BALTIMORE — An Eastern Shore hospital system lost Internet, phone service and access to electronic records last month after construction workers inadvertently struck a sprinkler pipe that damaged an IT area.

TidalHealth’s clinical teams sprang into action, shifting to paper documentation using pre-printed forms, switching to backup communications and setting up an incident command structure across the health system. The Aug. 13 response was the same as it would have been had the 30-medical-site system been hit by a cyberattack.

“Hospitals plan for the loss of our systems regardless of what causes it, and the procedures are the same whether the trigger is a pipe, a power failure or an attack,” a TidalHealth spokesperson told The Baltimore Sun Tuesday, noting that patient care continued. “We train on these procedures.”

TidalHealth’s outage was the first of three technology disruptions to hit hospitals in Maryland and the Washington region in less than a month, putting those emergency plans to a real-world test. A Sept. 1 cyberattack at Luminis Health followed, and a temporary network failure on Monday affected three Johns Hopkins Health System hospitals.

The disruptions underscore how dependent modern hospitals have become on interconnected technology — and how quickly they must be able to operate without it. Electronic systems now touch everything from patient records and prescriptions to laboratory tests, imaging, communications and even some medical devices.

“We seem to be experiencing an increase in cyber events that, at least recently, have been impacting the healthcare system,” said Meghan Treber, vice president of system readiness and chief preparedness officer for University of Maryland Medical System. UMMS was not affected by recent outages but regularly incorporates “downtime exercises” into software and database maintenance.

“That is a regular best practice in the industry,” Treber said, “especially in patient care in an environment like a hospital.”

As of Wednesday, Luminis, which operates Anne Arundel Medical Center in Annapolis and Doctors Community Medical Center in Lanham, said its hospitals remained open, but its phones and MyChart website were down. Luminis was investigating while teams worked to restore affected systems. Patients were directed to a hotline for questions about upcoming appointments or services.

“Luminis Health was victim to a cyber incident by an unauthorized criminal actor,” its website said. “Our priority continues to be providing safe, high-quality care to our patients.”

Beyond electronic health records, clinical care depends on networks that connect pharmacy, laboratory, imaging, patient registration, communications and connected medical devices, said Matthew T. Carr, co-founder and chief technology officer of Atumcell, a cybersecurity and critical infrastructure security firm. Outage procedures can require staff to revert to paper patient records and order forms, manually identify patients and use alternative systems for laboratory tests, imaging, medications and communications, Carr said.

“The challenge is not just storing paper forms,” Carr said. “Staff must know where they are, how to use them, who can declare downtime, and how to reconcile manual records with electronic systems.”

The scenario was dramatized in the most recent season of the show “The Pitt,” when a cyberattack forced the fictional Pittsburgh hospital to abandon its electronic systems and fall back on paper records and manual procedures. Doctors and nurses had to handwrite patient charts and orders, track patients without their usual digital tools and coordinate care while trying to keep a crowded emergency department running.

On Monday afternoon, three hospitals run by Johns Hopkins Medicine were temporarily placed in a “Code Black” status because of technical outages, WUSA9 reported. The status means the emergency department is effectively closed to EMS traffic because of technical outages or other disruptions, such as power failures, fires or floods, according to Maryland’s Emergency Department Advisory System.

The hospitals impacted were Howard County Medical Center in Columbia, Suburban Hospital in Bethesda and Sibley Memorial Hospital in D.C.

Typically, hospitals experiencing outages or other issues alert the Maryland Institute for Emergency Medical Service Systems, which coordinates the state’s emergency medical services system. A healthcare system might request that some or all ambulance transports be diverted, though the emergency departments remain open and treat walk-in patients.

Johns Hopkins Medicine experienced a temporary IT network hardware issue, which impacted some applications, a spokeswoman said Tuesday.

“We have restored full functionality,” Kim Hoppe, a Hopkins spokeswoman, said in a statement. “This was not a cyber-attack. In these situations, JHM has robust emergency preparedness and downtime protocols in place” to continue to operate and offer “safe, high quality care in the event of a network outage, cellular interruption or other emergency event.”

Hospitals typically scale back to the next available backup before reverting to manual systems, said Treber, of UMMS, “but then we always have a backup in case we have no technology at all. Our preparedness is scaled to match the level of impact.”

That could mean reverting to backup records held off premises or bringing a radiologist from an off-site remote site into the hospital, she said.

“But we don’t wait for an incident to figure out what we’re going to do,” she said. “We practice these capabilities well in advance and frequently.”

At TidalHealth, systems restoration began immediately on Aug. 13. The website and the air-handling systems supporting hospital operating rooms were back the same day. Remaining systems came online after overnight repairs, and the full health system returned to normal less than 24 hours after the pipe was struck. The hospital is reviewing the cause of the outage and the response to it to identify where improvements can be made, TidalHealth’s spokesperson said.

But having a plan doesn’t necessarily mean a hospital is prepared for the worst-case scenario.

“That’s not the real test,” said Scott Doerr, founder of cybersecurity advisory firm ForeGuard Advisory Group.

“A written plan and a plan that actually holds up when everything is dark, with no easy path back, are two different things,” Doerr said. “A drill built around that worst case is the only way to find out which one you actually have before a real incident forces the answer.”

--------------

©2026 The Baltimore Sun. Visit at baltimoresun.com. Distributed by Tribune Content Agency, LLC.