Implementation of a continuity plan for Cytotoxic Reconstitution Unit (CRU) in case of cyberattack

Objective
Cyberattacks are more and more frequent in hospitals: 730 in 2021 according to the Digital Health Agency. To be ready as well as possible, our CRU has set up a continuity plan without using specific software.

Material and method
Chimio^® software and gravimetric control are normally used during our manufacturing. Continuity plan includes: a) installation of equipment offline from our hospital network: computer, printer, copy machine b) Excel^® files creation: scheduler, medications management file, production sheets (PS) c) paper frames: planning, prescription mask (PM).

Results
Our continuity plan uses the following tools: a) Offline hardware dedicated to CRU. Protocols are saved in PDF format. b) Creation of 67 PS (1/medication) automatically integrating target weight +/-5% with density, expiry and concentration range. The medications management file allows to manage remainders (automatic calculation according to the volume used). c) A PM identifies the patient.
Continuity plan is as follows: 1) Doctors of the Day Hospital Unit (DHU) programs patients and their protocols on a day’s paper schedule 2) The schedule is transmitted to CRU, the pharmacist gives back to doctors a PM with the patient’s protocol 3) The doctor prescribes on protocol sheet and PM 4) Those elements are transmitted to CRU and transcribed by the pharmacist in the prescription book and in the PS (mandatory double check pharmacist/pharmacist). Gravimetric control is carried out during manufacturing 5) Preparations are released and sent to DHU with coresponding protocol and PM 6) Chemotherapies are administered and traced on protocol and PM. A copy is sent back to the CRU at the end of the day for archiving.

Discussion and Conclusion
Data from Excel^® files are erased at the end of the day (no storage of patient’s data for privacy). Updating the offline computer should be regular. A production simulation (PS and remainder of medications only) in parallel with the real production was carried out over several half-days. The PS correctly include all the information necessary to manufacturing. Editing is done quickly but transcription is a risk and double checking is mandatory for safety. Full-scale production seems difficult to achieve and good doctor/pharmacist communication is essential. Prioritization of patients should be considered in order to smooth production. This continuity plan is part of a response in the event of a cyberattack and will ensure production under conditions allowing the most appropriate possible support. A full-scale test without compromising production and safety will be organized soon.

See the poster