Bluewater Health getting new, more secure hospital info system

Bluewater Health, hardest hit by a cyberattack on five Southwestern Ontario hospitals last fall, had a relatively dated system for storing and sharing patient information at the time, Bluewater Health’s board chairperson says.

Article content

“It did make a difference,” said Margaret Dragan, about the hospital group’s 20-plus-year-old hospital information system that’s been eyed for an update since 2013.

Article content

Other hospitals in Chatham-Kent, Leamington and Windsor affected by the ransomware attack, detected Oct. 23via shared supply and technology systems provider TransForm Shared Service Organization, already were using a newer Oracle Cerner hospital information system at the time, Dragan said.

Bluewater Health announced this week it’s switching to Oracle Cerner by the end of 2024.

The upgrade was expected to happen around now, even before the cyberattack, Dragan said, adding Bluewater took its time evaluating hospital information system options before deciding because it wanted to be thorough.

Article content

Vendors are making Bluewater Health’s implementation a priority because of the cyberattack, a hospital official said.

Dragan stopped short of saying Bluewater Health’s existing Meditech system — still in place until the switch to Oracle Cerner is complete — is more vulnerable to cyberattack, adding officials have been asked to not talk about certain things given an ongoing police investigation.

But moving to the new system will put Bluewater Health “at the leading edge in terms of security and functionality,” she said.

A group called Daixin Team has claimed responsibility for the attack, which the Sarnia hospital group has said resulted in the theft of 5.6 million of its records dating back to 1992, affecting about 267,000 people.

Article content

Stolen data includes social insurance numbers for about 20,000 patients, officials have said.

A $480-million class-action lawsuit has been filednaming all hospitals involved in the attack —Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital — and TransForm.

Those other hospitals switched to Oracle Cerner sooner because their former hospital information systems were nearing end of life, Dragan said, whereas Bluewater Health still had system support and could afford to wait.

Good news is Bluewater Health can benefit from those other hospitals’ experience with the transition, she said.

Asked if Bluewater Health should have considered switching faster, Dragan said “I don’t know that there’s any value in answering that question. We are where we are.

Article content

“We’re looking forward and we will be implementing this new system which will offer security and service to our community.”

Bluewater Health will be joining the other “Erie St. Clair” hospitals in Chatham-Kent and Windsor Essex in adopting a particular database for the Oracle Cerner system, called the Erie St. Clair “instance,” she said.

It’ll also include “a health information exchange platform” that lets hospitals more easily share patient data with hospitals in London, officials said in a release.

London hospitals use a different Oracle Cerner instance, Dragan said.

Sharing information between hospitals is useful as patients often attend different hospitals, officials have said.

Bluewater Health in 2013 estimated switching to Cerner would cost $11 million up front, and another $14 million for upgrades, system maintenance and licensing over 10 years.

Article content

Those costs have increased, though totals still are being refined, Dragan said.

The contract with Oracle Cerner hadn’t been signed as of Friday afternoon, she said. “Until we sign a contract. . . we’re not releasing that (cost) number.”

Remaining systems affected by the cyberattack, including Bluewater Health’s hospital information system, should be restored “within a few weeks,” she said, noting individual systems are being brought back piecemeal, not all at once, for security reasons.

Until that full restoration, hospital personnel sti8ll don’t have access to things such as patient health card numbers, medical histories, medication lists, and patient care reports from other clinicians, she said.

Article content

Things like the payroll system have been at least partly restored, and Bluewater Health has focused on restoring core clinical systems, Dragan said.

“We will have all systems operational very soon,” she said, though some only on a limited basis.

“We will not be connecting all systems (to each other) for security reasons,” she said.

No further information was available about the lawsuit Friday, she said.

Public hospital board meetings are expected to resume Jan. 24, she said. The board last posted publicly in September.

“We backed off as a board (after the attack) because the hospital leaders and staff had other things that needed to be taken care of,” she said.

The board has been meeting and taking minutes “quite frequently” in private, she said.

Article content

“Always in camera because we were primarily discussing the cyberattack,” she said.

“We only dealt with those hospital matters that absolutely required board approval, and those critical things generally were in camera.”

That appears to include what hospital officials said in the release was a vote to adopt the Oracle Cerner hospital information system.

Dragan thanked board members for the time they’ve invested.

“There were many, many meetings through the fall,” she said. “They just weren’t public.”

She also credited Bluewater Health staff and leadership for their hard work.

“These folks have just done a frankly amazing job responding to this crisis and providing just exemplary care under really extreme circumstances,” she said. “These folks are tired but they just keep giving it their all and the board is ever so grateful.”

Article content

Expectations are the new hospital information system will serve Sarnia-Lambton well in terms of security and connectivity, she said.

“We’re very grateful for the support and collaboration of our peer hospitals in the area,” as well as the province, and for the co-operation from the community and local healthcare professionals, she said.

“These are terrible, terrible situations,” she said. “We sure do appreciate everyone standing by us.”

While more Windsor-Essex patients have been reported crossing the border for health care in the wake of the attack, that hasn’t been the case in Sarnia, Bluewater Health’s Tara Young said.

“Rather, we’re currently experiencing a significant surge linked to high respiratory and medicine admissions post-holidays,” she said in an email.

Higher than normal emergency department visits and admissions have been happening since Dec. 27, historically the busiest day of the year, she said.

In-patient acute bed occupancy also has been 100 per cent or more, she said

[email protected]

Article content