Emergency & Urgent Care Remains in Critical Condition

The session opened with a short video on how ransomware at hospitals can delay time-sensitive care, even at facilities that were never attacked. Beau Woods drew on his years doing IT security inside a hospital to describe legacy medical devices that reacted badly to routine network traffic, antivirus that shut down a vendor's clinical application, and login delays that cost emergency staff precious minutes. He also recounted restoring fetal monitors during a worm outbreak after leadership approved the fix, showing how approvals can come when the patient-safety stakes are laid out plainly.

Dina Carlisle, a critical care nurse and union president, described weeks of downtime at two hospital systems. Staff fell back to paper charting, the pharmacy safety net for medication checks disappeared, lab results were missing before surgeries, and newer clinicians had little experience writing orders by hand. She argued for enforceable staffing ratios and contract language that requires communication and training during outages. Christian Dameff presented research from his academic healthcare security center, linking ransomware in one health system to longer emergency waits, diversion at neighboring hospitals, and worse cardiac arrest outcomes. He also described a CrowdStrike outage that disrupted hundreds of hospitals' services, and a prototype called Crash Cart that restores a 20-bed emergency department's core IT from a vehicle using private cellular networks and satellite backhaul.

Audience questions covered state staffing legislation, whether HIPAA shapes contingency planning, scaling portable systems, and recovering data for electronic health records. The panel's takeaways were that prevention alone will not cover response, that organizations need to map the critical third-party vendors they depend on, and that clinicians and communities must press for accountability.