On October 22, 2026, University Hospitals — an 18-hospital health system serving greater Cleveland, Ohio — detected unusual activity on its servers and disconnected from the internet. Within hours, MyChart patient portal access was down. The public-facing website went offline. Elective procedures were rescheduled. Insurance pre-authorizations stalled. Five days later, as of this writing, full restoration had not been announced and the cause had not been publicly disclosed.
University Hospitals is not a small or under-resourced organisation. It is an 18-hospital system that completed a system-wide Epic EHR migration in 2023 — converting approximately 5.6 million patient records at a cost estimated at $400 million. If a health system of that scale and investment can be brought to a five-day (and counting) partial shutdown, what does that mean for a home health agency running Homecare Homebase with a three-person administrative team? What does it mean for a hospice provider whose clinical documentation lives entirely in an EHR that nurses access from personal devices at patient bedsides?
The answer is not that smaller organisations are more vulnerable because they have less. The answer is that smaller organisations are more vulnerable because they have less margin for the kind of disruption this incident represents — and most of them have made fewer of the decisions in advance that make disruption survivable.
This article draws on the publicly available account of the University Hospitals incident and a leadership advisory published October 28 by Withum, a national advisory firm, to identify what the incident means specifically for home health agencies, hospice providers, and community health centres — and what decisions you need to make now, before your incident happens.
What Happened at University Hospitals: The Timeline
Oct 22 | Unusual server activity detected. Systems disconnected from the internet. MyChart and the UH public website go offline. |
Oct 23 | UH initially reports no impact to patient care, then begins rescheduling some appointments and elective procedures. |
Oct 26 | UH publicly confirms a cybersecurity incident. Reports restoration progress underway. Coordination with law enforcement confirmed. |
Oct 27 | Most appointments proceeding normally. MyChart remains offline. UH calls patients directly with appointment reminders. |
Oct 28+ | No timeline for full restoration announced. Root cause, full scope, and whether patient data was exposed remain undisclosed. |
What remains unknown as of this writing: the root cause, whether protected health information was accessed or exfiltrated, and when full system restoration will be complete. If a breach of patient data is ultimately confirmed, federal and state breach notification requirements — HIPAA Breach Notification Rule and applicable state laws — will govern how and when notices must be sent.
The consolidation note in the Withum advisory is worth sitting with: UH's 2023 Epic migration consolidated 5.6 million patient records onto a single platform. That consolidation creates enormous operational benefits — unified patient records, streamlined billing, reduced redundancy. It also concentrates risk. A single incident affecting the consolidated system affects the entire patient population and the entire operational infrastructure at once.
Six Decisions Home Health and Hospice Leaders Need to Make Before Their Incident
The Withum advisory identifies six cyber resilience priorities for healthcare leadership. I want to translate each one specifically to the home health, hospice, and FQHC operating context — because the decisions look different for an agency with 45 employees than for an 18-hospital system with a dedicated IT department.
1. Decide in Advance Who Can Isolate Systems — and Under What Conditions
University Hospitals disconnected from the internet on October 22. That was the right call. The ability to make that call quickly — before an attacker has completed their objectives — is one of the most consequential factors in how a cyber incident resolves. But disconnecting from the internet in a home health or hospice environment means field nurses lose EHR access mid-visit. Medication administration records go dark. The clinical coordinator cannot reach patients or caregivers through the normal channels.
Who in your organisation has the authority to make that call? What are the conditions under which it gets made? Who gets notified, and in what order? If the answer is "the IT person would handle it," and your IT person is a contractor who responds to tickets during business hours, you have a gap that will cost you during an incident.
The decision needs to be pre-made, written down, and rehearsed. A 90-minute tabletop exercise — executive director, clinical director, IT lead, and billing manager running through a ransomware scenario — is the minimum preparation. Tabletops are not expensive. The absence of one is.
2. Plan to Operate Without Your EHR — Specifically
UH nurses and clinical staff operated without EHR access for multiple days. At a home health agency or hospice, that means field nurses visiting patients without electronic medication administration records, without electronic care plans, and without the ability to document visits in real time.
"We have downtime procedures" is not the same as "our nurses know what to do when the EHR is down." The distinction that showed up in the UH incident is the same one that shows up in HRSA site visits and OCR audits: the procedures exist on paper but have not been practiced, and paper forms are not available at the clinical point of care when they are needed.
Specific questions to answer now:
• Do printed downtime forms exist, and are they accessible to field nurses without network access?
• What is the process for medication verification when the MAR is offline?
• How do field nurses document visits during an outage, and how is that documentation reconciled back into the EHR when systems are restored?
• How long could your agency operate in downtime mode — hours? days? what breaks at the 48-hour mark?
3. Model the Cash Impact — Your Agency Is Not Too Small to Feel It
UH's insurance pre-authorizations stalled within the first day of the incident. Claims processing was disrupted. Revenue cycle operations — billing, collections, payer communications — went into partial suspension. For an 18-hospital system with substantial cash reserves and access to credit, a five-day revenue cycle disruption is a serious problem. For a home health agency operating on 30–45 day payment cycles from Medicare, it is potentially an existential one.
The Withum advisory recommends modelling the cash impact of a 3-day, 7-day, and extended outage. For home health and hospice leaders, that exercise should include: how many claims are pending at any given time, what the average payment cycle is, when payroll falls, and what cash reserves exist to bridge a claims processing gap. The answer to "what does a 7-day billing disruption cost us" should be a number, not a shrug.
4. Map Every Third-Party System Your Clinical Operations Touch
Home health and hospice agencies have a more complex third-party technology environment than most people outside the industry realise. The EHR communicates with pharmacy benefit managers for medication verification. The billing platform connects to clearinghouses for claims submission. The scheduling system integrates with patient communication tools. The payroll system connects to HR platforms. Field devices sync to MDM platforms. Each connection is a dependency — and each dependency is a potential point of failure or a potential entry point for an attacker.