Cyber Incident Victim: Norton Healthcare

On or around May 9, 2023, Norton Healthcare, a healthcare system based in Louisville, Kentucky, fell victim to a cyber incident described as a crime committed against the organization. The event necessitated immediate and important steps to ensure the continuation of community care. Following the discovery of the incident, the organization's Information Services team, in conjunction with leading external cybersecurity experts, initiated a diligent process of assessing the potential impact by going through every network application. The investigation into the precise nature and cause of the event began immediately and remained underway for an extended period, with the organization cooperating with the Federal Bureau of Investigation (FBI). The complexity of such cyber events meant the investigation was expected to take months to complete.

The primary impact of the incident was a widespread disruption to Norton Healthcare's network operations and IT systems. A significant portion of the organization's network applications were taken offline, affecting numerous business and clinical functions. Despite these disruptions, the majority of operations were successfully restored and brought back online through the concerted hard work of employees. The restoration process was meticulous and time-consuming, involving third-party specialists who were engaged to carefully examine and safely restore all affected network applications. This careful approach was deemed a critical part of the overall recovery and response effort.

Patient care services experienced considerable disruption. Providers faced challenges in communicating test and imaging results to patients, though they worked diligently to share this information as quickly as possible. The organization encouraged patients to expect delays in receiving their medical results. Appointments, exams, and scheduled procedures were also affected. Patients were advised to contact their provider’s office directly with questions about their schedules, and providers proactively reached out to reschedule appointments where necessary. To manage the high volume of inquiries, Norton Healthcare established dedicated points of contact, directing patients with general care questions to call the Norton Healthcare access center or the Norton Children’s access center.

Billing and administrative functions were similarly impacted. While billing information remained accessible to patients through their Norton MyChart accounts, the process of generating and sending out statements was delayed. The organization appreciated patients' patience as it worked to get statements out as quickly as possible and encouraged individuals to review their statements closely upon receipt. Patients with billing questions were provided a specific phone number to call or could submit inquiries through the Norton MyChart platform. The increased call volume and message traffic led to longer response times, and the organization requested patience as staff worked to respond to voicemail and MyChart messages as promptly as possible.

Throughout the response, Norton Healthcare maintained public communication via its website, posting a detailed update on May 24, 2023, to keep patients and the community informed. The organization acknowledged the ever-increasing reality of cyber threats targeting healthcare systems across the country and expressed its serious commitment to the trust patients and employees place in it regarding their care and information. The completion of the thorough investigation was anticipated to provide more definitive information about the incident's specifics. The overarching focus remained on ensuring patient care could continue while methodically working through the lengthy process of investigation, system restoration, and recovery.