It’s going to take at least three weeks for the National Health Laboratory Services (NHLS) system to be restored following the cyber attack just over a week ago. The extended downtime means the NHLS will be unable to process 6.3 million blood tests, leaving people undiagnosed and risking their lives.  

A top haematologist working in one of Johannesburg’s tertiary hospitals says his internal clinics have come to a standstill, and patients in emergency wards and intensive care units around the country are in fatal danger. 

Most of the country’s public health facilities don’t have their own laboratories to run blood tests. Instead, these facilities send samples to the NHLS. Test results are then automatically generated and sent to clinicians or made available on web view. But the data breach has blocked this communication system. 

CEO of the NHLS, Professor Koleka Mlisana, says the entire system is unavailable to users nationwide, ruling out electronic sample testing, access to documents in the laboratory information system, and e-mails.

“We can’t register new samples, we’re doing that manually. We also can’t get results loaded after analysis. We’re now printing the manual results out, attaching them to request forms and phoning these out,” she explains. 

Delayed blood test results, or no access to results means that diagnosis, treatment – and sometimes life-saving decisions – simply cannot happen.

Hundreds of essential operations country-wide will be also cancelled as blood tests are critical to check whether liver function is normal and to detect any risk-increasing comorbidities.

“We can’t even register patients on the system or send emails,” the haematologist told Health-e News.

Only emergency blood tests are being done manually at tertiary hospitals – a time-consuming, laborious process.

“It’s affecting casualty wards and people are dying,” he claims. 

The NHLS’ Mlisana says she’s unaware of any deaths, explaining that individual provincial heads of health departments would have to monitor this and report back. However, she appeals to all involved to start collecting crucial morbidity and mortality data so the weakest manual testing points could be identified and strengthened.

“We’re meeting with provincial heads of department every second day to get updates and assess the status at service delivery level. It’s been hectic and yes, you could call it a crisis, though nothing like COVID (where she headed the Presidential Advisory Team), where mortality was incomparable.” 

Compromised patient care

Another senior doctor at Charlotte Maxeke, Dr Adam Mahomed, says he hasn’t seen any written reports of people dying linked to the blood testing crisis yet. “But logic dictates that if you don’t get test results timeously, you’re going to get ill,” says Mohammed, who is Clinical Head of Internal Medicine at the hospital. 

He says the situation at hospitals that don’t have internal laboratories will be “100 times worse, with serious trauma,” emphasising that for conditions like diabetic ketoacidosis (a severe lack of insulin), requiring two to three blood tests per day, this could easily lead to death.

“It’s a bit like pulling up to a garage and putting diesel in your tank instead of petrol.” 

Certain types of X-rays also require blood tests beforehand. Diseases like TB, the leading cause of death in South Africa, (diabetes is second), will also be harder to treat. 

Mahomed is particularly angered by “the terribly poor communication about this crisis to doctors by the NHLS”. He says the delay in notifying healthcare professionals about the crisis and subsequent poor communication is “shameful”.

“Can you imagine if this happened with an NHI?” he asked.

IT working to rebuild system

Mlisana says IT teams at the NHLS are “working flat out to rebuild, refix and clean up both hardware and software to establish a clean operating environment,” under the guidance of a cyber security specialist. 

A top priority is to build in enhanced security features to reduce the chances of a second ransomware hack (a common occurrence globally). But this unfortunately means an extended down time.

“Everything is shut down with nothing coming in or going out. Only the IT people can say how long this will take. But their preliminary assessment is that we’re probably looking at the next two to three weeks,” she said on Thursday (June 27^th).

To get a usable system up and running, the IT crews needed to “map everything we have and then put it on a separate server. It looks like we might have something by early next week, which will make a huge difference to our operations.”

She says her staff were “constantly coming up with new suggestions and solutions, like grouping all ICU blood results and compiling a critical test list to reduce the volumes coming through”.

A cyber probe has not established the origin of the ransomware attack and no demands have been made. But it coincided with an almost identical attack on the NHS computer system in the UK. The local IT team has found a hyperlink that could lead them to the attackers but “advised us not to even think about opening it”. 

Mlisana says she was in talks with a few private laboratory groups, but nothing has come of it so far.

“We’d need to negotiate prices and a modus operandi, plus who bears the cost. So, we’re doing this in tandem with repairs and monitoring the volume flow. I know clinicians are very frustrated, but we’re doing our best,” she says.

“Luckily our actual data is safe for tests that were already done, as is our Oracle system, billing system and data warehouse.” – Health-e News