State Claims Agency confirms cover for clinical staff following cyberattack

Healthcare professionals providing care without the support of systems and diagnostics following the recent HSE ransomware attack are fully covered under clinical indemnity and general indemnity schemes, according to a statement from the State Claims Agency (SCA). In a document providing guidance on state indemnity, incident reporting and risk management to doctors, nurses, midwives, and allied healthcare professionals, the Agency confirmed cover remained in place.

“The SCA recognises that in many situations, health and social care professionals will be providing care in challenging situations, relying on paper-based systems, hand-written results, without access to patients’ and service users’ healthcare records and previous test results, and with limited access to diagnostic tests,” according to the document, published on the HSE website.

“For the avoidance of any doubt, please note that doctors, nurses, midwives, and allied healthcare professionals in the various specialties, who are obliged to practice without the usual back-up of essential systems, clinical imaging and other diagnostic-related results to assist in their assessment and treatment of patients, are fully covered by the CIS in relation to their ongoing clinical decision-making, in the absence of such clinical supports.”

The Agency added that while the National Incident Management System (NIMS) had not been impacted, access to the system had been suspended “to minimise any associated risk”. Forms should still be completed and retained for system input later, it advised.

Healthcare professionals should document in healthcare records when limitations to care occurred due to the absence of adequate systems and supports. Staff should also inform patients that their ability to provide care is limited and document this in the healthcare record. Formal risk assessments should be undertaken and the use of alternative IT communication channels “risk assessed”, the Agency further advised.

Meanwhile, a number of HSE ICT systems have been partially restored as work continues to reinstate all systems, according to HSE Chief Clinical Officer Dr Colm Henry. However, in a recent memo to staff, he cautioned that “recovery of ICT systems is not synonymous with service recovery”. Despite contingency plans and limited ICT recovery, he said most providers continued to curtail services.

“This is because not all systems are recovered, recovered systems are slower than usual and the considerable task of uploading backlogs and reconciling patient records is laborious and time consuming.”