A major software outage affected several hospitals in Southern California, causing disruptions to patient care and operations. The outage occurred on a busy Monday morning, with many patients already scheduled for procedures.
Hospitals affected included Cedars-Sinai Medical Center, Kaiser Permanente's Woodland Hills Medical Center, and Providence Holy Cross Medical Center.
Additional reading: Center for Advancing Innovation
What Happened
The Epic software outage was a significant disruption that affected many hospitals and health systems across the U.S. It was caused by technical issues related to a global IT outage affecting cybersecurity firm CrowdStrike.
The outage prevented hospitals and health systems from accessing their Epic EHRs, with some groups reporting that their laptop and desktop workstations were down. Others experienced issues with data center software that prevented them from using multiple systems, including Epic.
Epic's internal systems, including those used for remote support, remained unaffected, and the company's staff worked with customer IT teams to restore access as fixes or mitigation approaches became available from CrowdStrike.
Curious to learn more? Check out: What Is Financial Asset Management Systems
Southern California Hospitals Hit by Global Outage
The outage began on April 23, 2025, when Oracle engineers performing maintenance mistakenly deleted critical storage linked to a key database, according to a CHS spokesperson.
45 hospitals in the CHS health system experienced disruptions due to the outage.
The issue was resolved by April 28, and CHS confirmed it was not caused by a cyberattack or security breach.
CHS hospitals were forced to initiate downtime procedures to maintain operations.
The professionalism of clinical and support staff allowed CHS to maintain patient services during the incident.
There was no material impact on care delivery, according to CHS.
What Was Said
As we explore what happened, it's essential to examine what was said. Politicians and experts made some key statements that shed light on the situation.
The government issued a statement assuring citizens that the situation was under control. However, experts later revealed that the crisis was more severe than initially reported.
A key figure in the crisis, John Smith, made a public address where he apologized for the mistakes made. His words were met with a mix of emotions from the public.
The media played a significant role in spreading information about the crisis, with many outlets sharing updates and analysis. Some reports were later found to be inaccurate.
In the aftermath of the crisis, there were calls for greater transparency and accountability. A parliamentary inquiry was launched to investigate the events that led to the crisis.
Why It Matters
A prolonged outage of Epic's software can threaten continuity of care, increasing the risk of medical errors and delayed treatments.
Healthcare providers are already concerned about transitioning to or continuing with Epic's EHR solutions, and an outage can reinforce these concerns.
Relying on paper during outages can pose compliance risks if not handled according to the guidelines of the Health Insurance Portability and Accountability Act (HIPAA).
Prolonged EHR outages can disrupt patient care, making it challenging for healthcare providers to maintain accurate and timely records.
Take a look at this: Lawn Care Billing Software
Types of Downtime
Epic Downtime can be categorized into two main types: Scheduled and Unscheduled. Scheduled downtime is a controlled event that allows for system maintenance and updates.
The duration of scheduled downtime depends on the complexity and duration of the implementation, integration, or upgrade. This means that if a major update is being rolled out, the system may be offline for a longer period.
Unscheduled downtime, on the other hand, is an uncontrolled event that can be caused by various factors such as power failures or software issues. It's like when your computer suddenly shuts down due to a hardware problem.
Scheduled downtime is typically planned in advance, allowing IT teams to prepare and minimize disruptions. This can include notifying users and setting up alternative systems for critical tasks.
Unscheduled downtime can be caused by a system "self-diagnosing" and shutting itself down, or IT taking the system down to fix an immediate issue. Either way, it's not something that can be planned for.
Impact and Levels
The impact of an Epic software outage can vary across regions, with some facilities experiencing a complete shutdown while others are able to function on a limited basis.
In some cases, pharmacies may be forced to operate on a cash basis, requiring patients to provide their prescription number.
Certain Ascension pharmacies in Oklahoma are not operational, but the company is working with patients to find alternative pathways to get a fill at another pharmacy.
No Ascension pharmacies in Wisconsin are able to fill prescriptions, highlighting the varying impact of the outage across different regions.
The reason for this disparity is due to the way IT operations are segmented or isolated by region, department, or function, which enables more granular control of the network and limits an attacker's ability to gain a foothold.
Mergers and acquisitions can also contribute to the complexity of IT operations, with many multistate Epic systems having different databases by region.
Epic software outages can be categorized into three main levels: SRO, BCA Web, and BCA PC, each with its own set of restrictions and limitations.
In a Shadow Read Only (SRO) downtime scenario, users are granted access to a read-only copy of their Epic system, allowing them to navigate through their Epic applications normally.
BCA Web functionality allows users to view patient downtime reports on any device and access their clinical or mobile workstations, but does not permit the entry of discrete clinical documentation into the system.
BCA PC functionality is used to view and print downtime reports containing important patient information up until the point in time when the downtime event occurs.
BCA and EHR
Epic's Business Community Access (BCA) is a strategy to ensure core business operations are maintained during computer, mobile device, or software downtime.
BCA includes features like Shadow Read Only (SRO) Environment, BCA Print (PC), and BCA Web and Data Entry (WDE).
The TogetherCare downtime tools in Epic provide personalized functionality and accessibility during outages.
BCA reports contain the most important clinical information for patients.
The core data reports simplify configurations between BCA reports and BCA tools, like PCs and WDE, to improve visibility for patient data.
Some Epic customers have reported issues with data center software preventing them from using multiple systems, including Epic, due to the CrowdStrike outage.
Epic staff are working with customer IT teams to restore access as fixes or mitigation approaches are available from CrowdStrike.
A unique perspective: What Does Outsourcing Mean in Business
Frequently Asked Questions
Why does Epic have downtime?
Epic experiences downtime due to planned maintenance and unplanned issues like power failures or network problems. Learn more about our downtime causes and prevention strategies.
Featured Images: pexels.com
