CARY – A cyberattack proved to be far more than a pain in the foot for these doctors. A perfect storm hit the practice of Dr. Willard Niemi last week – one of weather (snow and ice) and the ransomware attack on Allscripts on which Carolina Foot & Ankle Specialists relies for practice management and patient electronic medical records, or EMRs. The practice is back online a week later.
“We are finally back up today,” Niemi said in an interview Friday morning, the frustration evident in his voice.
“We were down Thursday, Friday, Saturday, Sunday, Monday and Tuesday. We were at about half the staff for access and half for patient access on Wednesday and Thursday.
“We were unable to access our scheduling software and we had no access to patient data.”
BACK TO PAPER RECORDS
The outage was so bad that Niemi said he had to “take patient notes” for “scanning and inputting” into patient EMRs later.
Carolina Foot & Ankle Specialists operates offices in Durham Cary, Clayton and Knightdale. The weather forced a host of patients to reschedule – but with Allscripts unavailable the practice and people needing appointments faced major problems, Niemi said.
Asked if the outage cost the practice money, is declared: “Sure!”
Other practices also were hit in the Triangle.
“This has shut our medical office down for two days,” one person wrote to WRAL. “I think this [earlier] article [at WRAL.com] minimizes the effect on patient care here!!! We have not been able to schedule patients or call patients. If we solely relied on EMR we would be completely down. Nothing better than paper chart here today!!!!”
The attack has lasted for over a week, and an Allscripts spokesperson told WRAL TechWire early Friday that the company was restoring services to the some 1,500 clients who were affected. Later Friday, she said that all services had been restored.
One practice in Florida has already sued Allscripts, accusing the company of “wanton, willful, and reckless disregard.”
Will his practice join the suit? “I will have to discuss that with my partners,” Niemi responded.
THE RISK OF ELECTRONIC MEDICAL RECORDS
Niemi, who lives in Morrisville and received his doctorate degree from the University of Osteopathic Medicine, College for Podiatric Medicine and Surgery, in Des Moines Iowa, noted that the threat of ransomware attacks has been well known. And he said he was not entirely pleased with how Allscripts responded to customers.
“I find it interesting that there was no Plan B for Allscripts” in the event of an attack, Niemi said. He also expected more updates at least via email from the company about when services would be restored.
The Allscripts outage also illustrates a “Catch 22” of risk and rewards for physician practices, he added.
Federal requirements such as through Medicare and the Affordable Care Act penalize financially any practices if they don’t utilize EMRs, Niemi said. So his practice relies on a provider such as Allscripts for those services.
“We used to only have to worry about fire,” Niemi said, referencing records.
Now, he has to be concerned about the cloud or software or other electronic necessities that might “go bad.”
And even the addition of a cyberseucirty expert to help his practice is no guarantee of 24-hour-a-day, 7-day-a-week access.
“If we had a person for that, it wouldn’t have mattered,” Niemi said. “This [outage] was all on the Allscripts side.”
So what prescription might he write as a solution or treatment?
“You know what,” he said, sounding a lot like Dr. Leonard “Bones” McCoy of Star Trek, “I’m just a physician.”