Cyberattacks at Prospect Medical Holdings, which owns three hospitals in Connecticut, impacted medical care across the state. Now, the hospital’s sale to Yale New Haven is under the same stress.
WSHU’s Ebong Udoma spoke with CT Mirror’s Dave Altimari to discuss his article written with Jenna Carlesso, “Inside the cyberattack at Prospect Medical Holdings’ CT hospitals,” as part of the collaborative podcast Long Story Short.
You can read their story here.
Episode Transcript
WSHU: Hello Dave, Prospect Medical Holdings owns three major medical facilities in Connecticut. Waterbury, Manchester Memorial and Rockville General Hospitals. The Connecticut Mirror filed a Freedom of Information Act request to obtain documents connected with the cyberattack of the hospitals this summer. What did you find?
DA: We got documents from the Department of Public Health and then we also got dispatch records from the Tolland dispatch center, which handles all ambulance calls for Tolland, Vernon and Ellington, places that would be going to either Rockville General Hospital or Manchester. Clearly in the six weeks that the cyberattack lasted, the impact of it on the hospitals was far greater than what the public knew.
For example, there was over a two-week period where Manchester was almost fully diverting patients. They didn’t take any patients and no ambulances came to the emergency room. The only patients they were getting were walk ups. Rockville had closed several of its satellite offices, like blood draw places, and its Women’s Health Center. And Waterbury also was diverting emergency room patients to St. Mary’s, which unfortunately was overrun with people. Literally, there was a complaint in the DPH file, a person from Naugatuck took their dad to the emergency room at St. Mary’s and basically described a scene where people were lying on the floor and it took hours and hours to get anybody to treat her dad because they were overwhelmed with all the emergency room patients.
WSHU: There was a situation in which there was someone on a gurney for two days in the ER.
DA: Yes. And to be fair to St. Mary’s, I mean, Waterbury Hospital and St. Mary’s Hospital, are close to each other and they’re the only two there. So if Waterbury couldn’t take patients, there was nowhere else to go. And what we found out is that because Manchester is close enough to Hartford, that some of the patients who went to Hartford Hospital, some went to St. Francis, but we did see that they literally had to take patients to Massachusetts, in some cases from eastern Connecticut, because that was, I guess, the closest place.
WSHU: Now, how were the finances affected? Because you say here that the state had to give the hospital some upfront money from Medicaid?
DA: Yes, $7.5 million. So basically, Prospect came to them. And this has happened in other states. They did it in Rhode Island, for example, we know they needed the state to in effect front them the money, because they weren’t able to process Medicaid claims because their systems were down. So the state of Connecticut fronted them $7.5 million, and will eventually take it back in future claims that are made once they are back to whatever normal is going to be for those three hospitals.
WSHU: Complicating matters even more is the fact that the hospitals are in the midst of being taken over by Yale New Haven. What’s the situation with that right now?
DA: I would say the answer there would be maybe. Right now there is a deal in place that is being reviewed by the state Office of Health strategies, administrators from Prospect Medical, the corporate offices, as well as the local hospitals. And Yale New Haven came up to Hartford last week and met with the Governor and met with a bunch of legislators to try to urge them to speed up the process of approving the sale because Prospect is in dire financial conditions.
They, in fact, told some of the legislators that, you know, we’re talking about not even being able to purchase bed linens, for example. So the other big issue is there’s a lot of vendors, small businesses in Waterbury that supply the hospital, and if they’re not paying them, and there were documents that indicated they could be $40 million in the hole to their vendors, that impacts those smaller businesses and obviously, also patients and people’s ability to get treatment.
WSHU: The fact that they had to deal with this cyberattack, how unusual is that? And how unusual is the fact that it was such a massive, debilitating attack?
DA: The length of this one, I think, is unusual. So it was about roughly about six weeks before they finally issued an all clear. Hospitals have become more of a target recently. This is one that I think the length of is very significant. They had to cancel surgeries, they had to divert ambulances, they had to close satellite offices, people weren’t getting paid on time, because the payroll system was down, they had no email, I mean, impacted things that you wouldn’t even think of.
The other thing that Senator Saud Anwar, co-chair of the Public Health Commission said, his example was a heart monitor. And you could have 15 people whose hearts are being monitored. And normally, you have one person who’s watching these monitors all on one screen. If you don’t have access to that computer system, and you can’t do that, you don’t have to put a person in every single room to monitor those machines. And that takes an enormous amount of people and bodies to do that, because it’s a life and death situation. If you’re not monitoring that, someone could have a heart attack right there in the bed. That was one of the examples he gave of how reliant hospitals are on technology. And when it’s taken away, like it was here, it makes it very difficult.
WSHU: I know that the state legislature had a hearing about this. What was the outcome of that hearing? What more can lawmakers do?
DA: Well, they met privately with the hospital people. I believe Senator Anwar wants to have a hearing because he wants to hear from the hospitals as to what happened. But I also think he wants to have state officials come before the legislature and talk about what their role is here and what they could do or could have done to assist these hospitals more than they did. It’s a tough situation.
These are privately-owned companies and the state has what’s called a Medical Reserve Corps. At one point Waterbury, because they were short pharmacists and pharmacy technicians, asked the state if they could get some volunteers. And what the Medical Reserve Corps basically is, is volunteers in each region who could be used in a short-term period in an emergency. For example, during COVID, the Corps was activated to help hospitals fill in when they were overwhelmed with patients. And for some reason, the state decided not to activate that unit for this emergency. And I think he’s wondering, what was his decision behind that and why. So I expect that we will see some sort of hearing soon, in the next couple of weeks, on this whole issue before the legislature.
WSHU: In the meantime, the sale of the hospitals is in flux.
DA: It’s still pending. I know they all met with the governor the other day, I think that the reason they came here was to try to relay a sense of urgency that the sale needs to go through. There is a whole statute on how that proceeds. The commissioner of the Office of Health Strategy said its proceeding was normal, and there hadn’t been any delays. It’s just that the way the system is, it’s been over a year that the case has been before that office. And I think that they’re just trying to get the state to move a little faster and approve the sale so Yale can come in and take these three hospitals over.
WSHU: There’s an argument being made that Yale would probably be able to deal with the cyberattack situation better because they have more wherewithal to deal with that.
DA: A couple things, Prospect has acknowledged that they’re struggling financially. Also, while their systems are back, they’re coming back very slowly. So there’s a lot of things that they’re still having a hard time doing, like billing, which I think is still a big issue. And a company already having financial issues getting hit by a cyberattack that lasted six weeks has had a dramatic impact on your bottom line. They have canceled elective surgeries. They weren’t taking emergency room patients, they canceled all their outpatient clinics. Those are all things hospitals are relying on to make money. So it had a major impact on their financial bottom line.