Cyber-attack in an injectable chemotherapy reconstitution unit: what about the production in absence of prescription software

Context
Dax Hospital Chemotherapy Reconstitution Unit produces an average of 65 preparations per day using CHIMIO^® software. The unit is endowed with DRUGCAM^® to carry out double video control of the preparations. On February 9, 2021, the hospital was cyberattacked. The CHIMIO^® database which includes patient history, protocols, stock and DRUGCAM^® were unusable. The challenge was to preserve the safety of injectable chemotherapy process from production to infusion into patients in oncology and hematology units.

Materials and methods
Manufacturing history was retrieved thanks to CHIMIO^® records archived in paper format at the pharmacy. Initially, the production sheets (PS) were handwritten using sheets of the previous cure and with a triple pharmacist / pharmacy dispenser control. From a protocol’s backup retrieved before the cyber-attack, an EXCEL^® file was created with macros and alerts to print PS and prescriptions comparable to those of CHIMIO^® and to generate a computerized pharmaceutical register. At the end of the second week, this EXCEL^® file was improved to provide nurses with administrations plans similar to CHIMIO^®. A double pharmaceutical control of the PS and the administration plans was carried out. The preparations were produced and checked by double visual inspection. A subcontracting with the pharmacy of Mont-de-Marsan Hospital has also been set up. Finally, a local network was installed at the pharmacy after recovery our CHIMIO^® database.

Results
A total of 878 preparations were made in degraded mode. The PS were handwritten the first two days, which represents 39 preparations. Then, the production was managed using the EXCEL^® file and we succeeded in producing 839 preparations in 18 working days. Creation and appropriation of this file allowed a gradually increase of the average daily number of preparations (40, 50 and then 60 preparations). 139 preparations were subcontracted, which represents approximately 8 preparations per day on the 17 days of subcontracting. Finally, the resettlement of CHIMIO^® required a data transcription. No dose or solvent errors were detected and all treatment intervals were correct. The reuse of CHIMIO^® in local network was effective on March 9, one month after the cyber-attack.

Conclusion
The use of the EXCEL^® file and the implementation of the subcontracting allowed to reach quickly a similar average production rate than before the cyber-attack. No error was detected when transcribing data in CHIMIO^®, which shows the interest of using, this semi-automated EXCEL^® file in degraded mode. A regular backup of CHIMIO^® software data should be considered in the future.