AIIMS computers, IT system not upgraded for atleast three decades

Even as AIIMS is reeling under the ransomware attack, the country’s top premier medical hospital—All India Institute of Medical Sciences never upgraded its computer and IT system for the last 30 years. Besides this, out-of-date, old equipment and software, and old version of windows were in use till date which used to manage medical records of millions of patients. Officials said that while the issue to upgrade the IT system has been raised multiple times to the top authorities, nothing was done.

“There was no upgradation computer and IT facility in the institute for atleast last 30-40 years. Out-dated and old equipment having no latest version of windows were in use. We flagged concerns rhis issue many a times to the top administration but no improvement was done. Till date, the computer and IT division was headed by a doctor who do not have any know-how of IT related work.... so there are multiple flaws,” a senior official at AIIMS requesting anonymity.

On 23 November, AIIMS informed that it was hit by ransomware attack damaging all its servers. It is the 12th consecutive day that its server continues to remain down and hospital working on manual mode stopping all digital activities.

The central government immediately deputed a team of experts by National Investigation Agency (NIA), Defence Research and Development Organisation (DRDO), India Computer Emergency Response Team (CERT-IN), Delhi Police, Intelligence Bureau, Central Bureau of Investigation (CBI) and Ministry of Home Affairs (MHA).

Besides this, the institute administration is now planning to frame cyber security policy for the safety of hospital and patient data.

“Under this new cyber security framework, AIIMS is planning to depute a cyber security officer and senior IT professionals for the IT related work. A sperate network will be created for e-hospital and e-office related work and while a separate network will be set up for doctors for sending emails and other official work. Besides this, all department faculties, HODs, scientists have been directed to ensure security audits of the software they are using from CERT-IN certified auditing agencies so as to prevent malware spread from their software in the servers and connected endpoints,” said another official at AIIMS aware of these developments.

In this regard, the institute’s computer and IT facility has called for a meeting for IT vendors providing such solutions to AIIMS to verify the same before 31st December and block access to AIIMS network and central servers from any other non-security audit applications.

Besides, this all faculty and doctors have been directed that no routers hub etc should be connected to AIIMS network port by any user, no computer/desktop/laptop etc which is on AIIMS lane, may be connected to mobile hotspot, tethering or any other mode of internet.

Last week, the institute in a statement claimed that they have restored e-office but due to large volume of data, hospital operations are continuing manually.

Queries sent to AIIMS and health ministry spokesperson did not elicit any response immediately.