The cybersecurity issue at Lurie Children’s Hospital that has spanned more than a week is having ripple effects across the pediatric medical community — from slow-downs in billing to young patients being sent to other hospitals to community physicians who rely on Lurie’s system struggling to communicate with families.

Lurie, which is nationally renowned and is the biggest children’s hospital in the Chicago area, has been dealing with a “criminal threat” to its network, which forced Lurie to shut down the system since Jan. 31.

As the cybersecurity issue cripples communication at Lurie and beyond, some pediatricians are sending their young patients to other hospitals if they need urgent medical care.

But without a window into children’s previous treatment at Lurie, since their online medical records have gone dark, these patients are often showing up without access to their medical history, lab results or medications — crucial details a doctor might need to help make decisions about their medical care.

The outage is not only affecting medical professionals at Lurie hospital. Some pediatricians and medical groups that are affiliated with Lurie also can’t use their billing system or online patient records.

• RELATED STORY
• Environment & Public Health

Lurie Children’s Hospital says a ‘criminal threat’ forced the shutdown of its network

read more

“Still no update on when we will have access to the Lurie system,” the Northwestern Children’s Practice, which has an office on Lake Shore Drive near Lurie, posted on Facebook. “One of the ways that this affects us is that we cannot bill insurance companies, and if that’s [sic] lasts much longer, well … let’s hope it doesn’t.”

A representative from Northwestern Children’s did not return a message to comment.

Lurie took its network offline based on “evidence of suspicious activity,” the hospital’s chief medical officer said on Thursday. Leaders confirmed their network was accessed by a “known criminal threat actor” and that they are prioritizing patient care.

But they declined to take any questions, offering little insight into what happened or how the hospital is managing to treat patients on paper. They have declined WBEZ interview requests over the last week. A spokeswoman for the FBI confirmed the agency is investigating but declined to answer questions.

Lurie has taken down phones, email and the online MyChart patient portal where families can message with their doctors, book appointments and see lab results. That has created a domino effect for some community pediatric practices tied into Lurie’s system, leaving them unable to communicate with families online either. They encourage parents to call in.

Lurie also took down its electronic medical records system, where doctors need to sign their online charts after treating patients before they can bill insurance companies to reimburse them. In the meantime, Lurie is trying to figure out a way to help doctors manually bill.

In a statement, a Lurie spokeswoman said the hospital is trying to find workarounds. For example, Lurie has connected some community providers to specialists through a messaging portal to help manage patients together.

Lurie’s reach is vast, with immediate care centers and clinics throughout the suburbs that funnel the sickest and most complex youngsters to the downtown hospital. Lurie is a destination in the Midwest and is a safety net for low-income children. About half the patients who were hospitalized in 2022 had Medicaid, the government-funded health insurance for kids who are poor or disabled, the most recent state records show.

Lurie has become even more significant as community hospitals over the years have closed their pediatric units.

Some doctors shared stories with WBEZ of having to manage patients since Lurie went offline.

Dr. Stephanie Liou, director of pediatrics at Alivio Medical Center near the Lower West Side, saw a patient recently who was following up after a visit to Lurie’s emergency department and had a handwritten note with no date. She asked the child’s mom when they went, which could be important to understand when the child should be getting better.

“I had no way to get more information,” Liou said.

Alivio faxes paper records like referrals and orders to Lurie, but even the pediatric hospital’s fax machine was down. Liou said she has resorted to sending paper copies of visit details and encourages patients to photograph them in case they get lost.

Most of Liou’s patients are low income and have Medicaid health insurance (or their applications are pending) and speak either Chinese or Spanish. She said she typically refers patients to Lurie because they take so many types of Medicaid plans and have more specialists than many other hospitals in the area. But with little way to communicate with the hospital, she’s been referring patients elsewhere.

Liou said she worries her patients might fall through the cracks when it comes time for them to reschedule appointments or procedures booked long ago that Lurie might have canceled, exacerbating health inequities. The parents might not be able to convey their children’s medical history, and may not be as savvy about how to get their children back in, she said.

“A lot of them will need an interpreter, and a lot of them are not familiar with how the system works,” Liou said. “I have enough trouble reaching them.”

A new patient, a 6-month-old baby boy, arrived at Esperanza Health Centers this week who recently had an ultrasound of his heart at Lurie and his parents wanted to better understand the results. Like other pediatric offices, Esperanza can typically view Lurie’s online medical records. But Dr. Alejandro Clavier, a medical director at the Southwest Side health center, said they didn’t have access.

“In this case we do as much as we can, but we have to have (the patient) come back,” Clavier said.

In another case, a Lurie specialist had to call Clavier to get details on a patient, instead of being able to quickly look over the patient’s medical record online.

“Imagine for them how hard it has to be, how much time for them it takes to call me,” Clavier said. “The human toll is immense, no? For providers and for patients.”

Esperanza hasn’t referred patients to other providers. More than 90% of the health center’s pediatric patients have Medicaid.

“We depend on Lurie so much,” Clavier said. “I think patients are being served. I just think it’s super inconvenient.”

At least 10 young patients who would have typically gone to Lurie based on information from their parents have been transferred to UChicago Medicine’s Comer Children’s Hospital since Lurie went offline, said Dr. John Cunningham, the physician-in-chief at Comer. That number includes a couple newborns who were transferred from Lurie.

Lurie is keeping in touch with the Illinois Department of Public Health about how they are managing care, but they haven’t asked for help, a department spokesman said. The hospital’s busy emergency department is still up and running.

A Fitch Ratings report on Friday said the cybersecurity issue is suspected to be ransomware and that Lurie expects to regain “some systems shortly, but due to the complexity of the medical center’s systems, full resolution may take weeks.” While the rating agency said it did not anticipate any immediate effect on Lurie’s credit rating, that depends how long the shutdown lasts.

Parent frustration

Lurie has set up a call center where families can leave messages with an operator for a provider to call back and is able to text patients. For parents who have been able to get through comes relief, and some have been empathetic to Lurie’s situation.

But others, like Debora Land, feel left in the dark. Besides statements on Lurie’s website and on social media, there hasn’t been much outreach to the thousands of patients and their parents.

Land’s teenage daughter is a longtime Lurie patient and needed her doctor to write a lab order on paper so she could get bloodwork done before an upcoming appointment booked six months ago. The lab couldn’t access the doctor’s order online. Land said she left two messages with the call center and showed up at Lurie twice with a note for her daughter’s doctor to request the paper order but wasn’t allowed to leave her letter.

At one point, the receptionist at the hospital called the call center and handed Land the phone so she could leave another message for her daughter’s doctor. She describes the call center as a “black hole.”

“Here I was, standing in the hospital. I am a parent. I am a stakeholder,” Land said.

She criticized the lack of communication to parents.

“They’re so internally focused on their problem at hand that they forgot that we’re all sitting here and telling us, ‘Oh, we know you’re frustrated, but please be patient,’ doesn’t cut it,” Land said. “It’s not enough.”

On Thursday, a nurse finally got in touch with Land with a paper order for her daughter’s blood draw — five days after she first called.

Kristen Schorsch covers public health and Cook County for WBEZ.