In October 2024, a mid-size hospice organisation in the Mid-Atlantic region experienced a ransomware attack that rendered their EHR inaccessible for eleven days. During those eleven days, the hospice was serving 340 active patients — approximately 40 of whom were in their final week of life. Nurses documented visits on paper forms. Medication orders were communicated by phone and recorded manually. Chaplains and social workers operated without access to the care plan history that informs their work. Bereavement coordinators could not access the family contact information and assessment notes they needed to support families navigating the final stages.
The eleven days passed. The systems were restored. The hospice recovered. But what cannot be recovered are the clinical encounters that happened during those eleven days without full access to the care history of 340 patients — including the 40 who were actively dying. The clinical quality of care during those days was lower than it would have been with functional systems. The emotional burden on clinical staff navigating end-of-life care without their normal tools was significant. And for the families who lost loved ones during the outage period, the disruption was invisible — they did not know their care was delivered under crisis conditions. But the care team knew.
Why Hospice Cannot Accept the Operational Disruption That Other Healthcare Sectors Absorb
A ransomware attack that disrupts operations at a primary care practice means postponed appointments and delayed prescription renewals — serious disruptions, but ones that can be rescheduled. A ransomware attack that disrupts operations at a hospice organisation means care delivered in the final days of a patient's life without access to the symptom history, the medication titration record, the advance directive, the spiritual care notes, and the family care coordination information that guides every clinical decision in end-of-life care.
The irreversibility of time in hospice care is what makes operational disruption categorically different from the same disruption in other care settings. A missed primary care appointment can be rescheduled. A disrupted final week of life cannot be revisited. The standard of ransomware resilience required to protect hospice patients is therefore a higher standard than the general healthcare sector standard — not because the technology requirements are different, but because the consequences of failure are more permanent.