Development of Rapid Response Plan for Radiation Oncology in Response to Cyberattack.

To the Editor:

As a result of a cyberattack on the University of Vermont Health Network, access to all servers and clinical systems was immediately halted by our information technology infrastructure team on October 28, 2020. This resulted in all hospital electronic medical records and laboratory, pharmacy, pathology, radiology, and messaging systems becoming inaccessible. Only access to basic information, including demographic information; medical, surgical, family, and social history; most recent labs; medications; and last clinic note, was available. Additionally, the radiation oncology Mosaiq virtual server residing on the hospital network was shut down and we were unable to deliver radiation treatment. Initially, there was uncertainty whether this was a cyberattack or network issues, but without additional information, all remaining radiation treatments were initially canceled. Although the Mosaiq server is backed up multiple times throughout the day, no access to the backups was immediately allowed. Only the Pinnacle treatment planning system remained accessible during this downtime, but this system could not communicate with the treatment machines. In addition, loss of our network access disrupted communication platforms among health care providers, including secure email, video, and telecommunications. Providers therefore had to rely on personal messaging services and devices for communication. Our department set up a Slack channel for internal communications.

With no access to electronic patient radiation information, treatment schedules, or current radiation dose, continued communication with patients was essential. The radiation oncology team reconstructed a paper-based patient information sheet noting diagnoses and the remaining planned radiation treatment, and the physicians, nurses, and therapists made daily phone calls to patients to keep them updated on the evolving situation. As the community learned of the cyberattack, our patients were understandably distressed by treatment interruption, but also sympathetic and understanding of the circumstances. The University of Vermont Health Network regularly sends emails and posts to social media platforms to help communicate updates to the network’s patients.

Physicians triaged patients to prioritize those needing immediate resumption of treatment, based on tumor biology and anticipated effect of treatment delays. Patients were ranked into 3 groups for restarting treatment, with highest priority for patients with squamous cell cancer (including head and neck, cervical, and anal) for which prolonged treatment delays had the highest likelihood to compromise outcomes.1, 2, 3, 4 The next highest priority included patients with nonsquamous cancer receiving concurrent chemoradiation, and the last group included patients with tumors expected to have slower cell repopulation, such as breast and prostate cancers, as well as benign brain tumors.,

Initiatives to restart treatment were launched simultaneously and included transfer of patients to a network radiation facility that was unaffected by the cyberattack. At our primary facility, we were able to resume treatments deliverable with manual machine controls such as electrons or for urgent palliative cases that could be treated with clinical setup alone. The highest priority treatments were transferred to our network hospital that used the same treatment planning software and was accessible to our physicists, dosimetrists, and physicians. Although increased transportation distance was a challenge for some of our patients, most preferred to resume radiation treatment despite the increased transportation challenges to avoid further delay in resuming treatment. We were able to restart electron treatment at our facility for breast patients undergoing electron boost, and the remaining breast patients had their electron boosts started early to minimize gaps in treatment.

Using these approaches, high priority patients and patients eligible for electron or 2-dimensional palliative photon therapy had treatment breaks of 2 to 4 days after system outage and medium priority patients were able to resume radiation with a 6 to 7 day treatment break. The final group of patients resumed radiation with a 12-13 day treatment break after physics staff, information technology and our vendors were able to restore our server’s operation and our treatment capabilities.

We were not the only hospital to be attacked recently and other radiation oncology departments will likely need to work through many of the same processes. We advise that now is the time for all facilities to prepare for similar events. Steps that can be initiated now include simple procedures such as maintaining paper records of patient demographic and schedule information to use in the immediate aftermath of system outage; offline storage of policies, procedures, and patient records; establishment of disaster communication plans; and consideration of offline physical backup servers.