Article
What happened
The University of Mississippi Medical Center discovered a ransomware attack early Thursday, Feb. 19. Many of its IT systems went down, including its Epic electronic health record, and the system took other networks offline as a precaution. UMMC, which operates five hospitals and more than 30 clinics, closed all its clinics statewide on Thursday and again on Friday. Outpatient and ambulatory surgeries were postponed and elective procedures delayed.
Hospitals and emergency departments stayed open. UMMC said it is working with federal authorities and outside experts, and the FBI said its priority is helping restore systems so patient care can resume. The attackers have contacted the university, but their demands have not been disclosed. Officials warned the disruption could last for days and are investigating whether patient information was accessed.
The ambulatory gap
Most hospital downtime procedures focus on inpatient units and the emergency department, where paper documentation and manual workflows have been practiced for years. Clinics are often a different story. Scheduling, check-in, prescribing, referrals, results and billing in ambulatory settings are deeply tied to the EHR and patient portal, and many clinic teams have little experience working without them.
That gap has real costs. Closing clinics protects safety in the short term, but it means canceled visits, delayed treatments and lost revenue for every day systems stay down. For an academic system, it can also disrupt specialty care that patients cannot easily get elsewhere.
Questions for leaders this week
- Can our clinics operate on paper? Ask whether downtime kits, read-only record access and manual scheduling exist for ambulatory sites, not just hospitals.
- Which visits can never be canceled? Identify time-sensitive services, such as infusion, dialysis and prenatal care, and plan how to keep them running.
- How will patients be told? If phones and portals are down, have alternate channels ready, including local media and a static website.
- How long can we afford? Model the revenue and cash effect of a one-week and a three-week outage, and check whether cyber insurance covers business interruption at that scale.
- When did we last test it? Tabletop exercises should include an ambulatory-only scenario and a full network shutdown.
The board view
Ransomware has moved from an IT risk to an operational continuity risk. Boards should expect management to report on recovery time objectives for core clinical systems and on how the ambulatory network would function during an extended outage.
Archive entry for Feb 20, 2026, added Nov. 11, 2026.