What happens when healthcare systems face downtime?

When digital systems fail, healthcare staff can lose access to test results, medication records and patient histories. They must rely on manual processes while continuing to provide care, which can delay treatment, reduce capacity and add to the work required after systems return.

Downtime can follow a cyberattack, a software fault or planned maintenance. Whatever the cause, it changes how clinical decisions are made and how resources are allocated across a health system.

How healthcare downtime affects patient care

The July 2024 CrowdStrike outage shows how a faulty software update can disrupt healthcare at scale. Tully and colleagues detected network disruptions at 759 of 2,232 North American hospitals with observable data. Their external scanning measured service availability, not patient harm, but the findings show how a shared technology dependency can affect many organisations.

The 2024 Synnovis ransomware attack had consequences across connected services. NHS England reported significantly reduced pathology processing capacity and delays to more than 11,000 outpatient and elective procedure appointments. Services were fully restored by December, but the disruption affected clinical pathways that relied on the supplier.

The effects are not the same for every patient. Straw and colleagues’ 2026 review describes risks for people who need immediate intervention and for those whose ongoing treatment depends on digital services. Psychiatric harms were more frequently reported in social media material than in academic studies. The evidence is varied, and the chart’s counts do not show how often these harms occur; they do highlight patient groups leaders may need to consider in downtime planning.

Why a hospital outage can affect the wider health system

Disruption can shift demand to neighbouring providers. Dameff and colleagues found increased emergency department demand and longer waits at hospitals near an organisation experiencing ransomware disruption.

In Aotearoa New Zealand, Hoffman and Baker’s account of the Waikato attack describes difficult decisions about investigations and the deferral of elective orthopaedic care. Downtime can therefore affect how scarce clinical resources are allocated across a wider population.

Recent economic research adds to the evidence. Neprash and colleagues’ 2026 study linked ransomware incidents with Medicare claims and estimated that hospital activity fell by 17% to 24% during the first week of an attack. For patients already admitted when an attack began, estimated inpatient mortality was 34% to 38% higher than the comparison baseline. These findings relate to a specific population and should be applied carefully elsewhere, but they show that disruption can have consequences beyond delayed administration.

How healthcare leaders can build downtime resilience

Continuity capability helps protect clinical capacity. Deferred treatment creates work for the future, while manual processes draw staff away from other responsibilities. A credible business case should account for both the capacity lost during disruption and the resources needed to recover.

Choudhuri and colleagues propose a three-tier approach to resilience in intensive care. It starts with essential manual safeguards that units can implement with limited resources, then adds more advanced capabilities as resources and requirements allow. This gives leaders a practical baseline and a way to prioritise investment according to clinical risk.

A downtime plan needs to work in practice, not just on paper. HIMSS’s preparation and recovery protocol includes reviewing downtime policies, checking supplies, practising drills, activating the plan and reconciling records after service returns.

Van Boven and colleagues’ qualitative research describes limited preparedness for prolonged outages and significant effects on staff wellbeing. Although the interview sample was small, the findings raise a practical question for leaders: do local plans assume more staff will be available than a sustained incident would allow?

Alternative digital arrangements may preserve some capability. Jo and colleagues describe a backup information service and emergency prescribing application used during a planned 90-minute outage. Because scheduled maintenance allows for preparation and may leave supporting infrastructure available, leaders should check which dependencies are shared with the primary system and practise scenarios in which those dependencies also fail.

Recovery needs its own time and staffing plan. Restoring system access leaves work to do: treatment records must be reconciled and outstanding investigations reviewed. Van Boven and colleagues describe the return to digital working as another source of disruption.

What to consider when planning for downtime

Healthcare leaders and technology suppliers should consider how continuity arrangements will work in the customer’s actual clinical environment. England’s Health Services Safety Investigations Body has identified gaps in understanding electronic patient record capabilities, alongside variable implementation governance. Continuity commitments are more credible when their assumptions have been tested with the people expected to deliver care.

As healthcare becomes more reliant on digital services, leaders can protect care by requiring evidence of how essential services will continue during failure, then funding the weaknesses that exercises reveal. Demonstrated continuity capability gives organisations a sounder basis for deciding where to invest and how quickly to grow.

Authored by Tom Varghese, Global Product Marketing & Growth Manager at Orion Health.

---

References

• Choudhuri B, Prakash J, Pal B, Veenith T. Cyber-resilient intensive care unit: ransomware is a patient-safety crisis—a resource-stratified approach for India. Indian J Crit Care Med. 2026;30(5):363–367. 
• Dameff C, Tully J, Chan TC, et al. Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Netw Open. 2023;6(5):e2312270. 
• Gecomo JG, Klopp A, Rouse M. Implementation of an evidence-based electronic health record (EHR) downtime readiness and recovery plan. Online J Nurs Inform. 2020;24(1).
• Health Services Safety Investigations Body. Electronic Patient Record (EPR) Systems—Thematic Review. Published November 27, 2025.
• Hoffman TW, Baker JF. Navigating our way through a hospital ransomware attack: ethical considerations in delivering acute orthopaedic care. J Med Ethics. 2023;49(2):121–124. 
• Jo I, Kim W, Lim Y, et al. Strategy for scheduled downtime of hospital information system utilizing third-party applications. BMC Med Inform Decis Mak. 2024;24:300. 
• Larsen E, Hoffman D, Rivera C, Kleiner BM, Wernz C, Ratwani RM. Continuing patient care during electronic health record downtime. Appl Clin Inform. 2019;10(3):495–504. 
• Straw I, Kumar D, Kweon S, Selzer J, Dameff C, Tully J. Unveiling patient-level harms and at-risk clinical groups during hospital cyberattacks: systematic review of global case studies and social media data. J Med Internet Res. 2026;28:e88257.
• Tully JL, Rao S, Straw I, et al. Patient care technology disruptions associated with the CrowdStrike outage. JAMA Netw Open.2025;8(7):e2530226. doi:10.1001/jamanetworkopen.2025.30226
• Neprash H, McGlave C, Nikpay S. Hacked to pieces? The effects of ransomware attacks on hospitals and patients. Am Econ J Econ Policy. 2026;18(1):256–281. 
• Neprash HT, McGlave CC, Rydberg K, Henning-Smith C. What happens to rural hospitals during a ransomware attack? Evidence from Medicare data. J Rural Health. 2024;40(4):728–737. 
• NHS England. Synnovis Cyber Incident. Updated November 10, 2025.
• van Boven LS, Kusters RWJ, Tin D, et al. Hacking acute care: a qualitative study on the health care impacts of ransomware attacks against hospitals. Ann Emerg Med. 2024;83(1):46–56.