The hospitals stayed open; what stopped was everything connecting them to the outside — four 2026 hospital cyberattacks and what patients and providers should do

The scope differs by hospital. UMMC's published updates repeatedly stated that its hospitals and emergency departments remained open while clinics were closed. Signature Healthcare said inpatient care and walk-in emergency services continued, but ambulances were diverted and chemotherapy was cancelled. AZ Monica lost its own website and, according to reporting, set up an emergency website with a general phone number and FAQs. Check the hospital's official site, or a main phone number you looked up yourself.

Each hospital said it would contact patients to reschedule cancelled appointments. AZ Monica, according to reporting, phoned every patient whose appointment was cancelled, and UMMC said clinics would run extended hours and days to catch up. Some needs cannot wait: UMMC opened an automated triage phone line for time-sensitive needs and said it would prioritize medication refills and post-operative care visits.

Signature Healthcare's retail pharmacies stayed open for consultation but were unable to fill prescriptions; the hospital announced on April 24 that pharmacy operations had reopened (in the meantime, it gave a phone number for medication questions). When a hospital's systems are down, its own staff may not be able to see your prescription history quickly. As this site's own suggestion: keep a list (or a photo) of your current medications, doses and allergies. It speeds things up if you have to see another doctor or pharmacy.

All four hospitals kept an emergency department open. But Signature Healthcare diverted ambulance traffic for a time, and at AZ Monica, according to reporting, the mobile emergency team stopped going out and other hospitals covered under the provincial emergency plan. Ambulance crews handle where you go. There is no reason to hesitate to call because your usual hospital is down.

Nippon Medical School Musashi Kosugi Hospital states that it never asks patients for credit card numbers or passwords by phone, and warns patients about suspicious calls, text messages and postcards. After an incident, messages using the hospital's name can follow. For anything about refunds, re-registration or identity checks, hang up and call back on a number you looked up yourself (background: What is phishing?).

Go beyond "record on paper instead of the EHR". Write who does what, with what, for notifying patients of cancellations, chemotherapy schedules, pharmacy dispensing, telling ambulance services whether you can accept patients, and what patients see when the portal is down. MHLW publishes a checklist, guide and template for a business continuity plan (BCP) that assumes a cyberattack, and its overview of the revision calls for preparing "alternatives such as paper operation" and regular drills. A first step: ask outpatient, pharmacy and oncology, "If every system were down tomorrow morning, what would you need to look at in the first hour?" Any answer that exists only inside a system is a procedure you need to write.

Item 3-2 of the MHLW checklist asks whether you have "considered the information needed to continue care during an incident, secured backups of it, and confirmed the recovery procedure". The revision overview lists offline backups and recovery drills as ransomware measures. Concretely: regularly export the inpatient list with medications and allergies, today's and next week's appointments, and chemotherapy schedules to a place disconnected from the network. Backup basics are in Backup and recovery essentials.

After restarting its electronic records, AZ Monica, according to reporting, began re-entering three weeks of paper records. Downtime does not end the day systems return. Decide in advance who does the back-entry, how long it may take, and which record — paper or electronic — is authoritative until it is done.

MHLW checklist item 2-2 asks whether you have confirmed with vendors which devices use remote maintenance; item 2-14 asks for connection-source restrictions on network devices. As prevention measures, Musashi Kosugi Hospital switched external connections to on-demand only in principle and applied source-address restrictions. The maintenance lines to target first are those installed for medical devices, catering or lab equipment without going through the IT department. For every VPN appliance you find, assign someone to receive update notices and patch it, in line with checklist item 2-6 (apply security patches) and the HHS goal "Mitigate Known Vulnerabilities".

The MHLW overview calls for layered defense through network separation, multifactor authentication and access control, and the HHS goals include "Network Segmentation". Musashi Kosugi Hospital also listed settings that stop an intruder from moving sideways inside the hospital. A practical target: allow only necessary traffic from the zones holding nurse-call, patient monitors and imaging equipment to office PCs and the internet. At the same time, check which patient data is stored on the servers in those zones, device by device.

UMMC told its staff that its fast recovery was the result of its security environment and measures already in place. Written procedures do not run themselves. A half-day "no systems" drill in one outpatient department will surface missing contact lists and paper forms before a real incident does.