Campbell County Health is working hard to serve the community while its computer systems are down after a ransomware attack Friday.
The hospital is on divert, meaning it is not accepting any EMS transports to the emergency room. Other hospitals in the region are aware of the situation and are working with CCH.
According to the Cybersecurity and Infrastructure Security Agency, which is part of the Department of Homeland Security, ransomware is a type of malicious software, or malware, that is designed to deny access to a computer system or data until a ransom is paid.
According to a press release Saturday morning, there is no evidence that any patient data has been accessed or misused. CCH does not have an estimate of when its systems will be back up, but the ransomware has affected all 1,500 of the organization’s computers, including its email server.
Until the problem is solved, anyone receiving an email from a Campbell County Health address that ends in @cchwyo.org should be suspect of it. If you get an email that appears to be from CCH, you’re asked to call 307-299-4708 to report it.
Chief Nursing Officer Misty Robertson said CCH’s emergency department is still operational and will see patients who walk in, stabilize them and transfer them if necessary. The Walk-In Clinic, which is open from 8 a.m. to 6 p.m. Sunday with the last patient being accepted at 5:30 p.m., will do the same.
Hospitals in Casper, Sheridan and Rapid City, South Dakota, are aware of the situation. Casper and Rapid City are full, but are willing to talk to CCH about accepting patients on a case-by-case basis, said Steve Crichton, vice president of plant and facilities for CCH.
And EMS officials in Crook and Weston counties “understand they can’t bring anybody to us right now,” said Campbell County Health board trustee Ronda Boller.
The hospital also urges maternity patients to still come to the Campbell County Memorial if they need care and they can call 307-688-2200 for more information about maternity cases.
The hospital’s cybersecurity authorities have been contacted, Crichton said, but the issues are expected to last through the weekend.
As of Saturday evening, CCH had transferred six patients to other facilities. There are about a couple dozen more patients in the hospital and 142 in the Legacy Living and Rehabilitation Center, which is “in good shape,” said Jonni Belden, administrator at the Legacy.
“Our staff’s response and the calmness that exists in this building when such an awful incident is occurring should be noted,” said CCH board chairman Dr. Ian Swift. “I’m very impressed with our leadership, I’m very impressed with the employees and just the response this organization’s made.”
CCH Chief Operating Officer Colleen Heeter said there are seven ambulance drivers ready to transport patients if needed, and flight crews are available as well.
“The residents of Campbell County are safe, and if things do occur, through our ER and other services, we will make sure that they receive the care that they need,” Swift said.
Heeter said CCH might not be the only victim of this ransomware attack, adding that there are potentially two other places in Wyoming that were affected.
CCH is talking with its cybersecurity attorneys as well the state Department of Homeland Security, Federal Emergency Management Agency, the governor’s office and the FBI to figure out what steps to take to resolve this issue.
“Most of the systems we depend on for our patient care are not able to be seen by anyone. We have all computers in the hospital shut off at this point,” Crichton said.
Campbell County Commissioners approved a resolution Friday afternoon declaring a disaster to initiate the process of an 1135 waiver.
David King, Campbell County Emergency Management coordinator, said if a hospital diverts patients to a less capable facility, it risks losing some of its federal reimbursement money.
The waiver, if approved, protects the organization from this. It has to start with a local disaster declaration and will make its way up the chain, ending at the federal level, where it will go to either the Department of Health and Human Services or the president.