On November 4, more than 115 Illinois hospitals and health systems spent a morning rehearsing a day nobody wants to live through: a cyberattack that scrambles communications and takes the electronic medical record offline.
The attack was simulated. The question it leaves behind is a practical one. If your record went dark this afternoon, what would your nurses reach for, and would it be there?
What Illinois hospitals rehearsed
The Illinois Health and Hospital Association (IHA) ran the exercise, titled "Broken Trust: AI Takes Control," as a live, virtual event. Hospital teams responded in real time as the scenario unfolded over the morning.
In the scenario, criminals used artificial intelligence to send fraudulent messages that appeared to come from hospital employees. From there the damage spread. Teams worked through interrupted communications, lost access to electronic medical records and AI-generated changes to connected systems, according to local coverage of one participating hospital.
IHA described it as the largest AI-focused emergency preparedness exercise for hospitals and health systems conducted in Illinois, Becker's Hospital Review reported. A.J. Wilhelmi, IHA's president and CEO, said exercises like this let hospital teams test their response plans and find vulnerabilities before a crisis occurs.
Who took part
More than 115 hospitals and health systems joined, drawn from an association that represents more than 200 hospitals and nearly 40 health systems. IHA opened the exercise to hospitals of every size, from critical access hospitals to those with 400 or more beds.
This was not an IT-only drill. IHA built it for multidisciplinary teams and invited emergency management, information technology, nurses and physicians, operations, security, facilities, environmental services, senior leadership, communications, and risk and legal. A cyber event reaches every one of those desks, and the exercise treated it that way.
Why it matters
When the record is unavailable, patients still need care. Orders, medications, labs and handoffs move to paper right away, and they stay there until systems are restored.
That can take weeks. After a ransomware attack in May 2024, Ascension, with about 140 hospitals, did not restore electronic health record access across its network until June 14. Clinicians told reporters
they improvised with handwritten notes, faxes, sticky notes and spreadsheets, and described delayed lab results and medication near-misses.
Accreditors now expect hospitals to plan for exactly this. The Joint Commission's Sentinel Event Alert 67 says organizations "should be prepared to have life- and safety-critical technology offline for four weeks or longer." It also calls for a downtime planning committee, current downtime procedures and regular practice of the manual process.
An exercise like IHA's ends with a list of gaps. Many of them are physical ones:
- Is there a stocked downtime kit on every unit, or one for the whole building?
- Does every nurse on every shift know where it is?
- Are there enough charts for a full census, for more than one day?
- Is there a place at the point of care to write, file and find a paper chart?
Those questions are far easier to answer on a quiet Tuesday than in the first hour of an outage.
Where Carstens comes in
Carstens has been building the physical side of the patient record since long before hospitals went electronic. Founded in 1886, we moved into patient charting in the mid-1900s and never left it. Today we are a family-owned, certified woman-owned Chicago manufacturer supplying more than 30,000 healthcare facilities across the U.S. and Canada with over 2,000 American-made products.
That history is why downtime readiness is home ground for us. When the screens go dark, the work falls back on the tools we have made for generations, and we know how units use them:
- Paper Charting Toolkits: Ready-to-stage sets of chart binders or privacy clipboards, built for downtime procedures and patient surges. Order them standard, or custom-imprinted for your units.
- Custom binders, dividers and labels: Tabbed and imprinted to match your own downtime packet, so staff find the right section without thinking.
- Chart racks: Open or locking, so paper charts have a secure, known home at the nurses' station.
- CarePod and wall-mounted workstations: A charting surface at the point of care that works for a screen today and a paper chart during an outage.
We manufacture and imprint in our own plant, so a kit can be sized to your census and labeled for your units instead of pulled together from a supply closet at the worst possible moment.
Close the gaps before the next drill
If your team took part on November 4, your after-action list is fresh. If it did not, the scenario is worth borrowing. Either way, we can help with the part of downtime readiness you can hold in your hands.
- Book a downtime readiness consultation. Tell us about your units, your census and your downtime plan. We will recommend what to stage and where, and quote it.
- Order downtime materials. Shop Paper Charting Toolkits on carstens.com, or ask us for a custom set.
Call 1.800.782.1524 or email carstens@carstens.com. The best time to stock a downtime kit is before anyone needs it.
