A hospital IT shutdown is not a hypothetical. Three documented events, in 2024 and 2026, show what it looks like in practice: a pathology supplier in London, a claims clearinghouse in the United States, and a community hospital in Massachusetts. This post sticks to what those sources confirm and what the US health sector's own continuity checklist recommends.
It does not forecast a nationwide health system shutdown. No cited source does.
What happened
Synnovis, June 2024. A ransomware attack on the pathology provider Synnovis disrupted lab services for several NHS trusts in London. The Register reported in June 2025 that King's College Hospital confirmed one patient "sadly died unexpectedly during the cyberattack," that its patient safety investigation listed a long wait for a blood test result among several contributing factors, and that South East London figures counted 170 patients harmed, most classed as low harm. Synnovis's chief executive said the attack was identified as a contributing factor.
Change Healthcare, February 2024. A ransomware attack hit a company that handles pharmacy claims, billing and payment. The American Hospital Association (AHA) surveyed nearly 1,000 hospitals between 9 and 12 March 2024. It reported that 74 percent saw a direct patient care impact, 94 percent a financial impact and 83 percent a cash flow impact, and that 67 percent found switching clearinghouses difficult or very difficult. The AHA is an advocacy group, the survey is self reported, and the window was four days. In July 2025 the breach estimate filed with the HHS Office for Civil Rights was revised to 192.7 million people, according to CyberInsider.
Brockton Hospital, April 2026. Signature Healthcare disclosed a cybersecurity incident at Brockton Hospital in Massachusetts. Ambulances were diverted, chemotherapy was postponed for some patients, some lab results were delayed, and the system moved to "down-time procedures." The emergency room stayed open and scheduled surgeries continued, according to the report in Chief Healthcare Executive.
What the pattern shows
Three things repeat. First, the harm often comes from a dependency, not the hospital itself: a lab supplier or a clearinghouse. Second, the effects are practical and slow: delayed results, delayed approvals, delayed payment. Third, recovery takes longer than the outage. The AHA survey says 60 percent of hospitals needed two weeks to three months to return to normal after the clearinghouse was restored.
The sources do not show, and we do not claim, that these events are early signs of a larger one.
What US health regulators ask for
HHS published voluntary Healthcare and Public Health Cybersecurity Performance Goals in January 2024, with essential and enhanced tiers. Its Operational Continuity Cyber Incident (OCCI) checklist, updated on 7 November 2024 with the Health Sector Coordinating Council, covers the first 12 hours of an extended outage. It is organised by Hospital Incident Command System roles: incident commander, medical technical specialist, public information officer, liaison, safety officer, and operations, planning, finance, logistics and IT section chiefs.
It advises naming a primary and secondary for each role, posting the checklist where staff can find it, reviewing it at least annually or after any incident, and exercising it through tabletops or drills.
On the rulemaking side, a proposed update to the HIPAA Security Rule has slipped. A trade report says the federal agenda now lists final action no earlier than July 2027. We could not open the original, so treat the date as reported.
What to do now
- Map clinical and administrative services to the IT systems and suppliers they rely on.
- For each, write the downtime procedure on paper, and print it.
- Name a second supplier or manual route for labs, claims and prescriptions where one is possible.
- Run a tabletop with an incident commander and a clinician present.
- Check that backups can be restored, and time the restore.
- If you supply software to health providers, expect questions about your own recovery plan.
Try it yourself
Walk through an incident record and a postmortem for a supplier outage.
Click through it at your own pace, or open it full screen.
Quick check
Why did a pathology supplier outage affect hospital patients?
Hospitals relied on the supplier for test results. When the lab systems went down, results were delayed and procedures were postponed, which is how a supplier incident reaches patients.
What period does the OCCI checklist cover?
The first 12 hours after an extended outage caused by a severe cyber incident.
Sources
- The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality, 26 June 2025
- AHA survey on the Change Healthcare cyberattack, 15 March 2024
- CyberInsider: Change Healthcare revises breach impact to 192.7 million, 15 August 2025
- Chief Healthcare Executive: Massachusetts hospital hampered by cyberattack, 10 April 2026
- HHS and HSCC: Operational Continuity Cyber Incident Checklist, 7 November 2024
- HHS Cyber Gateway: Cybersecurity Performance Goals
- Fierce Healthcare: Feds push back HIPAA security rule overhaul to July 2027
