A hospital record tested on its worst night

In late 2022, after several Japanese hospitals had suspended services for weeks following ransomware attacks, our board asked how long we could operate without the electronic record. Our supplier proposed a live replica in a second data centre for ¥238 million, with ¥31 million a year to run it. The vice-chairman, a surgeon, favoured it because it promised recovery within hours.

I recommended against it. A replica copies whatever happens to the primary system, including encryption by an attacker. I proposed ¥84 million for isolated backups that could not be altered once written, a separate environment in which to rebuild the record, and ¥14 million a year for a downtime programme: standalone ward computers printing summaries every four hours and paper drills on live wards. The trade-off was explicit. Our planning assumption for full recovery became 72 hours rather than a few, and the wards would have to manage that period on paper.

The director of nursing objected for a different reason. Her wards were short-staffed, and a drill would take time she did not have. We agreed to run the first drill in June 2023 on two wards only, with overtime paid from my budget. It exposed 27 gaps, including laboratory labels that could not be printed and a dialysis clinic whose machine records sat outside the backup scope. Each gap was assigned an owner and a date.

The board approved the proposal by a majority. In 2024 we rebuilt the acute hospital's full record in the isolated environment in 58 hours. In August 2025 a network failure stopped the community hospital's record for six hours and twenty minutes, and the wards worked from the printouts. I do not claim that this proves the programme; it was not an attack.

What I would do differently is involve the dialysis clinic and the pharmacy from the first meeting. I also asked nursing to absorb the first drill's preparation before paying overtime, and that cost goodwill I needed later.

By 2021 our three hospitals ran three electronic records: two versions from one supplier, with support for the older ending in 2024, and a smaller supplier's product at the rehabilitation hospital. Between them they carried 286 local customisations. Upgrading the incumbent's system with every customisation preserved was quoted at ¥1.94 billion over seven years.

I recommended tendering for a single standard package across all three hospitals, limiting customisation to a priced list agreed by a clinical committee. A second supplier offered that for ¥1.46 billion over seven years, including data migration, a full export right and a break point after year five. The saving was real, but so was the cost. Five years of structured data would migrate; older records would remain in a read-only viewer costing ¥38 million.

The director of the rehabilitation hospital disagreed strongly. His therapists had screens built around their own assessment and planning forms, and the standard package recorded rehabilitation in a more general way. The head of the acute hospital's physicians' committee also argued that changing supplier during a staff shortage was a risk. Both concerns were reasonable. We kept 41 customisations, eleven of them for rehabilitation, and gave up the rest.

Go-live came at the acute hospital in November 2023, the community hospital in May 2024 and the rehabilitation hospital in November 2024. Therapists' documentation time rose by about a fifth in the first three months and returned to its earlier level after eight. Additional training raised the seven-year forecast to ¥1.51 billion, ¥50 million above the contract. Upgrades now follow the supplier's standard cycle, and our first one took a weekend rather than the three months of testing the old system needed.

The enterprise gained a record it can upgrade and, if necessary, leave. What I would do differently is fund therapists' and nurses' time to design templates before signing the contract. We asked them to do that work after go-live, when they had least time to give.

Medical institutions in Japan were required to confirm insurance eligibility online from 2023, and new paper insurance cards stopped being issued at the end of 2024. Our administrative director's budget for the year to March 2026 assumed that online checks would replace manual work at reception, and removed seven reception posts across the three hospitals, saving about ¥31 million.

I recommended deferring the reduction. In the first months of 2025 our logs showed many patients still presenting older cards or separate eligibility certificates, elderly patients locked out after repeated PIN attempts, and online responses that did not yet reflect a change of employer. Reception was where a patient might wrongly be told to pay in full or come back another day. The administrative director disagreed, because our operating margin was about one per cent and the saving had already been presented to the board.

The board agreed to defer the reduction for one year on condition that I report the evidence monthly. We set three rules. A failed online check would never turn a patient away; staff would use a printed fallback sheet; and the reason for every failure would be logged in a simple form on the reception screen. In the year to March 2026 we recorded 4,260 failed or unclear checks. Over the same year, the share of outpatient visits confirmed online rose from 21 per cent to 63 per cent, and claims returned to us for eligibility errors fell from 1,340 to 520.

The evidence supported a smaller, later reduction. From April 2026 four posts were removed through retirement and transfer rather than seven, and the logged failure rate is reviewed each quarter. The group carried the cost of the deferral in a difficult year, and revising the budget in front of the board was uncomfortable for us both.

What I would do differently is start the failure log when the card readers were installed in 2023, not two years later, and include the home-visit nursing stations, which met the same problems in patients' homes.