinkham DW, Sala IM, Soisson ET, et al. Are you ready for a cyberattack?. J Appl Clin Med Phys. 2021 Oct;22(10): 4-7. https://doi.org/10.1002/acm2.13422 (Accessed March 5, 2024).
- Cartwright AJ. The elephant in the room: cybersecurity in healthcare. J Clin Monit Comput. 2023 Oct;37(5):1123-1132.
- Checklist: Basics for Dealing With Natural Disasters