Some University of Vermont Health Network clinical offices will no longer be able to access patient schedules starting Thursday, the latest ripple effect of a now week-old cyberattack that has thrown parts of the medical system into disarray.

According to spokesperson Neal Goswami, the problem is related to the hospital network's main electronic medical records system, Epic, which was taken offline as a "precautionary measure" following the discovery of last Wednesday's attack.

Epic is currently used in clinical settings at four of the network's six hospitals: Central Vermont Medical Center in Berlin, Porter Medical Center in Middlebury, Champlain Valley Physicians Hospital in Plattsburgh, N.Y., and the University of Vermont Medical Center in Burlington.

All four are asking patients to start calling their providers 24 hours prior to any appointments so that clinics have time to prepare.

"The clinics [backed up] seven days' worth of appointment lists, and seven days' worth of clinical information," said Dr. Wouter Rietsema, vice president of the Plattsburgh hospital's Population Health and Information Services. "But [starting Thursday], they will be sort of operating in the dark."

The scheduling blackout comes as information technology teams are still working to restore systems impacted by the attack. On Wednesday, Gov. Phil Scott announced that a specialized digital outfit from the Vermont Army National Guard will be supporting the hospital network as it attempts to review thousands of computers and devices to "ensure they are free of any malware or virus."

The network said in a statement Wednesday afternoon that it was making "steady progress" on the restoration process but remains unsure when it will be completed.

"We sincerely apologize for any difficulty or inconvenience this event is causing our patients," the statement read.

Federal and state authorities have not yet confirmed whether the attack on the health network was part of an apparently coordinated strike on hospitals around the country. Federal authorities and cybersecurity experts have said that Russian cybercriminals have been perpetrating the attacks, which use ransomware to hold health care data and systems hostage. Some hospitals have paid up to $1 million to free their systems. 

Dr. Stephen Leffler, president and chief operating officer of the UVM Medical Center, finally confirmed the nature of the attack on Monday, telling Vermont Public Radio that it was indeed “ransomware.” But he has maintained that he is unaware of any ransom requests to date.
Leffler and other officials have stressed that the network's hospitals continue to serve patients, albeit with some delays. But while they emphasize that the quality of care remains unaltered, some aren't so sure.

One nurse at the Central Vermont Medical Center in Berlin, who spoke to Seven Days on the condition of anonymity because she was not authorized to speak to the media, reported a "huge anxiety" among staff.

Beyond the scheduling challenges, providers also cannot access electronic medical records while Epic remains offline. They will instead need to piece together a patient’s medical history through other means, the nurse said, which makes it more likely for something to get missed.

"They’re really saying we have to function as an on-site urgent care — see patients as they call, as they walk in," the nurse said. "We can’t do that. We’re not an ER. That’s great if some of the clinics feel they can do that, but some of the clinics can’t.”

Hospital administrators say that in most cases, providers can piece together a comprehensive medical history using other sources, such as regional health information exchanges, which both New York and Vermont have. The health network is also encouraging patients to bring "as much information with them as they can" to their appointments, including current medications and any "after-visit summaries" they may have on file.

With that in mind, Rietsema, the Plattsburgh hospital executive, said he finds it highly unlikely that any providers would be treating patients "blind" to their medical histories, allergies or medication lists. A more apt description, he said, would be "a little fuzzy."

"The really blind part is just that, after today, we don’t know who’s going to show up," he said.

If your work or treatment has been affected by the cyberattack on UVM Health Network, please share your experience with Seven Days by filling out this form.