ANDREW LIMBONG, HOST:
You probably heard of all the flights that were canceled because of a software update last week, specifically one distributed by cybersecurity firm CrowdStrike. That meltdown also had a huge impact on the operation of hospitals all over the world. As NPR's Selena Simmons-Duffin reports, the impact went far beyond having to switch to paper and pencil for patient charts.
SELENA SIMMONS-DUFFIN, BYLINE: In the labor and delivery department at Kaiser Permanente San Jose Medical Center in California on Thursday, a baby had just been born around 9:00 at night. Registered nurse Kim Brown was coming to the end of her shift.
KIM BROWN: After what's called the golden hour, where baby and Mom get to bond and do their skin-to-skin time, we have a set of normal newborn medications that we give all of our babies.
SIMMONS-DUFFIN: Just as that new baby was getting these medications, like antibiotic eye ointment...
BROWN: The computer just - boop (ph) - shut off.
SIMMONS-DUFFIN: And it wouldn't restart. It soon became clear it wasn't just one computer. It was all of them.
BROWN: They were kind of here and there, coming on and off, and then everything just completely went down.
SIMMONS-DUFFIN: The medical records system went dark. So did the central system for monitoring the baby's vital signs. So they assigned a nurse to each baby. And the security system for making sure no babies were taken out of the unit also went down, so security staff had to come sit by the door to safeguard the babies.
BROWN: It was kind of surreal, and, you know, of course, rumors started flying. Is this a cyberattack? What's going on?
SIMMONS-DUFFIN: What was going on was part of a worldwide glitch, affecting everything from airports to local government to banking. All these systems were using CrowdStrike, software designed to protect data and block cybersecurity threats.
JOSHUA GLANDORF: So this was a software update for CrowdStrike that didn't play well with Microsoft operating systems.
SIMMONS-DUFFIN: Joshua Glandorf, chief information officer at UC San Diego Health, explains any computer running both Windows and CrowdStrike became basically unusable. In hospitals, some surveillance cameras went down, and clinicians weren't able to use their ID badges to unlock secure areas. Nurse Kim Brown says she was astounded when she came to understand how many health care systems across the world were affected.
BROWN: 911 systems are down. Like, it's just absolute madness that one incorrect update to a system could literally bring the planet to its knees technologically. It definitely warrants further investigation and hopefully a way of preventing this from happening again 'cause holy cow.
SIMMONS-DUFFIN: Dr. Mitesh Rao says there's a big reason why health care was so hard hit by this fiasco.
MITESH RAO: Everything runs on Windows in health care.
SIMMONS-DUFFIN: Rao is an emergency physician at Stanford and runs a data infrastructure company called OMNY Health.
RAO: Anytime you have one system driving so much, there's a high risk of impact from failure.
SIMMONS-DUFFIN: Rao says even though the CrowdStrike issue affected all sorts of industries, the stakes in health care are high.
RAO: There are patients coming in through the emergency department every second who need immediate care. There's car accidents. There's heart attacks. There are people giving birth, all sorts of stuff just happening constantly.
SIMMONS-DUFFIN: He says hospitals and clinicians train for problems and setbacks. They can pivot and do whatever's needed to keep patients safe. Kim Brown says that's what happened in her labor and delivery unit at Kaiser San Jose.
BROWN: We do have a downtime protocol in place that they implemented rather quickly.
SIMMONS-DUFFIN: She says they can even fax if they need to. But still, it's more complicated and stressful. She was relieved to learn before her next shift everything was back up and running. Selena Simmons-Duffin, NPR News.
(SOUNDBITE OF BROWN BIRD'S "SHADRACH") Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
