By Jason Mafera, Field CTO, Healthcare, IGEL
LinkedIn: Jason Mafera
LinkedIn: IGEL Technology
After Boston Scientific disclosed a cyberattack on its systems in late August, it took the company 16 days to fully restore manufacturing and shipping operations. The incident illustrates how recovery can extend well beyond the initial disruption, even for sophisticated organizations. Many organizations, hospitals included, struggle to say how long it takes to restore usable endpoint access after disruption because endpoint recovery time is not always tracked with the same rigor as infrastructure and application recovery. Inside a hospital, not knowing that number is an operational risk because care delivery depends on clinicians regaining timely access to working devices.
Most hospital ransomware plans focus first on the systems that keep the organization running: the network, the servers, and the core electronic health record. Few plans apply the same rigor to the layer clinicians touch every shift: the bedside workstation, medication cart terminal, or shared device at the nurses’ station. Security and recovery planning has traditionally concentrated heavily on the network, infrastructure, and EHR. As a result, the recovery time for the devices clinicians log into has stayed largely untracked and untested.
Health-ISAC’s most recent CISO benchmarking research points to a broader maturity gap around recovery. Among the functions measured in the research, recovery ranked lowest. Only 22% of surveyed security executives rated their organizations at the top maturity levels for restoring operations after an incident, compared with 60% for detection and 55% for protection. Detection and protection are often easier to quantify for leadership. A harder question is how quickly a nursing unit can regain usable endpoint access after disruption.
Public incidents also show how recovery can unfold in stages. When the Interlock ransomware group hit Kettering Health in Ohio in May 2025, the health system took roughly 600 applications offline and sent clinical staff back to paper charts. Core components of the Epic EHR were restored within two weeks, but normal operations across the health system did not return until three weeks after the attack began. That gap between core-system restoration and a return to normal operations illustrates why restoring the EHR does not necessarily mean the organization, or the clinicians depending on it, are fully recovered.
The effects of a prolonged disruption can also extend to the business side of healthcare, often on a longer timeline than the immediate clinical impact. When the University of Mississippi Medical Center (UMMC) was hit by ransomware in February 2026, it closed clinics statewide for nine days and postponed roughly 650 elective surgeries. UMMC also reported revenue for the month at roughly 20% below budget, a shortfall of about $34.2 million. More broadly, incidents like this illustrate that continuity extends beyond direct patient care. Scheduling, billing, finance, and reimbursement all depend on people being able to regain access to the systems they use to work. If endpoint access is not part of the continuity plan, those business functions can remain constrained even as core clinical systems begin to return.
The American Hospital Association and the Joint Commission addressed the recovery-time gap in May 2026, when they launched a readiness program built around a 28-to-30-day planning benchmark for cyber outages. While that benchmark is a meaningful step for clinical continuity overall, hospitals still need to understand how quickly clinicians can regain access through bedside and shared clinical workstations. Endpoint recovery deserves its own measurement because a ransomware attack, failed update, or other disruption can produce the same operational result: a clinician unable to reach the applications needed to keep working.
Hospitals do not need a new process to start tracking clinical endpoint recovery. Recovery time objectives already exist for the network and the EHR because leadership decided years ago those numbers mattered enough to track, test, and report. Clinical endpoints need that same three-part treatment: a defined recovery-time target, a drill that tests the target under realistic conditions, and a number that shows up in the same incident report as network and EHR recovery. Until a hospital can say how quickly clinicians can regain usable endpoint access, whatever the cause of the disruption, it does not have a complete picture of how quickly clinical operations can recover.