Ascension still working to restore medical record access after cyber attack

A health system with dozens of hospitals and clinics in Wisconsin says it hopes to restore electronic medical record access for providers and patients by the end of next week.

Ascension detected a ransomware attack on May 8, which took out the St. Louis-based health system’s electronic medical records and systems for ordering tests and medications at locations across 19 states.

In the weeks following the incident, patients in Wisconsin and across the country have reported difficulty contacting their providers and receiving lab or imaging results.

Ascension announced Tuesday that it plans to completely restore medical record access by June 14. The health system said it has already restored medical record access at locations in Florida, Alabama and Austin, Texas.

An Ascension Wisconsin spokesperson said in an email that “work is underway” in the state, but the company does not yet have a specific recovery date for Wisconsin locations. The spokesperson added that Ascension’s pharmacy and home delivery services have returned to full operations, which they called a “promising and important” step.

“Our hospitals and facilities have remained open and continued to provide patient care since the incident occurred, and as our electronic health record is restored, clinicians will be able to access patient records as they did prior to the incident,” the spokesperson said in an email.

Members of the Wisconsin Federation of Nurses and Health Professionals, a union representing nurses and other health care workers at Ascension at Ascension St. Francis Hospital, have expressed their concern over the continued lack of access to the records system. Executive Director Jamie Lucas said in an email that Ascension has “provided very little information” to the union and its members since the attack.

“Today, we were told that (the electronic medical records) might be back up by Friday and we hope to confirm this soon,” Lucas said in an email.

It’s not the first health system in the state to experience a cyber security attack.

Last year, a cyber attack caused a system-wide outage for Hospital Sisters Health System and Prevea. In early 2024, Group Health Cooperative of South Central Wisconsin, a nonprofit managed health care organization, also suffered a cyber attack that resulted in patients’ personal information being released.

Alex Holden, chief information security officer for Hold Security in Milwaukee, said it’s surprising that Ascension has taken nearly a month to restore its system. He said hospitals and other companies facing similar ransomware attacks have restored normal operations within days or weeks.

“They’ve been victimized by cyber criminals, however, it’s taking too much time to restore the data that should be readily available,” he said. “The backups of this data should be available also for quick restoration, in case of a cyberattack, natural disaster or something similar.”

He said hospital systems have seen a growing number of ransomware attacks in recent years, in part because of the large dollar amounts that cyber criminals can charge to return access to the data. He pointed to the $22 million in bitcoin paid by UnitedHealth paid in a ransomware attack earlier this year.