Houston's St. Luke's cyberattack is leaving patients vulnerable, nurse tells FOX 26

HOUSTON - Nearly two weeks after a cyberattack against Houston's St. Luke's health system, a vital patient-record system remains shut down.

This week CommonSpirit Health, the parent of St. Luke's, acknowledged that all of their facilities across 22 states were hit by a ransomware attack. While the hospitals are working to fix the problem, there are concerns among some caregivers about the danger to patients.

RELATED: Major US airport websites go offline in apparent cyberattack

"Mary" is a registered nurse at St. Luke's who wishes to remain anonymous out of concern for her job. She's worried about the level of care she and her colleagues are able to provide.

"It's horrible," she says "We're in survival mode and trying to do our best to deliver good patient care."

The ransomware attack has triggered an 'internal disaster' declaration which allows emergency traffic to be diverted away from St. Luke's. "Mary" says as the hospitals continue to see patients, vital digital records have given way to paper records that are unfamiliar, slow, and sometimes incomplete.

RELATED: Juice Jacking: How cyber thieves hack cell phones through public charging stations

"We're just trying to do the best that we can, but without having the records, it just makes it very difficult to do that, and it's the patient that suffers," said Mary.

CommonSpirit Health said in a statement, in part, "Patient care remains our utmost priority, and we apologize for any inconvenience," and, "We are taking steps to mitigate the disruption and maintain continuity of care."

University of Houston cybersecurity expert Chris Bronk says the only surprise about the ransomware attack is that it hit a hospital, which is generally left untouched by cyber-crooks.

"Information failures in a hospital environment can lead to very negative clinical outcomes," he says.

However, Bronk states the type of attack is a constant threat that costs enormous amounts of time and money to overcome, but attackers only need to get lucky once.

SUGGESTED: 2 caretakers arrested, accused of beating up elderly man at Texas City nursing home

"Every system that the attacker touched, they encrypted, they scrambled, they locked up the data, and if you pay the ransom, you get a key and it unlocks your data," Bronk explains, "The problem is sometimes, with these attacks, you pay the ransom and you don't get a key."

CommonSpirit Health has not indicated whether it has paid any ransom or if they're working to reconstitute its records without giving in to the crooks.

RELATED:  Houston nurse creates app to help nurses provide virtual wound care

Meantime, "Mary" says there have been some instances where patients have been "quietly" encouraged to seek treatment elsewhere to avoid a slowdown in care. It's a problem that may repeat itself.

Chris Bronk states attacks like these, whether from someone sitting in their basement or a state actor, will only continue unless there's some remarkable technological advance that stops them in their tracks.