When Ransomware Hits the Med Cart: How Chicago Nursing Homes Can Survive an EHR Shutdown
When the EHR goes dark in the middle of a shift, resident care still has to move forward. A calm, practiced downtime plan helps your team do that safely while IT works on recovery.
Why an EHR Shutdown Affects More Than the Screen
A ransomware incident can make electronic health records unavailable with little warning. Suddenly, a nurse may not be able to confirm an order, check a recent note, or document a medication pass in the usual system. Depending on how your facility’s technology is connected, scheduling, phones, pharmacy communications, or shared files may also be affected.
That doesn’t mean care has to stop. It does mean staff need clear instructions for what to do next.
A facility may need to rely temporarily on paper records or other approved downtime tools. Common pressure points include:
Checking current medication orders and documenting administration.
Confirming allergies, diagnoses, and care instructions.
Contacting physicians, pharmacies, labs, and family members.
Tracking resident location, status, admissions, and transfers.
Protecting paperwork that contains protected health information (PHI).
There’s a compliance side, too. HIPAA’s Security Rule calls for contingency planning, including data backup, disaster recovery, emergency operations, and periodic testing.[1] HHS also identifies ransomware as a security incident that covered entities and business associates must address.[2] The practical takeaway: your facility should be ready to care for residents, protect information, and document its response, even when normal systems are unavailable.
Three Practical Ways to Keep Care Moving
1. Prepare a downtime workflow staff can actually use
A plan is only useful if people can find it and follow it during a busy shift. Keep printed instructions and forms in an accessible, known location, not only in a shared drive that may be unavailable.
Work with nursing leadership to identify what staff must record during downtime. Your forms may need fields for medication administration, orders, vital signs, assessments, results, incidents, and transfers. Include a process for checking orders and documenting who completed each action. When appropriate, use read-back or a second-person verification step for critical instructions.
Make the plan specific to your facility. Name the person who activates it, who contacts the EHR vendor and IT support, and who communicates with department leaders. Include current phone numbers for key vendors, pharmacies, physicians, labs, and internal decision-makers. Keep a current resident census and a practical way to coordinate staff if email or internal messaging is unavailable.
Most importantly, explain how staff will reconcile paper records once systems return. Each manual entry should be reviewed and entered into the correct record, with a clear indication of when the event occurred and who completed the documentation. That follow-through helps prevent missing, conflicting, or duplicated information.
2. Build backups you can restore, not just backups you can see
A backup is not a recovery plan until someone has tested restoring it. Ask your IT provider how often backups run, what systems and data they cover, how they’re protected from attackers, and when the last restoration test took place.
For a nursing home, recovery planning should look beyond the EHR database. Consider the systems and information staff rely on to provide care and run operations, including:
EHR records and clinical documents.
Medication-related data and key interfaces.
Staff schedules, contact lists, and important configurations.
Shared files, identity systems, and communication tools.
Keep protected copies that aren’t simply reachable with the same credentials as everyday computers. CISA recommends organizations prepare for ransomware and maintain recovery capabilities, including backups that can be restored.[3] Ask your provider to explain recovery priorities and realistic timelines in plain English. “We back it up” is a start. “We tested recovery and know what comes back first” is far more useful.
3. Practice the response before a real incident
A short tabletop exercise can reveal practical snags before they land on the night-shift team. Walk through a scenario: the EHR is inaccessible, a workstation displays an encryption notice, and staff can’t reach the usual shared files.
Ask: Who declares downtime? How does the charge nurse access forms? What communication channel still works? Who contacts the IT provider and EHR vendor? Who tracks resident-care documentation? Who coordinates updates for families and leadership?
After the exercise, note the gaps and assign owners. Update the contact list, replace outdated forms, and clarify any confusing instructions. CISA’s healthcare-specific ransomware guidance is designed to help organizations prepare and respond, and can be used to support your planning.[3]
During an actual suspected incident, staff should promptly follow your established reporting process and contact the designated IT or security lead. Don’t improvise by deleting files, plugging in personal devices, or trying to investigate the attack yourself. The response team can assess the situation, isolate affected equipment where appropriate, preserve relevant information, and coordinate recovery.
The Bigger Picture
Ransomware readiness isn’t just about getting the EHR back; it’s about giving staff a clear path to continue safe, organized care while systems are restored. For Chicago-area nursing homes, a well-practiced plan can support resident safety, protect privacy, and give administrators better visibility when a disruption crosses departments or shifts.
Your Takeaway
Block off one afternoon this month to review your downtime forms, confirm your emergency contacts, and ask when your backups were last tested. Then run a short tabletop exercise with nursing, operations, and IT.
Want help evaluating monitoring, backups, or HIPAA-focused IT practices for your facility? GCMSP reports 99.98% uptime, 95% of issues resolved in under an hour, and zero HIPAA violations in 2025. The team also provides 24/7 monitoring and bilingual Spanish support. Explore GCMSP’s HIPAA-focused IT services or contact the Chicago-area team to start a practical conversation. Let’s see how your downtime plan stacks up.
Sources
Comments