Melbourne Health says no clear evidence of how Qbot wormed its way in

There is still no clear evidence as to how the Qbot virus entered the Melbourne Health network and disrupted some of Royal Melbourne Hospital's systems, but it appears to be able to infect PCs running any version of Windows, the organisation says.

The worm first attacked Royal Melbourne a fortnight ago, forcing the hospital to temporarily abandon some of its clinical systems and institute manual work-arounds, particularly in pathology. Pulse+IT understands this is the second virus to bring down the pathology department in the last six months.

As Pulse+IT revealed last week, the culprit turned out to have been a Qbot or Qakbot worm, which is known to affect older Windows operating systems, in particular XP.

A Royal Melbourne Hospital source said most of the workstations that pathology staff use to access the laboratory information system run on XP. There are also a number of older machines attached to medical devices such as analysers that run on Windows NT.

However, this particular variant is able to attack PCs running any version of Windows, a hospital spokesperson said.

“Evidence tells us that the computer virus affecting Melbourne Health is a variant of the Qbot worm affecting PCs running on any version of Windows,” the spokesperson said.

“The virus is polymorphic and new variants are being discovered world-wide. We do not have clear evidence as yet as to how the virus entered the Melbourne Health network.”

Much criticism has been laid at the feet of the hospital's IT department for still using XP. In addition to a long list of questions sent to Melbourne Health last week, Pulse+IT asked whether the hospital had a contract with Microsoft to continuing supporting XP, NT and other unsupported operating systems for critical clinical software applications.

However, Melbourne Health did not respond to specific questions. All it would say is that “Melbourne Health is in the process of migrating off Windows XP”.

“Safe patient care has been maintained throughout, elective surgery has continued with no cancellations and there have been a handful of outpatient cancellations,” the spokesperson said.

“Admissions to the hospital were not affected. Critical infrastructure is stable.”

Melbourne Health is in the process of removing its aged Kestral laboratory information system and implementing a new system from Citadel Health, a Canberra-based company that last year bought out pathology specialist PJA Solutions (PJAS).

PJAS is best known for its Auslab system, a version of which has been used for years by Pathology Queensland and is at the end of its life. Queensland Health says a replacement will cost about $75m.

Auslab is also used by Pathology North in NSW and Eastern Health in Melbourne, amongst others.

Royal Melbourne has joined with Austin Health and the Peter MacCallum Cancer Centre to introduce the new system.

The hospital is also part of an alliance that is trying to lobby for funds to introduce an electronic medical record. According to Melbourne Health's annual report for 2013-14, the hospital's board has approved a business case for the introduction of an EMR, and is currently rolling out a scanning solution to digitise paper records in advance of a “big bang” EMR.

The Victorian Department of Health has also funded the development of a “Parkville precinct” EMR business case. While the Royal Children's Hospital was successful in receiving funds to roll out an Epic EMR, due to go live in April, Royal Melbourne and the Royal Women's predominantly still run off paper charts, although both use CSC's iPM patient administration system.

It is no secret in the eHealth sector that Melbourne Health's CEO, Gareth Goodier, is also in favour of implementing an Epic system. Epic was rolled out at Dr Goodier's former employer, Cambridge University Hospitals NHS Foundation Trust, in 2014.

The cost of rolling out Epic at the 334-bed Royal Children's Hospital is $48 million. Pulse+IT understands that a Parkville implementation, with links to the research institutes and the medical school also in the precinct, would be well over double that figure. Royal Melbourne Hospital has 571 beds and the Royal Women's has 200.

The precinct also includes the new Victorian Comprehensive Cancer Centre, Murdoch Children's Research Institute, the Peter Doherty Institute for Infection and Immunity, the Walter and Eliza Hall Institute, the Bio21 Molecular Science and Biotechnology Institute and the University of Melbourne.

Posted in Australian eHealth

Tags: Royal Melbourne Hospital, Qbot, Qakbot, Melbourne Health

You need to log in to post comments. If you don't have a Pulse+IT website account, click here to subscribe.

Sign up for Pulse+IT eNewsletters

Sign up for Pulse+IT website access

For more information, click here.

Copyright © 2017 Pulse+IT Magazine
No content published on this website can be reproduced by any person for any reason without the prior written permission of the publisher.