The global IT outage of 2024: 5 lessons for healthcare

What happened

A defective update to the security software from supplier CrowdStrike caused the notorious blue screen (Blue Screen of Death) on countless Windows computers. Around the world, sectors such as aviation, banking, the media and healthcare were thrown into disarray.

In the Netherlands, the hospitals affected included Treant (Emmen, Hoogeveen, Stadskanaal), Nij Smellinghe (Drachten) and Slingeland (Doetinchem). Operations were postponed and some sites temporarily stopped admitting new patients. This was emphatically not a cyberattack but a fault in an update; recovery required manual work on each system.

Lesson 1: Care carries on, even on paper

When the client record, the medication module or the scheduling system goes down, care still has to continue. That calls for tried-and-tested emergency procedures: working with paper administration lists, double-checking high-risk medication and clear agreements about who does what.

Practise these emergency procedures regularly. Experience shows that staff who rarely use them lose precious time during a real outage. A short, clear instruction card for each department helps enormously.

Lesson 2: Keep staff informed, even outside the systems

When the usual systems are down, you cannot reach staff through those systems. Think in advance about alternative routes.

• A central, brief instruction: what is not working, which emergency procedure applies, where to find the latest status.
• Reachability via alternative channels (telephone, text message, a private page).
• Clarity about priorities: which care and which departments take precedence.
• Radiating calm: staff who know what to do also keep patients and families calm.

Lesson 3: Reassure families and patients

Postponed operations and closed doors cause unease among patients and families. Be proactive here: explain what is going on, what it means for their appointment and when there will be more news.

An honest, human message prevents unnecessary phone calls and mistrust. Make sure the information on the website, at the reception desk and on the telephone is consistent.

Lesson 4: Know your dependence on suppliers

The outage did not come from within but from an external software supplier. That shows how dependent modern healthcare is on the digital chain: an ECD supplier, a software vendor, a cloud service.

Map out these dependencies (which system depends on which supplier) and set out what you will do if a supplier fails. Make agreements about recovery times and keep a fallback option in reserve.

Lesson 5: Know your standards and reporting obligations

Healthcare institutions operate under NEN 7510 (information security) and the GDPR. If patient safety is at risk, this may constitute a serious incident that you must report within three working days to the Inspectie Gezondheidszorg en Jeugd (IGJ) under the Wkkgz. If personal data is involved, the data breach notification obligation (72 hours) to the Autoriteit Persoonsgegevens applies.

Healthcare providers also fall increasingly under the Cybersecurity Act (NIS2), with an obligation to report significant incidents. During the crisis, record which reports were made, when and to whom.

How CrisisRadar helps

CrisisRadar brings the board, care management, IT and communications together in a shared crisis picture. You record facts with their source, share clear emergency instructions with staff, draft a reassuring message for families and safeguard the continuity of care. Reporting-obligation timers keep track of the deadlines for the IGJ and the Autoriteit Persoonsgegevens.

Would you like to see how an IT outage in healthcare unfolds step by step in the platform? Then take a look at the accompanying practice scenario.

Stappenplan

Veelgestelde vragen

Was the CrowdStrike outage a cyberattack?

No. The outage of 19 July 2024 was caused by a faulty software update from the supplier CrowdStrike, not by an attack. Even so, it brought down Windows systems worldwide, including in hospitals, which underlines the importance of sound emergency procedures.

How does care continue when the systems fail?

With tried-and-tested emergency procedures: working with paper administration lists, double-checking high-risk medication and clear agreements about priorities and roles. Practise these procedures regularly so that they become second nature.

Which reporting obligation applies to an IT outage in healthcare?

If patient safety is at risk, you report a serious incident within three working days to the IGJ (Wkkgz). If personal data is involved, the data breach notification within 72 hours to the Autoriteit Persoonsgegevens applies. Often the Cybersecurity Act (NIS2) applies as well.