UMMC’s 2026 Cyberattack: What It Took to Keep Care Moving

Key takeaway: When the University of Mississippi Medical Center lost its EHR and phone systems to a cyberattack in February 2026, its hospitals and emergency departments stayed open, inpatient teams moved to paper documentation and orders, and chemotherapy restarted within days through an offline infusion clinic and a central coordination center. The lesson for any hospital is to plan continuity one care pathway at a time: which records still support it, who accepts each decision, and how unfinished work reaches the next team.

Clinical continuity means organizing essential care around the information, people and communication routes a hospital can still use. UMMC's February 2026 response offers a concrete example. For another hospital, the useful starting point is one care pathway: which records support it, who accepts each action and how unfinished work reaches the next team.

What did UMMC report about continuing care?

UMMC kept its hospitals and emergency departments open throughout the response while clinics, elective procedures and its EHR were down. In its February 20, 2026 update, UMMC said its EHR and phone systems were unavailable. Inpatient teams were using paper documentation and patient orders, and emergency departments remained open. Clinic operations and elective procedures had been cancelled for the preceding day and that day.

Its March 2 account, titled "This has pulled us together," described an offline urgent infusion clinic and a multidisciplinary coordination center. Chemotherapy restarted February 23. Clinics resumed normal operations March 2. UMMC also described a central paperwork and supply distribution point. These were distinct operational milestones rather than one date proving every system was restored.

The discussion below is an original planning example. It does not reproduce UMMC's clinical procedures, establish uninterrupted care or attribute its response to a particular product.

What does one interrupted treatment reveal?

A single interrupted treatment shows every dependency at once: the record, the report held by another department, the clinician who must decide, and the person who tells the patient what happens next. Consider a fictional patient due for time-sensitive treatment. The appointment is known, but the usual record cannot be opened. A required report is held by another department, and a question needs an authorized clinician's decision. The team has to connect those pieces before deciding how to proceed.

Begin the conversation with what people need to know. Where is the approved downtime record? Who can confirm the relevant information? Who tells the patient or receiving team what happens next? Clinical leaders determine whether the available information supports care. A coordination list can make outstanding work visible without becoming an order or an authorization to treat.

This distinction gives different people a clear contribution. The person locating a report, the clinician reviewing it and the colleague contacting the patient may be doing related work, but they are accepting different responsibilities.

How can the team make the next action clear?

A five-step map lets a team talk through the whole journey without opening a long audit. Adapt the example below to a service your team knows, and use the hospital's approved records, clinical decisions and escalation rules throughout.

Discussion map: keep one urgent care pathway moving

1. Name the care need. Clinical team: identify the time-sensitive work and who is responsible for the patient.
2. Locate the approved information. Clinical team and supporting departments: confirm patient identity, the relevant record and its limitations.
3. Assign the unresolved question. Responsible clinician or service: accept the decision or follow-up that is still needed.
4. Confirm and record the action. Performing team: communicate the authorized next step and document it in the approved record.
5. Carry remaining work forward. Receiving or recovery team: accept outstanding items at shift change and when systems return.

If blocked, retain an owner and use the established escalation route. Completion means the authorized action is documented and remaining work has an accepted destination.

What changes when another shift takes over?

The test of a continuity plan is whether someone who was not in the room can pick up the work. Ask a person who was not part of the first conversation to explain where the work now stands. They should be able to find the active record, identify an unresolved question and reach the person who owns it. If that explanation depends on someone remembering a private conversation, discuss how the next team would learn the same information.

Include the physical route. A paper packet may be in the treatment area while another team is looking for it elsewhere. Forms, printers, document transport and a place for changed information belong in the discussion. Agree how the team distinguishes the current packet from an older copy, using local policy.

How can the conversation stay manageable?

Fifteen minutes, one workflow and one disruption is enough for a first conversation. Invite a person who performs the work and someone from a receiving or supporting team. Add IT or emergency preparedness when a question depends on access, communication or the wider response.

Spend the first few minutes choosing the example. Walk through the map together, paying attention to one uncertainty that matters to the group. End by agreeing one useful action, its owner and when to return to it. That action might be clarifying a contact route or locating the approved document. It need not be a technology purchase or a hospital-wide exercise.

Should another hospital copy UMMC's response?

No. UMMC's response reflected its own systems, staff and approved procedures, and the public updates describe milestones rather than a complete playbook. What transfers is the shape of the problem: care that depends on records, decisions and handoffs, each of which needs an owner when the usual route is gone. The practical aim for another hospital is shared understanding of a care process. People should know what they can use, what decision belongs to them and how to hand off the work they cannot finish. An unfamiliar dependency is a topic to investigate, not a readiness score.

Clinical communication platforms such as Backline can help teams keep a shared view of outstanding work and reach the right person when the EHR and phones are unavailable, though every hospital's downtime procedures govern what counts as an approved record or an authorized action.

If a treatment pathway is on your mind, pick one disruption, one workflow and one discussion focus, and bring the question to the people doing the work. Their next step is the place to start.

Sources

1. UMMC Vice Chancellor's Notes: We Press On (February 20, 2026)
2. UMMC: "This has pulled us together": care and learning during cyberattack (March 2, 2026)

Source links support the facts cited in this article. The discussion map is an example to adapt to a hospital's approved procedures.