Grant walked me to my car.
I’d parked a block away on a side street, under a streetlight. He walked beside me in his good wool coat with his hands in his pockets, snow settling on his shoulders. Neither of us said anything for half a block.
“I owe you an apology,” he said finally.
“You don’t.”
“I do. I’ve been your brother-in-law for eleven years, and I’ve never once asked about your work.” He gave a short, tired laugh. “My own wife’s sister. And then at four in the morning I look down, and there you are on your knees on a tile floor, sorting charts. I thought you were a volunteer.”
“Close enough.”
He stopped under the streetlight. “Lydia, that floor. Do you know what that was like? I’ve been practicing medicine for twenty-two years. I’ve never seen a hospital run that cleanly through a crisis.”
“It was the downtime drills.”
“Whose idea were those?”
I looked at him. “Mine.”
He closed his eyes.
“I fought for them for eleven years,” I said. “Nobody liked them. Finance hated them. They cost money, and they pulled staff off the floor. But I read about a hospital in another state that got hit with ransomware and had no paper plan. Ambulances got diverted. A patient died on the way to another hospital.”
“I read about that one, too,” he said quietly.
“I didn’t want that to be us.”
When he opened his eyes, they were wet.
“It wasn’t us,” he said. “Because of you.”
I couldn’t answer.
He hugged me. In eleven years, Grant had never hugged me. It was stiff, awkward, and completely sincere, his chin resting on top of my head while the snow fell on both of us.
“Thank you,” he said into my hair.
Afterward, I drove back to the hospital, because I had to.
It was past ten. The roads were empty and white, and the lights of Toledo glowed through the snow like a city in a snow globe. I took the long way, along the Maumee River, past the dark grain elevators.
The command room was nearly empty. Marisol sat alone at the long table with her shoes off, a paper cup of tea at her elbow, reading a status report.
“You’re supposed to be at your mother’s,” she said.
“I was.”
“And?”
I sat down across from her and put my head in my hands. Then I told her everything: the toast, the envelope, my grandmother’s question, my mother on her knees on the rug.
She listened without interrupting, her chin in her hand. When I finished, she was quiet for a while.
“I’ve worked with you for eleven years,” she said. “On December 21st, I watched you give eleven instructions in ninety seconds. I’d bet my pension those instructions saved forty lives.”
“It was the drills.”
“It was you.” She reached across the table and took my hand. “I’ve never said this to you. I’m proud of you, Lydia.”
My eyes filled.
“I know I’m not your mother,” Marisol said. “But somebody in this building has been watching you for a very long time. And she thinks you’re extraordinary.”
I put my forehead down on the table and wept. She stroked my hair the way you’d comfort a child.
All six hospitals were back on their electronic systems by December 30th.
We never paid the ransom. Not one dollar. Devin’s team and the FBI confirmed that the hackers had gotten into our clinical systems but never reached the billing database where patients’ Social Security numbers and bank information were stored. Our lawyers still sent notification letters to every patient whose records might have been viewed, as federal law requires, and our cyber insurance policy covered two years of free credit monitoring and identity theft protection for anyone who wanted it.
The total cost of the attack, including the forensic investigation, overtime pay, legal fees, the notification letters, and the credit monitoring, came to $3.1 million. The insurance policy covered all of it except the $250,000 deductible.
Three years earlier, I’d stood in front of the finance committee and argued for that policy. One board member called it “paying for a fire that will never happen.”
Not one patient was harmed during the outage.
I’d love to call it luck. It wasn’t. It was eleven years of drills nobody liked, staff who had rehearsed, and a woman named Marisol who said, “Open the boxes.” In the end, it was thousands of people who pulled a plastic bin down from a shelf and started writing without complaint.
The board met on January 3rd.
I’d half expected a reprimand. A stolen password at one of our clinics had caused all of it, and as COO, our clinics were ultimately my responsibility. I stood in the ninth-floor boardroom in my navy suit, holding a folder that contained my written analysis of every failure, including my own.
Alan Prewitt looked at me for a long time from the head of the table.
“Lydia,” he said. “We’d like to talk about your employment contract.”
“All right.”
“We’d like to renegotiate it.”
I braced myself and stood very straight.
“Upward,” Alan said.
I blinked.
He smiled, a thin, dry, genuine smile. “The board voted unanimously. The Ohio Department of Health has called our response a model for the state. The American Hospital Association wants you to speak at its national conference. The Wall Street Journal has requested an interview.” He paused. “And on a personal note, in forty years of medicine, I have never seen a hospital executive carry a box of forms up three flights of stairs at four in the morning.”
I put a hand on the back of a chair to steady myself.
“It was just a box,” I said.
“It was the box,” said Alan Prewitt.
The new contract was five years. My salary went up considerably, with a performance bonus tied to patient safety measures, not to profit. Howard Brandt reviewed every page with me, and so did an outside employment lawyer I hired with my own money, a sharp woman named Celeste Moreau. She caught one clause about non-compete restrictions and had it rewritten.
“You’re the most valuable person in that building,” she told me. “Don’t sign anything that says otherwise.”
Executive compensation at nonprofit hospitals is public record. It gets reported to the IRS every year. In the spring, the Blade ran its annual list of the highest-paid hospital executives in northwest Ohio. My name was on it.
My mother called me at midnight, weeping.
“I’m sorry,” she said. “I’m so sorry. I didn’t know it was that much.”
“It’s all right, Mom.”
“Fifty dollars,” she whispered.
“I know.”
“I’ll never forgive myself.”
“Mom,” I said. “I’d like you to try.”
