JUNEAU — More than two weeks after Alaska’s Department of Health and Social Services suffered a cyberattack, the agency has not fully recovered and Alaskans are still seeing effects.
Background checks for hospital workers — everyone from front-line doctors to cleaning staff — are now being processed on paper instead of online.
“It’s definitely a real problem at this point, and the impact is real,” said Jared Kosin, director of the Alaska State Hospital and Nursing Home Association.
Birth, marriage and death certificates are slow to arrive because the state’s vital statistics system is offline. The websites of the department’s various divisions are also offline.
Instead of distributing health grants through a centralized system, the state is working with recipients in one-on-one conversations.
“It’s just taking more time,” said Chelsea Ward-Waller, speaking on behalf of the Anchorage Health Department.
The Department of Health and Social Services is the state’s biggest agency, overseeing the state’s vast Medicaid program, the Pioneer Homes, vital statistics, public assistance and the Office of Children’s Services, among other things.
But when it comes to the scale of last month’s cyberattack, the agency hasn’t provided detailed information. It issued a statement May 18 with a list of services that had been taken offline. Spokesman Clinton Bennett declined to provide a list of servers that had been disconnected, citing security concerns.
He also said the source of the attack and the method used to attack the state remain under investigation.
Renee Gayhart, director of the division that handles Medicaid and other health care services, said that when it comes to her branch, the cyberattack had its biggest effect on background checks for new health care workers.
Alaska requires all health care employees — from janitorial staff to front-line doctors — to undergo a background check before they can start work. The cyberattack forced the state to disconnect the system used for those checks, and the process is now functioning on paper forms.
Kosin said hospitals were alarmed by a message saying it could take as long as two weeks to process checks under the new system. The normal timeline is two to five workdays.
[Unidentified cyberattackers force Alaska Court System to disconnect from internet]
Monique Martin, director of government relations at Alaska Regional Hospital, said delays are a problem because more Alaskans are seeking medical procedures they put off during the COVID-19 pandemic. Hospital staffers are going on vacation, requiring Alaska Regional to hire temporary workers, and those people need clearance.
But Gayhart said the 15-day warning is just a precaution: With staff working overtime and with some employees shifted over to help, most significant delays were in cases when background checks were underway when the cyberattack took place.
“We really have not fallen behind. We’re well within where we’ve been, even with the process down,” she said.
Dallas Hargrave, the human resources manager at Bartlett Regional Hospital in Juneau, said it’s too early to tell whether there will be delays.
“We didn’t have any delays for our cohort of new employees who started on June 1. Some of our next cohort of new employees, scheduled to start on June 14, are going through the revised background check process, so we will need to watch to see if they get processed in time,” he said.
Martin said that at her hospital, it’s sometimes come right down to the wire to see if potential employees will get their paperwork in time for orientation.
“Having them able to start right away is really important. It’s been a little bit intense, for sure, running right down to the finish,” she said.
At Providence Hospital in Anchorage, spokeswoman Katie Marquette said the cyberattack initially “created considerable delay to our background check and new caregiver onboarding processes,” but in the past week, new temporary procedures have reduced the delay.
Background checks are required for child care licenses in the Municipality of Anchorage, but Ward-Waller said the new system seems to be working.
“It was problematic right when it happened because folks were hiring with summer camps,” she said, but those issues seem to have been ironed out.
This is actually the second time in a month that the state has had to revise its background check procedure because of a cyberattack. On May 1, the Alaska Court System was attacked and had to shut down most online operations, including CourtView, the public database that shows Alaskans’ legal history.
It isn’t clear whether the two attacks are part of a broader wave of ransomware attacks afflicting companies and governmental institutions nationwide this year. Those attacks have shut down a major East Coast gasoline pipeline, crippled Illinois’ legal system and closed huge meat-processing plants.
At DHSS, the agency has limited access to its vital statistics database, leading to longer wait times for birth certificates, death certificates, and marriage certificates.
Those things can’t be processed in Anchorage anymore; they’re all being done in Juneau.
“Be assured that we are doing everything we can to fully resume services and we hope to serve you at normal capacity very soon,” the department said in a statement explaining the delay.
It wasn’t immediately clear how long the delays are. Marquette said that at Providence, parents of newborns traditionally receive temporary proof of birth certificates until an official document arrives. That process, in place before the cyberattack, should provide some surety, she said.
Martin, at Alaska Regional, said the cyberattacks against the court system and DHSS — as well as those Outside — have prompted her to ask questions about what comes next.
“I think one of the things we’re trying to learn is, what should we be taking away from this process?” she said. “It’s like, what do we need to be prepared for in this new age of cyberattacks that can take down whole systems?”