Health workers have expressed alarm at the devastating impact a cyberattack on South Africa’s National Health Laboratory Service (NHLS) is having on patient treatment.
Frustrated doctors at two large state hospitals in Johannesburg said they were having to postpone critical medical procedures. Apart from the increased medical risk this entails, it also means longer stays in hospital for patients, leading to a severe shortage of beds.
The NHLS is unable to upload test results onto the online system owing to the cyber hack on June 22. Medical workers say test results that previously could be obtained within several hours were now taking up to four days to be retrieved, because staff were having to fetch them manually.
A senior doctor at Chris Hani Baragwanath Hospital said the hack had led to severe consequences for patients.
“This is one of the most serious threats to patient care we have had in a long time. When we have load-shedding or water shortages, [the problem is resolved] in a day or two. What is happening here has been taking place for almost two weeks. The impact on patients is significant.
“We cannot make decisions about critically ill patients and patients with trauma. The doctor has to go to the lab and wait. In a hospital like Bara, you find that there are so many doctors waiting for results that it is chaos.
“Normally, you can get blood results in two to four hours, but now ... it is two to four days,” the doctor said.
Another doctor said: “We try to do an assessment of our patients so that at least they can be stabilised while we are waiting for the test results. We can give them antibiotics to help deal with infection while we wait for the results. It is really a difficult situation.”
The Progressive Health Forum (PHF) said the extended time period during which laboratory services had been unavailable meant millions of blood and other pathology tests had not been able to be processed, leaving doctors unable to access vital information and having to rely on their own clinical judgment to make decisions ordinarily guided by laboratory readings.
The PHF is a national network of academics, government workers, community activists and scientists now mobilising to help end the NHLS crisis.
“Now doctors are suddenly blind,” said the forum’s convener, Dr Aslam Dasoo. “So if, for example, a woman with pre-eclampsia needs an emergency Caesarean so she doesn’t go into renal failure, it becomes a matter of life and death, because the illness eats up the platelets and her blood cannot clot. She could bleed to death unless you are able to crossmatch the blood and order platelets for her. And while you wait for the information, the baby could become deprived of oxygen,” he said.
“I have had obstetricians crying to me because they have patients with foetal distress and they need to act while they are blinded. Yes, they can still make a good decision, but it will never be as precise as it could be, and by the time they act, the foetus could have cerebral palsy or neuroencephalopathy.”
He said the crisis had not been well managed or prioritised with extra resources. Interns and doctors had been turned into runners in many of the big government hospitals, where some of them were covering 30-40km on very long shifts. For example, one intern at Chris Hani Baragwanath Hospital racked up 34km during a single 12-hour shift.
Authentication solutions specialists Swivel Secure said high demand for patient information and often outdated systems were among the reasons why health care was now the biggest target for online attacks.
South Africa’s government departments and entities were sitting ducks for cyberattacks because of years of underinvestment in security systems, outdated technology and incompetent IT security staff.
The NHLS said this week it was working on fixing its online system, and that it would be back online by mid-July.
At Charlotte Maxeke Johannesburg Academic Hospital in Parktown, a doctor in the radiology department said: “It is very difficult to work without blood-test results for cancer patients. For the cancer patients who are already on treatment, it is easier for us to postpone their treatment by three days when we know we are going to get the results. But for those who are just starting treatment, we have to get the results. We postpone their treatment by just 48 hours. We can’t do the treatment unless we’ve done the blood tests — that is just how it works,” the doctor said.
A nurse at Eshowe Hospital in KwaZulu-Natal said the delays had increased workloads at the facility.
Patients were having to spend more time in the hospital, which increased the burden on health workers. Furthermore, as ever more patients waited for results, they ran out of beds for new ones.
“There are patients on dialysis you need to treat. You have patients who are diabetic. You need samples when treating those patients, otherwise you are running the risk of losing them,” said the nurse, who did not want to be named.
“Under normal circumstances, you will pick up that a patient is anaemic. For you to even order any blood transfusion, you need to know the haemoglobin [HB] of that patient. How you detect the HB is through the lab. How will you give a blood transfusion without the lab results?”
National health spokesperson Foster Mohale conceded that the cyberattack had negatively affected the turnaround times of laboratory test results, but said all urgent results were being communicated telephonically to requesting clinicians.
“However, efforts are being made to prioritise severe cases to mitigate the impact and prevent avoidable deaths.”
He said there had been no reports of loss of life directly linked to the hack.
“Critical tests such as blood tests for sodium, potassium, glucose and other vital chemicals, as well as urgent tests for infections and other serious conditions, have been prioritised to ensure essential health services continue,” Mohale said.
“Health facilities have point-of-care equipment such as i-STAT machines that can provide health-care professionals with diagnostic information [that is] key for patient care.”
In a statement on Wednesday, the NHLS said that all laboratories were functioning, but providing results remained a challenge.
“Under normal circumstances, the laboratory reports are automatically generated and sent to clinicians or made available on WebView, but this incident has disabled that functionality.
“However, all urgent results are communicated telephonically to requesting clinicians. In addition, the NHLS has distributed a critical-test list to all health facilities,” said NHLS spokesperson Mzi Mgcukumana. Critical tests are done where doctors have to make urgent decisions about gravely ill or seriously injured patients.
Gcukumana said a case had been opened with the police.
Prof Rennie Naidoo from the Wits School of Business Sciences said there was limited public information about cyberattacks, and scholars tended to rely on media reports in this regard. However, there were indications South Africa had seen a significant increase in cyber breaches in recent years.
Additional reporting by Shonisani Tshikalange
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.