Scripps Health employees have regained access to some internal systems weeks after a cyberattack on their technology servers forced the health system to go offline, according to an internal communication obtained by NBC 7.
Employees now have access to some patient records, their email, to payroll and to an internal emergency response communication tool -- which they lost access to on May 1, the internal report dated May 18 said.
Patient appointments that were postponed due to the security breach -- which the California Department of Public Health has called a ransomware attack -- are also being rescheduled, though their access to Scripps' web portals is still not working.
Get top local stories in San Diego delivered to you every morning. Sign up for NBC San Diego's News Headlines newsletter.
The report did not go as far to say the security incident had been resolved but did confirm that "progress is being made to restore Scripps systems."
"Since the malware was first contained, our Information Services teams and cyber security advisors and technicians continue to work 24/7 to restore and validate priority applications," the report said.
A Scripps spokesperson would not confirm to NBC 7 that the malware was contained and said that no updates could be provided.
The internal email also said that Scripps Health was adding security features to its arsenal, like a multi-factor authentication process for remote access and mobile devices and new security software on 98% of all Scripps devices.
Scripps Health has provided little details about the cyberattack, including to confirm if the health system is being ransomed, and, if so, for how much or by whom. They have also not said if any private patient information has been compromised.
Scripps has been vocal, though, to say doctors are still able to provide patient care through back-up processes like physical charts, though some patients told NBC 7 their critical care was being postponed and they were having trouble getting answers from Scripps.
An memorandum from Scripps Health CEO and president Chris Van Gorder to employees last week was the first time many employees had heard from their top boss on the issue. In it, he said he wanted to be more transparent but that his hands were tied regarding what he could divulge about the incident.
Though the CDPH has called the outage a ransomware attack, Van Gorder did not use the term. He confirmed Scripps Health was working with consultants and government agencies to investigate the attack and get systems back online.
Read his full statement to employees below:
Scripps also has not said when it expects its systems to fully be back online. Visitors to Scripps.org are being told that "Patients or families with questions should contact 1-800-SCRIPPS (800-727-4777). We apologize for any inconvenience."
The local health care provider operates five hospitals in San Diego, along with a series of clinics.
