HSE cyberattack to result in financial and ‘human costs’ Paul Reid
about 4 years in The Irish Times
Evidence of “incidents and near misses” have emerged as Health Service Executive (HSE) staff manually upload patient records due to the impact of the cyberattack on the organisation’s computer systems.
A briefing document provided to TDs and Senators says that around 1,400 paper-based incident reports have been made to the State Claims Agency (SCA) “thus far”.
The HSE could not last night say if there had been a higher number of incidents as a result of the cyberattack, which happened on May 14th last, than in normal times.
The information was provided to the Oireachtas health committee ahead of an appearance on Wednesday by HSE chief executive Paul Reid.
He is expected to tell the committee that the HSE now has 75 per cent of its server estate decrypted as it continues to work to restore its network following the attack. The focus has been on those systems “most most critical to patient care in the first instance”.
His opening statement says 70 per cent of the HSE’s “end-user devices” are now available.
He says staff are working “extremely hard to keep services going in the face of the enormous challenges presented by the cyberattack and ensuing shutdown”.
‘Human costs’
“There is no underestimating the damage this cyberattack has caused,” he says. “There will be financial costs certainly, but there will unfortunately be human costs as well.”
Mr Reid says “everything possible” is being done to restore the HSE’s systems but it will be “months” before this work is completed.
An accompanying briefing document to the committee includes a section entitled “quality and patient safety cyberattack update”. It says “the onerous task of uploading backlogs of manual records and reconciling patient records is progressing”.
It also says “the level of stress and risk involved in this process cannot be overstated” and that “as this work progresses evidence of incidents and near misses have emerged”.
“Staff continue to manage these risks to mitigate them where possible, identify, report, and manage incidents and share lessons learned to prevent recurrence.”
Asked about the incidents a HSE spokeswoman said: “Under ordinary circumstances all incidents across the health service are recorded on the National Incident Management Systems (NIMS).
“This system has not been available as a result of the cyber attack, so a manual work around was put in place with the State Claims Agency.
“We cannot say at this time whether there has been a higher number of incidents as a result of the cyberattack.”