HSE staff asked to turn on computers but it will 'take weeks to get back online'

The HSE is continuing to grapple with the fallout from the May 14 cyberattack. iStock

HSE staff have been asked to turn on their computers so that the decryption key sent by the cyberattackers can be downloaded across 80,000 devices, but have been warned the devices cannot yet be used.

The advice to staff came as the HSE's chief information officer said it will "take weeks to get back online".

Fran Thompson said restoring access to data has to be done in a safe and careful manner and "we anticipate this will take a number of weeks in total”. 

“We are making progress, it is tough, but we are getting there,” said Mr Thompson in a video message for staff.

As the HSE continues to grapple with the fallout from the May 14 cyberattack, chief operations officer Anne O’Connor warned of widespread cancellations in the weeks ahead as only some IT systems have been restored.

“We expect many services to have cancellations next week; we know that it is going to be into next week and possibly weeks after that before some of these systems are restored,” she told RTÉ on Wednesday.

Capacity in hospital laboratories where tests and blood samples are processed is at 20% of normal levels because of the cyberhack, she said.

We know there are a lot of samples which haven’t been tested, and that is obviously a concern for us.”  

This also affects GPs who cannot get tests for their patients.

Outpatient services continue to be heavily hit. Ms O'Connor said, “we are probably only about 40% working", with South and West, where there are fewer voluntary hospitals, hardest hit.

Some cancer patients in Galway are being forced to travel to Dublin for treatment, but Cork University Hospital radiotherapy is continuing in the UPMC Bon Secours private centre.

The HSE has called on people to only use hospital emergency departments for serious health issues.

“Emergency departments remain very busy with high numbers of patient attendances in some hospitals now exceeding 2019 levels,” said a spokeswoman. 

She said they now expect that some older patient records can be recovered, but said, “we believe we will have lost some details of recent clinical activity”. 

The vaccination rollout programme is continuing unaffected, as it operates on a separate IT system. But daily numbers cannot be published and GPs cannot file the numbers they are vaccinating.

UL Hospitals said that, from Thursday, pregnant women can book vaccinations through a new number: 087 3593568.

“We don’t have any concrete evidence that anything has been posted online,” said Minister for Justice and Employment Affairs Heather Humphreys. 

However, she warned that all patients should continue to be alert for scams as the criminal group behind the cyberattack may release HSE data online.

Joanne O’Connor, co-founder of Cyber Women Ireland, said patients can use the haveibeenpwned.com website to check if their emails appear in data breaches.

This data will live on and will be available indefinitely. 

"Like most forms of internet content, once it is out there we have lost or handed over control of it, unfortunately,” she said. 

New passwords should have 12 to 16 characters and not contain characters from old passwords, she said.

Hospitals typically work with a range of small suppliers and businesses. Ms O’Connor said cybersecurity training should be given to all employees.

She said free training which “covers the basics” is available from the American National Institute for Cybereducation and Technology and through Google.