Idaho Falls Community Hospital and the adjacent Mountain View Hospital, which share a campus in eastern Idaho along with some common ownership, were struck by a cyberattack on Monday, May 29, 2023.
Idaho Falls Community Hospital, which operates the emergency department for the shared campus, began diverting ambulances to other facilities as a precaution, and the diversion was still in place two days later. Staff took electronic medical records and other IT systems offline and reverted to recording patient information manually on paper. The Mountain View RediCare urgent care clinic closed temporarily and several affiliated clinics ran at reduced capacity, with affected patients contacted to reschedule appointments.
A Mountain View Hospital spokesman said the IT team had identified the attack quickly and was working around the clock, that patient safety was the priority, and that surgeries were continuing and the emergency department remained open. The hospitals brought in outside cybersecurity specialists. They did not say publicly whether ransomware was involved or when systems would be fully restored.
Recovery ran into June. Idaho Falls Community Hospital resumed accepting patient transfers to its intensive care, pediatric and intermediate care floors on June 8, partner clinics and RediCare reopened by June 13, and the hospital was accepting all ambulance traffic by June 22. A later forensic review found intruders had access to the hospitals' systems between April 17 and May 29, 2023 and had removed files containing patient information.
Updates
Mountain View Hospital sent notification letters to 1,043 people on July 3, 2023. The exposed information included names, contact and demographic details, dates of birth, medical record and patient account numbers, and diagnosis, treatment and prescription information, with a limited number of patients also having Social Security numbers and driver's licence numbers taken.