University Hospitals (UH) continues to experience disruptions to its websites and MyChart patient portal more than two weeks after detecting suspicious activity on its computer systems.
The Ohio-based healthcare system said it could not provide an estimated date for restoring all affected services. Patients remain unable to access MyChart and certain online resources, while doctors and administrative staff have adopted alternative procedures to maintain medical services.
- University Hospitals websites and MyChart remain unavailable more than two weeks after the health system detected suspicious network activity.
- Internal systems used by doctors to access patient records remain operational, but appointments, prescriptions and patient communications have required alternative arrangements.
- The hospital faces a proposed class-action lawsuit alleging inadequate cybersecurity protections. Officials have not confirmed whether patient information was compromised.
University Hospitals confirmed that its internal network, which allows physicians to access patient records, remains fully operational.
On Thursday, Oct. 22, 2026, we detected unusual activity on University Hospitals servers. We activated our response protocols and, out of an abundance of caution, disconnected our systems from the internet. While we are trying to minimize the impact on our patients, certain digital services, including MyChart, remain offline while we investigate. We are working around the clock to address the issue and restore access.
“We are working to restore our systems safely. Our hospitals, emergency departments and physician offices remain open, and our caregivers continue to provide safe care every day. At this point, we do not currently have an estimated timeline for completion”, University Hospitals said.
The organization has not disclosed the nature of the cybersecurity incident or confirmed whether unauthorized individuals accessed patient information.
University Hospitals MyChart remains offline after cyberattack
University Hospitals first identified unusual activity on its servers on October 22. The health system disconnected affected systems from the internet as a precaution while investigating the incident. More than two weeks later, its websites and MyChart portal remain unavailable.
In a statement, University Hospitals acknowledged receiving a high volume of calls from patients seeking information.
The organization encouraged patients to contact their physicians’ offices directly with questions about appointments, medical records and other services.
Patients have also been advised to continue attending scheduled in-person appointments. Virtual consultations are being converted to telephone calls, Zoom sessions or face-to-face appointments when necessary.
A hospital spokesperson confirmed that the internal system used by doctors to access patient records is functioning.
Doctors use alternative procedures during system outages
The cybersecurity incident has disrupted several administrative and clinical workflows.
Healthcare providers have been calling prescriptions into pharmacies or preparing written documentation when electronic systems are unavailable.
Patients are receiving laboratory results by telephone, while appointment reminders are being delivered through calls rather than MyChart notifications.
Several applications used by University Hospitals employees remain inaccessible or can only be operated from desktop computers.
The hospital has continued providing medical services while working to restore affected technology.
Internal emails reviewed by Ideastream Public Media show that employees have been instructed to reset passwords and continue adapting their daily procedures.
The messages did not provide detailed information about the attack or a timeline for full restoration. University Hospitals CEO Cliff Megerian thanked employees for maintaining patient care during the disruption.
“We cannot repeat it enough. Thank you to each and every one of you who have adjusted your routines and workflows to continue to serve our patients,” Megerian wrote.
Why hospital cybersecurity recovery can take weeks
Cory Scott, executive director of the Cybersecurity Center at Cleveland State University’s College of Law, said the length of the disruption was not unusual for a serious cybersecurity incident.
A study of ransomware attacks affecting US hospitals and healthcare providers found an average recovery period of approximately 16.5 days.
University Hospitals has not confirmed that its incident involved ransomware. Scott explained that healthcare organizations generally disconnect potentially affected systems to contain an intrusion and prevent additional damage.
Investigators must then establish how attackers gained access, identify compromised systems, remove any unauthorized access and determine whether infrastructure can be safely restored.
Hospitals must carry out those tasks while continuing to deliver essential services.
Laboratory testing, imaging, patient scheduling and medical treatment may need to operate through temporary procedures during the investigation. Restoring systems before establishing that they are secure could expose the organization to further disruption.
Healthcare ransomware attacks reached new highs in 2026
The volume of cyberattacks affecting healthcare organizations can complicate recovery efforts.
According to cybersecurity research company Comparitech, ransomware attacks against the healthcare sector reached an average of 3.33 incidents per day during the third quarter of 2026.
University Hospitals has engaged external investigators to assist with its incident.
Demand for cybersecurity response specialists can affect recovery times when multiple organizations require assistance simultaneously.
Attackers may monitor public statements and use disclosed details to assess an organization’s response. Hospital officials may also avoid announcing restoration dates until they are confident those deadlines can be met.
University Hospitals faces proposed class-action lawsuit
University Hospitals is facing a proposed class-action lawsuit alleging that its cybersecurity practices failed to adequately protect sensitive patient information.
The complaint claims that personal information was compromised during the incident and alleges that the health system did not implement reasonable security safeguards.
These remain allegations, and the lawsuit does not establish that patient data was accessed.
University Hospitals has not publicly confirmed whether personal information was exposed or acquired during the incident.
The organization has also not disclosed the type of attack detected on October 22.
Under federal healthcare privacy rules, certain breaches involving protected health information must be reported to the Department of Health and Human Services within 60 days of discovery.
At the time of reporting, University Hospitals had not filed a public breach notification with the department concerning this incident. The health system continues working with external investigators while maintaining patient services through its operational internal network and temporary communication procedures.
