Established Downtime Procedures Protect Patient Outcomes Against Cyber Attacks

In the age of cyberattacks, establishing and practicing a downtime procedure is crucial to safeguard patient care, according to Kelli-Ann Mancini, MSN, RN, OCN.

Mancini, an oncology nurse at Yale New Haven Health Smilow Cancer Hospital, recently co-authored a study focused on maintaining patient care in downtime conditions, which was presented at the 47th Annual Oncology Nursing Society Congress. In her presentation, she demonstrated that preparedness is imperative to successful patient care.¹

In an interview with Oncology Nursing News®, Mancini discusses the intervention that her institution implemented to combat this potential threat, why they felt it was necessary, and the broader implications of caring for patients with cancer in an increasingly digital age.

Oncology Nursing News®: Please discuss the potential threat that a cyberattack poses to patient outcomes, and the importance of preparing a healthcare system to be able to combat this possibility.

Mancini: With a potential cyberattack, patient care in its entirety can be significantly delayed or essentially halted. Many of our lines of communication rely heavily upon our electronical system. In terms of technology, [this includes] our epic patient records, communication via our mobile devices, scans, admissions, and more—all of which could really be delayed.

We had downtime procedures in place. Ultimately, the downtime processes that we had already would not have [easily] expanded for the length of time that a cyberattack could really endure—days, weeks, months even, in terms of how long it could potentially take to even have that [problem] rectified. This could have a huge impact on patient care, given how we currently rely so heavily on technology.

What is the process map that your team developed? How does it work?

At Smilow, we have 4 inpatient units: surgical oncology, women’s oncology, solid tumor inpatient oncology, and our hematology oncology units. Our surgical oncology and our women's gynecologic oncology take a lot of admissions straight from the post-anesthesia care unit (PACU). A lot of that handoff is done via an electronical medical record system.

Before our reliance on electronical medical records, it was all verbal handoff or nurse to nurse communication. Currently, we rely heavily on notes and flow sheets. The PACU admission process was important to look at because they needed [clear] outlines in terms of what do to if our electronical medical record isn't available. Our teams process maps not only outline what to do, but [includes] every single flow sheet on paper that you would need to complete a patient chart in its entirety.

What is important about these process maps is that they're interdisciplinary. They don't only include what nursing needs; it also includes what would it look like if we had chemotherapy being ordered for a new patient. [Imagine] a patient is coming in for chemotherapy:

How do those orders get placed [if we] don't have an electronical medical record? What does it look like on paper? How does that translate to pharmacy? How does that translate to the pharmacy mixing room? How does that get back to nursing in a flow that doesn't create a lot of confusion, and potential safety risks for patients? Ultimately, this process map is step-by-step instructions across multiple domains.

[Furthermore,] not only do we have the process maps outline, but we also did roleplay. We were able to take those process maps and roleplay and look at what it would look like if a patient had to go to scan for MRI. How are those results translated to nursing, to physicians, and to providers?

We looked at this as everything went down—which means everything from computer systems to fax machines. We asked: Who would be responsible for taking those results? What does that look like? Who brings those results to the nurse so that they could be reviewed? It is the same thing with high-risk chemotherapy—essentially, what does that look like? Who hand delivers that patient chart from area to area [in the clinic]?

We even outlined in the process map where those charts are kept so that in all inpatient units within Smilow, we would have a standard location and there wouldn't be confusion if a patient was on a different unit. For example, if we did not have beds on the hematology unit, and there was a patient who would need to be on a solid tumor unit, those providers would know exactly where to go.

In your opinion, what are the necessary tools that frontline workers will need in order to provide seamless patient care in the event of this type of emergency?

Overall, that priority would be ensuring that we have continuous checks of the actual downtime forms to ensure that things get updated very frequently. We must ensure that if there's an upgrade to our computer or electronic medical record, in those flow sheets, that actual upgrade translates to paper documentation. We need those checks and balances completed, and [we need to] ensure that we actually have a ready number available in the unit if there were a downtime.

Finally, it is crucial to ensure that those dry runs are periodically done—even if it's just annually. However, I would encourage it to be done more frequently than annually.

Reference

Henderson C, Mancini KA. Maintaining patient care in the age of cyberattacks. Presented at: 47th Annual Oncology Nursing Society Congress; April 27-May 1, 2022; Anaheim, CA. Abstract P209.