UNM cyberattack diverts ambulances, disrupts care and raises HIPAA concerns

A cyberattack at the University of New Mexico Health Sciences Center did more than interrupt computers. It disrupted the systems that support emergency care and medical education, forcing operational changes that reached ambulances, patients, students and faculty. The incident is a reminder that in health care, a cyber event can become a patient-care and business-continuity crisis within minutes.

Public reporting on October 26 said the University of New Mexico was dealing with a cyberattack affecting its Health Sciences Center. Classes were canceled for a second day as teams worked to contain the incident and restore services. UNM Hospital also diverted ambulances, an emergency measure used when a facility cannot safely accept some incoming patients. The reports available for this draft did not establish the attack vector, identify an attacker or confirm the full scope of any data exposure.

The operational impact spread across the UNM community. Students lost access to scheduled instruction and campus resources. Faculty and staff faced disrupted workflows and uncertainty about when systems would return. Patients could encounter longer travel or wait times when ambulances were redirected, while clinicians had to continue care under constrained conditions. Even if core medical services remain available, the loss of connected systems can slow registration, communications, scheduling, diagnostics and access to electronic records.

The Health Insurance Portability and Accountability Act requires covered health care organizations and their business associates to protect electronic protected health information through administrative, physical and technical safeguards. A cyberattack does not automatically prove a HIPAA violation. However, an incident involving systems that create, receive, maintain or transmit protected health information can trigger a documented risk assessment, investigation and, if unsecured information was compromised, breach-notification obligations.

For UNM, the central questions include whether attackers accessed or removed patient information, whether data was encrypted or otherwise rendered unavailable, which systems were affected and how quickly essential services were restored. Those facts will determine whether the event was limited to operational disruption or also became a reportable health care data breach. Public reporting cited for this article had not yet resolved those questions.

Health care organizations should treat availability and confidentiality as connected goals. Network segmentation limits lateral movement between administrative, academic and clinical environments. Multifactor authentication and privileged-access controls keep stolen credentials from becoming a systemwide compromise. Endpoint detection and response, centralized logging and continuous monitoring improve detection and containment.

Recovery planning is equally important. Organizations should keep protected, tested backups and rehearse restoring electronic health records, identity services, communications and scheduling platforms in a clinically meaningful order. Incident-response exercises should involve hospital leaders, emergency management, legal, privacy, communications and academic administrators, not just IT and security staff.

The UNM cyberattack shows that cyber resilience must protect people and operations, not just data. Ambulance diversions and canceled classes caused visible harm before investigators knew whether information was stolen. Strong safeguards, rehearsed downtime procedures and clean recovery capabilities help narrow that gap.

Disaster recovery is what keeps a cyber incident from becoming a prolonged crisis. A documented, tested plan sets restoration priorities, downtime procedures and decision-making roles before an attack begins. Without one, organizations risk improvising while ambulances are diverted, classes are canceled and clinicians work with limited access to records. Regular testing of backups and recovery steps helps shorten downtime and protect patient safety.

As UNM investigates, accurate public updates are essential. Patients, students and employees need to know which services are available, what information may be affected and what protective steps, if any, to take. Until the facts are confirmed, reports should clearly distinguish a disruptive cyberattack from a verified breach of protected health information.