Dr. Cliff A. Megerian, MD, FACS, University Hospitals CEO

On Thursday, someone in the security operation at University Hospitals in Cleveland saw activity on the servers that did not belong there. By Friday, patients opening MyChart were reading an apology where their results should have been. In between, a large health system had chosen to pull its own network from the internet, knowing the cost in cancelled clinics and deferred procedures, and without yet knowing what it was facing.

That sequence deserves more credit than it will probably receive. The hospital has not said whether this was a cyberattack, and the investigation continues. What is already visible is a decision made early, under uncertainty, with patient safety named as the governing priority. Rescheduling elective work is expensive and reputationally awkward. Doing so before the threat is fully understood is the harder discipline, and University Hospitals appears to have exercised it.

The relevance to Britain is direct. The 2024 ransomware attack on Synnovis, the pathology provider serving several London trusts, showed how a single supplier failure can ripple through an entire health economy. Blood testing and transfusion services were constrained, thousands of appointments and operations were postponed, and the harm later acknowledged by the affected trusts included a patient death to which delayed results contributed. The lesson drawn at the time was about supply chains. A second lesson sits beneath it: speed of containment determines how long the disruption lasts.

Here the UK context is less forgiving than the American one. NHS trusts operate under intense scrutiny of waiting list performance, and elective recovery remains a central test of the government's credibility on health. A chief executive weighing whether to take systems offline is not making a purely technical judgement. Every cancelled list is a number that will be reported upward. Capital for digital resilience competes with the backlog for the same constrained budgets, and ageing infrastructure in many trusts makes clean isolation harder than it sounds. In such an environment, the pull towards waiting for certainty is strong, and waiting is precisely what attackers rely on.

Clear communication was as important as the technical response. University Hospitals kept patients informed, explaining that services were down, appointments were being rescheduled, and queries should be directed to the relevant provider’s office. A follow-up statement admitted that disruption would run into the following week. That candour is a form of trust management. Britain is steadily making the NHS App the front door to care, and the public will increasingly experience any outage as a failure of that door. Trusts and national bodies need a rehearsed script for the day it closes, including the admission that recovery will take days.

The practical implications fall on several desks. NHS boards should test downtime procedures as seriously as they test financial controls, including paper fallbacks and the manual flow of pathology and imaging requests. Procurement teams should write incident response obligations and reporting timelines into supplier contracts, since a trust's exposure now extends well beyond its own firewall. Health-tech and life sciences firms selling into the NHS should expect those clauses and should be ready to demonstrate their own isolation capability. Policymakers revisiting network and information security rules should ask whether regulators will treat a precautionary shutdown as sound judgement, because a regime that punishes the resulting delays will teach leaders to hesitate.

None of this requires a verdict on what happened in Cleveland, which may take weeks to emerge. The cause could prove minor or serious. Either way, the choice made on Thursday was defensible in advance, and that is the standard worth adopting. The NHS will face its own unusual activity, probably sooner than anyone would like. When it does, leaders will need to know that disconnecting early will be supported by the system around them, and that the cost of a postponed list is smaller than the cost of an unchecked intrusion.

‍