Health Care Coalition Provides Crucial Support to Texas Hospitals During Simultaneous Cyber Incident and Inclement Weather
Rio Grande Valley, Texas
March 20, 2025
Quick Look
Background
On March 20, one of the two Level 1 trauma centers in Texas’ Rio Grande Valley experienced a system-wide cyber incident. The hospital lost access to critical technology and records, with potential impacts to patient care. During the cyber incident response, the region’s other Level 1 trauma center was impacted by severe weather.
Response
Through exercises required by ASPR’s Hospital Preparedness Program, CBRAC knew how to efficiently respond. The health care coalition worked with their wide network of members to quickly mobilize previously purchased redundant communications systems, support laboratory and pharmacy services, and support patient movement across a large hospital system. CBRAC kept patient needs at the forefront as they responded to the evolving incident.
Impact
CBRAC’s actions maintained patient safety, coordinated patient movement, and minimized disruptions to care for the Level 1 trauma center and its network of facilities throughout the cyber incident.
On March 20 at 9:34 AM, Bernardino Palacios answered an unexpected phone call. Mr. Palacios, the Coastal Bend Regional Advisory Council (CBRAC) Program Director, was out of state when an emergency manager for the largest hospital system in CBRAC’s jurisdiction called to report a significant computer network intrusion. Mr. Palacios and his team immediately stepped in to help, mobilizing the CBRAC network and resources to respond swiftly and minimize disruptions to patient care.
CBRAC is a health care coalition supported by ASPR’s Hospital Preparedness Program, which provides funding and guidance to hundreds of health care coalitions across the nation. CBRAC oversees health care entities across three regions in Texas, including the Rio Grande Valley where the cyber incident took place. With support from the coalition, CBRAC members prepare for various emergency scenarios, including downtime in the event of a cyber incident. Extended downtime can impact technology and communications systems, access to patient information, and pharmacy and laboratory services, all of which can compromise patient safety.
To prepare for such scenarios, CBRAC conducts annual emergency preparedness and response exercises, drills, and risk analyses as required by ASPR’s Hospital Preparedness Program. This includes the Medical Response and Surge Exercise, a required annual functional exercise that tests a coalition’s ability to care for an increased volume of patients beyond normal capacity. CBRAC members also conduct bi-annual redundant communications drills on off-grid communication systems. These drills promote clear emergency operations and incident command structures for everyone responding to incidents.
Through these preparedness activities, health care entities under CBRAC’s jurisdiction had already identified and addressed gaps in availability of internet, handheld radios, and satellite systems. When the cyber incident occurred, the impacted hospital system was ready to respond.
The cyber incident began the morning of March 20 at one of only two Level 1 trauma centers in the region. Level 1 trauma centers are health care facilities that provide care for critical patients and are equipped to handle complex traumas. By the end of the first day, the cyber incident had impacted the entire Level 1 trauma center and over 120 clinics, hospitals, and campuses across multiple counties. Impacted entities lost access to crucial systems for patient tracking, charting, and laboratory and pharmacy services.
For the first 18 hours, CBRAC worked with its local members, as well as state and regional public health organizations, to get hospitals and providers back online as quickly as possible. CBRAC had previously used Hospital Preparedness Program funds to purchase 12 satellite devices for use when traditional communications are down. Just 14 minutes after Mr. Palacios received the call for help, CBRAC’s team prepared the satellites for pick-up. In less than two hours, the satellites were online, providing immediate, reliable internet and connectivity to the 120 impacted entities within the hospital system. With these backup communications devices, the hospital system could continue to provide crucial patient care.
For the remainder of the incident, CBRAC worked with hospital information technology and relied on its trusted partner network and redundant communication systems to maintain patient safety and continuity of care. For example, when pharmacy systems were down, CBRAC collaborated with the Drug Enforcement Administration for waivers to expedite controlled medication approval to patients in need. CBRAC also worked with impacted laboratory service providers to bolster capabilities and shift services to alternate locations.
Although pharmacy and laboratory services weren’t restored until March 29, CBRAC coordinated alternate avenues of care so that patient care remained uninterrupted. Additionally, the coalition relied on its vast member network across health care, emergency medical services (EMS), and other providers to coordinate the transfer of critical patients from the facilities under attack to multiple receiving health care facilities. As a result, all patient transfers were smooth and efficient.
On March 27, with ongoing cyber incident recovery, the region experienced severe weather that impacted the only other Level 1 trauma center. Suddenly, CBRAC was coordinating a multi-threat response. The compounding effects of the cyber incident and the inclement weather created technological and environmental accessibility issues, jeopardizing patient safety. Fortunately, CBRAC was prepared. With the satellite communications redundancy already in place, CBRAC led a continuous response in which no additional patients needed to be transferred out of the region. On April 8, 19 days after the cyber incident began, CBRAC turned off the last satellite and facility operations returned to normal.
Swift action, existing resources and plans, and effective communication enabled this successful response. The well-established partnership and existing trust between CBRAC and local health care entities strengthened response efforts and minimized disruptions to patient care.
“Health care coalitions serve a crucial role for health care organizations. Having trusted relationships established before the cyberattack made the facility willing to share information and trust that sensitive information wouldn’t be shared, which made the response smoother.”
CBRAC Division Director of Preparedness and Response
Cyber incidents threaten sensitive information, risk patient lives, and have the potential to spread rapidly. Knowing what to do when a cyber incident occurs, including who to trust and who to call for help, is crucial. Within minutes of this cyber incident, the Texas hospital system called CBRAC and revisited lessons learned from Hospital Preparedness Program-required activities like the Medical Response and Surge Exercise. With a trusted network, broad connections, and Hospital Preparedness Program-funded planning in place, CBRAC stepped in to support a large hospital system while minimizing disruptions to patient care.
To learn more about the Hospital Preparedness Program’s requirement for health care coalitions to conduct at least one Medical Response and Surge Exercise every year, access the Exercise and Improve section (page 36) of the Hospital Preparedness Program Fiscal Year 2024-2028 Notice of Funding Opportunity.