University Hospitals shuts down some systems after a cybersecurity issue

Cleveland-based University Hospitals shut down some of its systems following an unspecified cybersecurity issue, according to HIStalk's Monday Morning Update for October 26, 2026. The health system said patient care is not impacted. HIStalk characterized that statement as a boilerplate assurance, and no independent detail on the cause, the systems involved or the expected duration has been reported.

That gap is the point for every other organization reading this. What is known is limited: a large health system made a deliberate decision to take some systems offline, and it has said care continues. What is not known is whether the shutdown was containment, precaution or consequence, which systems went dark, and how long clinical and business teams will work without them. Leaders should treat the public statement as a claim, not as evidence, and resist drawing conclusions about the attack or the response until more is reported.

The lesson does not depend on those details. A partial shutdown is a choice security teams may need to make quickly, and its cost lands on nurses, pharmacists, registration staff and the people answering the phones. Whether patient care is truly unaffected during an event like this depends less on the security operations center than on whether frontline teams can keep working safely on paper, with clear roles and a known path back to normal operations.

For the CISO, the question is whether the authority and criteria to isolate systems are written down and agreed in advance with operations and clinical leadership, so a shutdown decision does not stall. For the COO, it is whether downtime procedures cover registration, scheduling, orders and communication with patients, and whether staff know where the forms are. For the CNO, it is whether nurses can safely administer medications and document care without the electronic record, and how that documentation gets reconciled afterward.

The move: run a tabletop exercise this week on a partial system shutdown, testing paper downtime procedures in nursing, pharmacy and registration. Include the people who would actually do the work, not only managers. Time how long it takes to switch over, note every point where someone had to ask what to do, and assign owners to fix those gaps. The return is a shorter, calmer disruption for patients and less strain on the employees who carry the load when systems go dark.

You are an operations advisor to the COO and executive team of [your organization], a [type of organization, such as health system or clinic group].

HIStalk's Monday Morning Update 10/26/26 reports that Cleveland-based University Hospitals shut down some of its systems following an unspecified cybersecurity issue. University Hospitals said patient care is not impacted. HIStalk characterized that statement as a boilerplate assurance, and no independent detail on the cause, the systems involved or the expected duration has been reported. Treat the statement as a claim, not evidence, and draw no conclusions about the attack or the response.

Design a tabletop exercise we can run this week on a partial system shutdown, testing paper downtime procedures in nursing, pharmacy and registration. Include frontline staff who would actually do the work, not only managers. Build in steps to time the switch to paper, log every point where someone had to ask what to do, and assign an owner to each gap. Cover who has authority to isolate systems, registration, scheduling, orders, medication administration and documentation, patient communication, and reconciliation afterward.

Produce a draft workflow for the executive team with these sections: scenario and assumptions; participants by role; exercise steps with owners and checks; what to time and log; gap tracker with owners and due dates; return to normal operations.

Use these details: [your EHR and pharmacy system], [departments and units in scope], [date and length of the exercise], [names or roles of the CISO, COO and CNO leads], [where downtime forms are kept today].

Use only the facts above and the slots I fill. Cite HIStalk by name when referring to the University Hospitals event. Flag anything uncertain or that needs verifying against our own policies. Do not request or include any patient data. Nothing here is medical advice. Label the output as a draft for the team to check.