Experts Urge Hospitals to Rethink Backup Communications and Technology Dependencies
Amid the disruptive global Microsoft 365 outage that affected various sectors, healthcare experts are calling for immediate action from medical facilities to enhance their operational resilience. The incident, which impacted the communication and coordination functions of hospitals and clinics—despite not directly affecting core clinical systems—highlighted the urgent need for healthcare institutions to critically evaluate their dependency on third-party technologies and cloud-based services.
The disruption, which occurred on a Thursday, became particularly problematic for U.S. healthcare organizations, creating bottlenecks primarily in areas such as administration, communication, and authentication processes. David Utzke, CEO and CTO of MyKey Technologies, noted that while essential patient care continued largely unhindered, hospitals faced significant challenges with coordination and internal communications due to the outage. As per Microsoft, this outage was not the result of any malicious activity—a factor that served as a sobering reminder for the healthcare sector to prepare for various types of service disruptions, not just those linked to cyberattacks.
The nature of the outage primarily involved Microsoft’s Exchange Online, which disrupted its business email service, along with other Microsoft 365 features. Although organizations remained operational for patient care, behind-the-scenes administration faced strain as staff struggled to implement manual communication methods. Unlike the July 2024 CrowdStrike incident that significantly impacted Windows endpoints globally, this Microsoft outage primarily hindered email functionality, calendar synchronization, and access to cloud productivity tools.
Errol Weiss, Chief Security Officer at the Health Information Sharing and Analysis Center, remarked that the visible impact of the outage was largely felt in disrupted email services and staff coordination. Many healthcare providers had to consider contingency plans based on the duration of the outage. By early Friday morning, many services started to return to normal, but some users were still advised to anticipate delays in email delivery, which included instances of duplicate messages. Weiss emphasized the challenge in determining the full sector-wide impact, particularly regarding how patient care may have been affected.
Tom Walsh, a healthcare privacy and security consultant, further clarified that while communication disruptions were reported, there appeared to be no significant interruptions to clinical workflows. He noted that hospitals utilizing alternative services, such as Google for their email and office tools, experienced little to no direct impact from the outage. The reliance on different systems for communication is critical to understanding how care delivery could remain intact even amidst disruptions in other areas.
The disparity in methods used for clinical communication versus administrative functions was further highlighted by the experts consulted. Most clinical communication occurs within electronic health records (EHRs) rather than through email or cloud-based services. Weiss remarked on the variety of methods employed for communication in healthcare settings, including integrated messaging within EHRs, secure clinical messaging platforms, and traditional communication methods such as telephones and pagers.
In light of this recent incident, healthcare experts underscored the importance of developing reliable, out-of-band communication channels that do not rely on affected systems. Weiss recounted his experiences from almost two decades ago in the banking sector when a similar outage crippled internal communication. The key takeaway from that event was the paramount need for alternative methods of communication that could be deployed during service interruptions.
Operational resilience in healthcare requires meticulous planning, including the conduct of realistic incident response exercises that engage clinical leadership to practice maintaining patient care when primary IT or communication systems are unavailable. Organizations are urged to have tested contingency procedures that encompass contact lists and clear instructions for downtimes, as mere possession of backup tools does not suffice.
Furthermore, Walsh pointed out the necessity of performing business impact analyses to encompass various communication systems in line with HIPAA requirements. Tools that initially served convenience have evolved into mission-critical functionalities for healthcare organizations. This reinforces the notion that planning for potential interruptions is essential, regardless of their causes. Staff must be well-informed on alternate methods of reaching on-call personnel and coordinating urgent results when conventional platforms fail.
The recent outage echoes broader lessons learned from previous technology disruptions and cyberattacks across the healthcare sector, advocating for more robust contingency frameworks. Utzke emphasized that operational resilience requires evaluating shared points of failure and eliminating unnecessary technology dependencies that create vulnerabilities. Understanding where operations can continue independently from centralized technology is crucial for ongoing patient care.
Chris Frenz, CISO at Rectangle Health, solidified this perspective by advocating for "subtractive security." This method focuses on minimizing dependencies rather than simply increasing them. The infrastructure for emergency communications should not rely on the same systems that may fail during a critical incident. Critical contact lists and automated procedures for escalations should be readily available offline to ensure the ability to communicate seamlessly even in challenging circumstances.
The Microsoft 365 outage exemplified that the healthcare industry could benefit from a more deliberate reduction in dependencies on centralized systems. While eliminating all technology dependencies is impractical, healthcare organizations must strategically reduce the number of systems and services relied upon for essential care continuity. As institutions move forward, learning from the lessons of this recent disruption will be essential in fortifying both operational resilience and patient care delivery.