This Was Never About Data. It’s About Patients.

You know how this story goes. A hospital gets hit, and suddenly ambulances are sent elsewhere. Surgeries are pushed back. Staff go back to paper charts and handwritten orders. Lab results take hours instead of minutes. Every one of those delays lands on a real person in a bed.

When a critical partner goes down

In February 2024, that story went national. On February 12, attackers typed a stolen password into a remote login page at Change Healthcare. Most people had never heard of Change. But it sits quietly in the middle of American healthcare, handling billing, payments, and pharmacy claims. That login page had no second check. One password was enough.³

For nine days, the attackers moved around inside. Then they set off the ransomware.

Pharmacies struggled to fill prescriptions. Doctors' offices and hospitals went weeks without the payments they live on. A month in, the American Hospital Association heard from nearly 1,000 hospitals. Seventy-four percent said the attack was directly affecting patient care. Ninety-four percent said it was hurting them financially. And among hospitals with cash flow problems, more than a third said over half of their revenue was affected.⁴

The scale of the disruption

The numbers kept climbing for more than a year. In April 2024, UnitedHealth, Change's parent company, estimated the attack would cost it up to $1.6 billion that year, and it had already advanced billions of dollars to providers to keep them going.⁵ By October 2024, the estimate had grown to $2.87 billion.⁶ The count of people whose data was caught up in it grew too: an estimated 190 million in January 2025,⁷ and a final count of 192.7 million in July 2025.⁸ That's more than half the country.

That's what happens when a critical partner goes down. Change wasn't a hospital. Most patients had never heard its name. But because it sat in the middle of claims and payments, its outage became everyone's outage, at providers and pharmacies that were never attacked themselves.

Notice something about Colonial and Change Healthcare. Neither attack started with a camera or some brilliant piece of code. Both started with one door that had only one lock. Two stories, one lesson. Attackers don't need the front door. They need any door nobody is guarding closely. And in most hospitals, the least guarded doors are the devices nobody has even put on a list.

What failure means for patient care

It's easy to think of cameras and building systems as "not clinical," and so not urgent. But think about what happens when they fail or get taken over. If door access goes down, staff can't move freely between units, or the wrong people can get in. If the pharmacy refrigerator stops reporting its temperature, medicines can spoil without anyone knowing. If the heating and cooling system is tampered with, operating rooms and isolation rooms lose the conditions they depend on. If nurse call stops working, a patient presses a button and nobody comes.

And as we saw in the last chapter, a camera that nobody watches can be the first step toward the systems that hold patient records and run clinical care.

This changes how you should talk about the problem. When you go to your board or your clinical leaders, don't lead with technical terms. Lead with patients. Ask the question this way: if this device were taken over tonight, what would happen to the people in our beds tomorrow morning?

That question gets attention, and it should. It also helps you decide what to fix first, which we'll come back to in Chapter 6.

Revisit the downtime plan

It's also worth looking at your downtime plans with fresh eyes. Most hospitals have careful plans for when the electronic health record goes down. Far fewer have thought through what happens when the building systems, door access, or cameras go down at the same time. Bring your facilities and clinical engineering teams into that conversation. They know these systems better than anyone, and they'll be your best partners in protecting them.

Questions for your team

Do your downtime plans cover building and physical security systems, not only clinical software? Could you explain the risk of an unprotected camera in terms of patient safety? Are facilities and clinical engineering part of your security planning today?