When people hear “healthcare cyberattack,” the first concern is usually patient information. That is important—but it is only part of the risk.
In August, Health Sciences Centre in Winnipeg experienced a ransomware incident affecting parts of its facilities-management environment. Shared Health reported impacts to centralized HVAC monitoring and a system used to issue or modify access cards. Existing access cards continued working, HVAC systems continued operating with local monitoring, and patient care and clinical services were reported as unaffected.
At the August 14 update, investigators had not determined that data had been removed and initially believed financial and personal health information had not been accessed.
Think beyond patient data
For a smaller clinic, operational dependencies can include internet access, phones, appointment scheduling, printers, payment terminals, door access, Microsoft 365, shared files, backups and specialized clinical equipment or applications.
If one of those systems becomes unavailable, staff may still have patients arriving at the door while normal workflows are no longer available.
The practical question: can you keep operating?
Run a simple downtime exercise
Identify critical systems. Write down the technology required to open the clinic and serve patients.
Define manual alternatives. Decide how staff will communicate, schedule, document essential information and contact vendors if systems are unavailable.
Keep vendor contacts accessible offline. Do not make your emergency contact list dependent on the same systems that may be down.
Test backups and recovery. A backup that has never been restored is an assumption, not a recovery plan.
Assign responsibilities. Staff should know who makes decisions, who contacts IT and vendors, and how an incident is escalated.
The lesson for clinics is straightforward: protect sensitive information, but also understand which technology your organization cannot function without—and prepare for its temporary loss.
Source: Shared Health Manitoba, ransomware incident update, August 14, 2026.
Simple IT. Strong Security. — CyberEase
How resilient is your clinic?
CyberEase helps smaller healthcare organizations improve security, backup and practical recovery planning.