Discussion reply

Hello class and professor,

Questions

1. I have been working for Ascension since
2. I have never seen such chaos firsthand. When it comes to information systems and information technology. I want to be transparent and honest about the ransomware attack at Ascension. All information systems were shut down, and staff had to revert to pen and paper, like in my old days. Yes, everyone from medical aids to upper-level clinicians was in the same boat. The scene was really like an animal with a headless body wandering around in the dark. In 2024, this brutal cyberattack had a significant impact on the information system, with effects that persist to this day. To elaborate on the most important challenge, the urgent one is that over 5.6 million medical records were breached, and protected health information (PHI) and personally identifiable information (PII) were compromised, making this the third-largest breach of data in 2024 (Alder, 2024).

(2.) The current system we use to import and export PHI before the ransomware attack is still somewhat slow. Ascension is still facing certain dilemmas due to the data breach. I still have to change my password every 3 months, down from 6 months. On the business level, financially, Ascension was hit hard to the tune of over 1.8 billion dollars (Narayan, 2025). The strategy at Ascension is a zero-trust architecture framework. This keeps the network perimeter elusive and narrow. An example is me changing my password more often, and the sites we once would visit, like music apps, we are no longer able to access. User Training is another strategy that trains users to look for suspicious phishing attempts. Ascension’s process is 24/7 monitoring of the security operations center (SOC). Ascension has deployed HL7 FHIR APIs to address interoperability and speed issues as a technology platform, along with cloud-based integration platforms that support data exchange. Ascension’s results have been steady; patient levels are recovering. Even as this happens post-pandemic, it has also affected telemedicine and virtual health technology, and there is a recovery in these centers for patient care. There is a measurable reduction in phishing attacks, proving that the training strategy is working. Lastly, there has been no reported breach through mid-2026, and, besides the 5.6 million notifications sent, they are still eligible to receive credit monitoring for at least 2 years from the date of enrollment.

Alder, S. (2024, December 20). Ascension Ransomware Attack Affects 5.6 Million Patients. Retrieved from THE HIPPA JOURNAL: https://www.hipaajournal.com/ascension-cyberattack...

Narayan, D. (2025, March 18). Ascension Health Ransomware Attack: Impact, Lessons, and How to Strengthen Cybersecurity. Retrieved from vcomply: https://www.v-comply.com/blog/ascensiorn-cyber-att...

please help

Me reply to this discussion post and this one as well

Tyonna Strong

Jun 13 7:28pm

Reply from Tyonna Strong

Currently my organization is having IS challenges integrating EPIC into our workflow. We're actually having issues with several technology integrations. We have taken traditional insurance brokering and introduced an AI to streamline things. There is a lot of compliance, paperwork, client interactions and data management that encompasses successfully brokering and managing insurance benefits. AI / EPIC is supposed to streamline the process and take a lot of the administrative tasks off our hands so we can get back to managing the clients.

The vision was to introduce technology platforms that could remove a lot of the initial client intake, education and policy analysis off our plates. From there integrations with EPIC would be built so that we didn't have to input and store client records in multiple data bases. When we first heard about all of this it was very appealing but up until now none of this has taken off the way it was initially presented. The client intake / education platform still does not analyze policy documents correctly; we've had several failed client demonstrations that were supposed to display all of our technical capabilities. Even all of the EPIC capabilities are not fully functional. Certain payment processes are not live, specific departmental needs still have to be completely built out by Applied, the company that created EPIC.

Our Senior team had all these visions, prepared trainings and created some simulations for us to run through but we were not prepared for the many roadblocks we would encounter after going live. As we run into issues, the tech team jumps on resolving them, but we are forced to continue to use a more basic storage system of record keeping, sometimes inputting the same records into multiple databases while continuing to handle all administrative duties. As a company we have taken a step back to make sure all functions have been properly tested and vetted before making them part of our routine workflow.