Haematology patients are among many in New Zealand whose treatment has been disrupted by a health service shutdown from a cyber attack.
The IT systems of the Waikato District Health Board (DHB) were paralysed a week ago by a ransomware attack that has blocked clinicians from accessing patient records, appointment booking systems and rendered radiation oncology treatment equipment inoperable.
According to media reports, medical staff have been forced to revert to alternative systems such as whiteboards and personal laptops.
Medical oncologist Dr Chris Jackson, medical director of the Cancer Society of NZ, said patients were continuing to receive chemotherapy and immunotherapy albeit with limitations on access to records.
“I think it’s hard to understate just how disruptive the loss of the IT system is on a hospital. Things like access to medical records, access to scans, test results, even things like working out who’s coming in to clinic is difficult because all that is handled through the patient management system. Colleagues have described it as like walking through fog at the moment,” he told Radio New Zealand.
“What we have seen with the taking down of the entire Waikato DHB is that the level of failure is enormous and it is extraordinarily disruptive and stressful for patients and staff,” he said.
According to media reports, the ransomware attack has blocked oncology treatment system software and left oncologists unable to identify patients on waiting lists. It has also prevented services from accepting new referrals.
One patient with advanced Hodgkin Lymphoma said the IT shutdown meant her blood tests were delayed and she was unable to communicate with haematologists about her chemotherapy.
“They couldn’t look up my records. They didn’t know anything unless I told them,” said Lara Wall.
The region’s Radiation Oncology Clinical Director Dr Cristian Hartopeneau said the shutdown meant cancer patients at Waikato Hospital in Hamilton were being diverted to hospitals in Auckland and Wellington, but capacity was limited and so Australia was being considered as an emergency option.
“There is considerable pressure on the system at the moment, but staff at Waikato Hospital are working hard in unique circumstances to ensure patient safety and care remains at the forefront,” he said.
“New Zealand and Australia have a long-standing arrangement to transfer patients for treatment, but only as a last resort. At this stage the service is working with key partners on all available options within New Zealand,” the DHB said in a statement.
Dr Hartopeanu said it could be a month before system come back online, and in the meantime staff were using manual methods to try trace and contact patients who had been referred but not yet started treatment.
”We are going through papers and we find the paper we think it could be then we check with the clinician, do you remember that three weeks ago you might have seen this person. It sounds primitive in the computer era, but we look at them and then there are some checks,” he told the NZ Herald.
The ransomware attackers have also hacked patients records and sent copies to media outlets as part of their demands for payment. The breach is being investigated by police and the country’s security services.
In the wake of the attack, healthcare providers have been urged by the country’s Privacy Commissioner to ensure security measures are in place to protect health IT systems.
“We are aware that some patient, staff, contractor and other personal information has been distributed to news media organisations by unknown individuals,” the Commissioner’s office said.
“Our expectation is that the DHB would notify and offer support to the individuals identified in that information without delay. We would also expect that the DHB would be actively monitoring for potential host sites on the Dark Web or elsewhere.”