01 · The hospital that has no alternative
Sole provider, and a hundred miles of nothing
Sky Lakes Medical Center is a standalone not-for-profit hospital in Klamath Falls, Oregon, serving roughly 100,000 people across South Central Oregon. It is not one option among several. If a patient does not get care at Sky Lakes they drive about a hundred miles in any direction, at 4,300 feet, over mountain passes that winter closes.
It also provides essentially all of the imaging in its community. So when John Gaede says the stakes were clinical rather than operational, he means it literally: a trauma arriving in the emergency department needs imaging, and radiation oncology is a course of treatment that happens day by day.
- Standalone, not-for-profit, no parent system to fall back on
- Roughly 100,000 people in South Central Oregon
- About 100 miles to the nearest alternative, in any direction
- Effectively all the imaging in its community
02 · 26 October 2020
Every system in the building, switched off
The attack started with a phishing email at eight minutes past noon. By half past one the following morning a nurse was reporting that the network was slow, and by half past three the team knew what they were looking at. A server restored from backup began re-encrypting within minutes of coming back into production.
So they took the only decision left: shut everything down. Every computer, every server, every modality, everything in the hospital with a processor in it, apart from equipment like cardiac monitoring. Financial systems, supply chain, all clinical systems, medical and radiation oncology. The electronic medical record stayed offline for 23 days, and this was October 2020, the first peak of the pandemic, with eighteen years of accumulated tooling suddenly gone from under clinicians who were already stretched.
- A phishing email at 12:08pm on 26 October 2020
- A restored server re-encrypting within minutes
- Every system in the hospital shut down deliberately
- 23 days with no electronic medical record
- All of it during the first COVID-19 peak
Why it matters
“How do you take care of that trauma that comes into the emergency department without imaging?”
John Gaede, Director of Information Systems
Sky Lakes Medical Center
03 · Three months, or days
A PACS in the cloud, and a RIS the same week
Once the modalities were confirmed clean they could be switched back on, but a modality with no PACS, no RIS and no reporting system leaves a hospital doing imaging entirely on paper, which is not something anyone sustains. The quote to stand up a replacement PACS was about three months. Gaede’s answer was that it could not happen.
What followed was a week. Electromek and Sectra built the PACS in the cloud in three days, a configuration Sectra had not previously run in production. He needed more than a PACS, though: something had to schedule patients and run the radiology workflow. That call reached AbbaDox on the Monday, and by the Friday the RIS was live and scheduling, integrated with the new PACS over HL7, with 3M M*Modal Fluency for reporting. By Friday at noon a radiologist was reading a CT on an iPad, and on the Saturday the whole thing went live together.
- Modalities validated clean, then brought back up
- PACS built in the cloud in three days by Electromek and Sectra
- The RIS live and scheduling by the end of the same week
- PACS, RIS and reporting integrated over HL7
- A radiologist reading a CT on an iPad by Friday noon
04 · Yes before paperwork
Nobody had signed anything
The part Gaede returns to is not the speed. It is that none of it was under contract. He phoned people he had never met, at companies with no relationship to his hospital, and they started work on a verbal agreement. The contracts were signed months later. His phrase for it is that a yes was going to be a yes and a no was going to be a no, and the paperwork could follow.
Sky Lakes ran its scheduling on the platform for three to four months while the rest of the hospital came back; full recovery took about seven. The RIS is still in use for some workflows today, alongside the Epic module the hospital moved onto afterwards. And the hospital chose to talk about all of it publicly, which is rarer than it should be. Gaede’s argument is that the industry cannot learn from an incident nobody will describe.
- Work started on a verbal agreement; contracts came months later
- Scheduling ran on the platform for three to four months
- About seven months to full recovery across the hospital
- Still in use today for some workflows, alongside Epic
- The hospital chose to be public about the whole incident
Client story