Lessons From the University Hospitals Cyber Incident: A Healthcare Leadership Perspective

University Hospitals (UH), an 18-hospital system based in Cleveland, has spent the past week recovering from a cybersecurity incident that took digital services offline and led to the rescheduling of some appointments and elective procedures. The incident remains under investigation, and the facts may change. Even so, the disruption already raises practical questions for every healthcare organization that relies on connected clinical systems, outside partners and the trust of the communities it serves.

From our respective perspectives in cybersecurity and healthcare, the central lesson is clear: a cyber incident in a health system is not only an information technology event. It can quickly become a patient-access, clinical-continuity, revenue-cycle, liquidity, regulatory and reputational event. This advisory summarizes what UH has disclosed publicly and highlights the questions healthcare boards and executive teams should be asking now.

What Happened at University Hospitals

On Thursday, October 22, UH detected unusual activity on its servers. It activated its response protocols and, in its words, disconnected its systems from the internet “out of an abundance of caution.” The decision contained the threat but took certain digital services offline, including the MyChart patient portal and the public website. At first, UH reported no impact to patient care delivery. As the outage continued, it began rescheduling some appointments and elective procedures. On Monday, October 26, UH confirmed publicly that it had experienced a cybersecurity incident.

The table below traces the incident through UH’s public statements.

Current Status

As of October 27, UH reports that it “made significant progress over the weekend in restoring our systems to full operability,” but that it continues “to work through challenges and that will continue through the week.” Three problems remain visible to patients and staff:

UH has given no timeline for full restoration. Patients with questions about results or appointments should contact their provider’s office directly.

Activities Under Way at the Hospital

UH reports no impact to patient care delivery and warns that digital disruptions may last several days. It directs patients to contact their provider’s office directly and to call 866-844-2273 to schedule appointments. 

What Remains Unknown

UH has not disclosed the cause or full scope of the incident, whether patient information was compromised or when all affected systems will return. Healthcare organizations should treat early reports with caution. Investigations of this kind often take weeks, and the first public account rarely tells the whole story. If the investigation finds that protected health information was exposed, federal and state breach notification rules will set the timing and content of the notices that follow.

The stakes are high. UH completed its move to the Epic electronic health record in 2023, converting 5.6 million patient records and its scheduling systems into one platform at an expected cost of about $400 million. Consolidation can create significant clinical and operational benefits, but it can also concentrate dependencies. When a core platform or its connections are unavailable, the effects may extend across patient access, clinical workflows, scheduling, authorization, billing and communication.

Six Healthcare Cyber Resilience Priorities for Leaders

Healthcare leaders need not oversee every technical control. They should, however, understand how the organization would continue safe care, protect cash flow and make timely decisions if critical systems went dark tomorrow. The UH incident points to six areas that deserve immediate attention.

1. Decide in Advance Who Can Pull the Plug

UH detected unusual activity and disconnected from the internet the same day. Rapid isolation can be an important containment step, but it carries significant operational consequences. Leaders should confirm who may isolate systems, under what conditions, who can activate downtime procedures and emergency spending and how clinical, financial, legal, privacy and communications leaders join the decision process. These roles should be rehearsed in tabletop exercises so that the first real event is not the team’s first time working through them together.

2. Plan to Operate Offline

Containment has a price. Once UH went offline, it lost its patient portal, struggled with network access at some sites and could not process insurance pre-authorizations smoothly. Health systems should identify the clinical and administrative processes that cannot stop, document manual workarounds and train staff to use them. Priority workflows should include patient identification, medication administration, results, documentation, scheduling, registration, referral, discharge, charge capture, claims submission and prior authorization. Downtime procedures, forms and contact lists must also be accessible when the network is not.

3. Revenue-Cycle Continuity and Liquidity Plan

A healthcare cyber incident can interrupt the front, middle and back ends of the revenue cycle. Delayed authorizations may affect scheduling, while disruption to registration, coding, charge capture, claims processing and remittance workflows can delay billing and collections. Finance leaders should model the cash effect of a multi-day outage, identify critical revenue-cycle functions, confirm access to liquidity required to continue business operations and establish a disciplined method to track deferred claims and post-restoration backlogs.

4. Map Your Third-Party Connections

UH’s recovery depends in part on reconnecting to outside partners, and its pre-authorization delays determine how much healthcare work runs through payers and vendors. Leaders should maintain a current inventory of critical connections across payers, laboratories, pharmacies, clearinghouses, physician practices, cloud providers and medical-device platforms. Each connection should have an accountable owner, a business-criticality ranking and criteria for safe reconnection. Relevant contracts should also be reviewed for notification, cooperation, security and recovery obligations.

5. Restore According to Clinical and Business Continuity Plan

A technically convenient recovery sequence may not be the plan a healthcare organization needs most. Leadership should predefine which applications, interfaces and external connections return first based on patient safety, operational dependency, financial impact and data integrity. The recovery plan should also explain how the organization will validate that restored systems are clean, interfaces are functioning and transactions processed during downtime are complete and accurate.

6. Communicate Early, Plainly and Often

UH issued statements after detection and continued to update the public as restoration progressed. During downtime, patients and staff need practical guidance: what is unavailable, which services remain open, where to go for care, how to obtain results or schedule services and when another update will be provided. Organizations should prepare holding statements, alternate communication channels (i.e., social media) and an update cadence in advance. Communications should be coordinated across incident response, clinical operations, legal, privacy and leadership so that speed does not come at the expense of accuracy or consistency.

Making Cyber Resilience Part of Healthcare Operations

Prevention remains essential, but no organization can stop every intrusion. Resilience depends on what happens in the hours and days after detection: who decides, how patient care continues, which systems and interfaces return first, how deferred clinical and financial activity is reconciled and what patients, employees, payers and partners hear. These questions belong to the board and the full executive team, not only to the IT department. Organizations that practice the decisions now will be better positioned to protect patients, preserve liquidity and maintain trust when a disruption occurs.

Questions for Boards and Executive Teams

Boards and executive teams should ask when the organization last performed an enterprise downtime exercise; which patient-care and revenue-cycle processes would fail first; who has authority to isolate systems and approve emergency actions; whether restoration priorities reflect clinical and financial necessities; how a three-day, seven-day or longer disruption would affect the healthcare organization’s cash flow; how downtime activity will be reconciled; and what evidence demonstrates that backups are protected, recoverable and regularly tested.

About This Advisory

This advisory reflects public information available as of October 26, 2026, including University Hospitals’ statements as reported by WKYC, News 5 Cleveland, cleveland.com and Becker’s Hospital Review. The situation continues to develop, and later disclosures may change the facts described here. This document provides general information, not legal, clinical or technical advice for any specific organization.