Regularly scheduled clinic appointments and elective procedures at the University of Mississippi Medical Center are canceled through Friday, extending statewide disruptions in health care to more than a week since a cyberattack targeted Mississippi’s only academic medical center.

UMMC is making significant progress in its response to the Feb. 19 cyberattack and restoring systems, the medical center said in a statement Wednesday afternoon.  

“Through diligent, around-the-clock work, UMMC is hopeful that it will be able to resume normal clinic operations as soon as Monday,” the statement read. 

Patients across Mississippi have missed health care appointments and surgeries since the attack, which compromised the health care system’s IT network and forced the medical center to shut down all of its network systems, including its electronic patient health records. Experts have warned the hospital system could face weeks or months of recovery following the attack. 

Jimmie Elaine White of Brandon had a follow-up appointment scheduled for Feb. 19, the same day the cyberattack began, to go over the results of an ultrasound examining a blockage in her carotid artery.

Since then, she has been unable to contact UMMC to reschedule the appointment, leaving her increasingly anxious.

“I’m worried that I’m going to have a stroke,” White said. 

UMMC is one of Mississippi’s largest providers of specialty health care and operates the state’s only Level 1 trauma center, which is equipped to handle the most severe medical emergencies.

All UMMC hospitals and emergency departments in Jackson, Madison County, Holmes County and Grenada remain open, and UMMC will reschedule canceled appointments, it said in a statement. 

Nearby hospitals are stepping in to fill gaps in care caused by the attack.

“We have increased staffing and welcomed patients in our emergency department and clinics to help offset any immediate needs and meet increased demands for health care in our community,” said Baptist Memorial spokesperson Kimberly Alexander. 

The medical center has not yet publicly described how extensive the attack on its computer systems was or if any data was compromised. In a Tuesday interview with SuperTalk Mississippi, medical center Vice Chancellor Dr. LouAnn Woodward confirmed the attacker made financial demands. 

Getting hospital computer systems back up and running after a ransomware attack can take anywhere from a couple of weeks to a month, but full recovery often takes much longer, said Allan Liska is an intelligence analyst for cyber threat intelligence company Recorded Future.

“It can take six months to a year to fully recover,” said Liska, who is also an expert in ransomware, or malicious software that holds computer systems or data hostage with demands for a payment.

Usually, computer systems that have been infiltrated are rebuilt from scratch, then tested segment by segment while disconnected from the internet to ensure that the attackers are out, Liska said. Once they are confirmed to be secure, the systems are gradually brought back online. 

UMMC has endured security breaches before. After a 2013 report of an incident involving unsecured electronic patient health information, the U.S. Department of Health and Human Services’ Office for Civil Rights investigated UMMC’s cybersecurity policies. The agency determined that UMMC had identified risks and vulnerabilities to its systems as far back as April 2005 but did not undertake significant risk management efforts until after the breach.

UMMC agreed to settle the matter by paying a resolution amount of $2.75 million and adopting a corrective action plan. The Office of Civil Rights closed the matter in 2022 based on documentation of UMMC’s compliance with the terms of the resolution and settlement.

Liska said it’s difficult to evaluate from the outside whether a hospital system has effective defenses against cybersecurity attacks. Attackers are constantly changing their tactics, and even well-prepared organizations can have vulnerabilities, he said. 

“’Everybody has a plan until you get punched in the face,’” he said, quoting former professional boxer Mike Tyson. 

Patients with time-sensitive needs including prescription refills can call the automated UMMC Triage Line at 601-815-0000, the medical center said. Patients requiring immediate assistance will be contacted directly to schedule an urgent care clinic visit.