The Situation

Luminis Health, the Annapolis nonprofit that runs Anne Arundel Medical Center and Doctors Community Medical Center, is still operating parts of its business in downtime nearly four weeks after a cyberattack. As of its most recent public update, the MyChart patient portal is available only in read-only mode, and online scheduling and messaging remain unavailable.

The system provides care to more than 1.8 million patients across roughly 100 ambulatory sites around Annapolis. Its emergency departments are open and surgeries are continuing, so from a clinical standpoint the organization looks recovered. The parts of the operation patients use to book care, get results, and pay bills are not.

4 weeks
Elapsed time since Luminis first alerted the state to a technology disruption, with patient scheduling and messaging still offline. Clinical services came back far sooner.

How the Outage Unfolded

Luminis alerted the Maryland Department of Health to a technology problem on August 31 and publicly disclosed a cybersecurity incident the following day. In the first days, clinicians reverted to paper charts and some patients were rerouted to other facilities, with ambulances taking noncritical cases elsewhere. At least one cancer patient reported that a scheduled radiation treatment was postponed and not immediately rescheduled.

By early September, both the phone system and MyChart were still offline, and appointments were being rescheduled. No ransomware group had publicly claimed the attack.

Exhibit 1
A four-week incident that is not over
Publicly reported milestones in the Luminis Health cyber incident
DateDevelopment
Aug 31Luminis alerts the Maryland Department of Health and begins rerouting patients
Sept 1Cybersecurity incident disclosed publicly and clinicians revert to paper charts
Sept 7Phones and MyChart still offline and appointments rescheduled
Sept 18Telephone service restored at all locations with EDs open and surgeries continuing
Sept 22Portal still offline and patients told to call for scheduling results and prescriptions
Sept 25Four weeks in with records read-only and no restoration timeline
SOURCE Amelior analysis of public disclosures and Maryland Department of Health statements. Dates approximate.

Where Recovery Stands

On September 18, Luminis said telephone service had been restored across all locations. Both emergency departments are open, and surgeries are continuing at the hospitals and at its ambulatory surgery centers. The system cautioned that some processes may take longer than usual and that patients may be asked to complete paper forms.

Several days later, the portal was still offline. Patients now have to call the hospitals for scheduling, test results, general questions, and prescription refills. As of the latest public commentary, records remained in read-only mode and the organization had not explained what happened or when full service would return.

Exhibit 2
Clinical systems are back. Patient-access systems are not.
Reported status of key systems as of late September 2026
SystemStatus
Telephone serviceRestored at all locations
Emergency departmentsOpen
SurgeriesContinuing
MyChart medical recordsRead-only
Online schedulingOffline
Patient messagingOffline
Billing charge capture and claimsNot disclosed
SOURCE Amelior analysis of Luminis Health public updates. Status reflects the most recent disclosures available.

The Revenue Cycle Picture Is Mostly Undisclosed

Luminis has not said whether registration, charge capture, coding, claims submission, or payment posting were disrupted. It has released no figures on canceled volume, held claims, or cash impact. Those silences matter, because MyChart is also where patients view results, message providers, and pay bills, and the organization has not said whether online bill pay functions in read-only mode.

Where the revenue risk actually starts
Self-scheduling is gone and every appointment request now routes through phone lines that were themselves down for about two weeks. That builds backlog for referrals, follow-ups, and rescheduled procedures. Paper forms at check-in mean demographic and insurance data has to be keyed in after the fact, which is exactly where registration errors and front-end denials begin.
Threat Brief
What Luminis has not disclosed
Whether registration and charge capture were disrupted. Whether claims are being held or submitted. How much volume was canceled or deferred. Whether online bill pay works while records are read-only. Any estimate of revenue or cash impact. As a nonprofit bond issuer, Luminis may eventually post operational or financial updates to investors. Any quantified figure would be the first hard number from this event.

The tail can run long. After Fort Worth's JPS Health Network restored its core EHR in mid-August, patients still reported billing and prescription-refill problems for weeks. Restoring the clinical system is not the same as restoring the revenue cycle.

What Revenue Cycle Leaders Should Watch

The Luminis event is a live case study in a gap most downtime plans underweight. Clinical services can return while patient access, and the revenue that depends on it, stays degraded for weeks. A few things are worth watching, both at Luminis and inside your own organization.

Recommended Actions
01
Track when scheduling and messaging return
Until the portal and messaging are back, the organization is not fully out of downtime no matter how normal clinical operations look.
02
Watch for backlog signals
Extended clinic hours, catch-up scheduling, and any reporting on deferred outpatient volume all indicate the size of the access backlog that has to be worked off.
03
Wait for financial disclosure
As a bond issuer, Luminis may report an operational or financial impact, and a quantified revenue or cash figure would be the first hard number from this incident.
04
Pressure-test your own exposure
Ask how your organization would schedule register and capture charges if the portal and phones were down together for two weeks, then estimate how long it would take to reconcile paper-era encounters once systems return.
Clinical recovery and patient-access recovery run on different clocks. The revenue cycle almost always sits on the slower one, and the plan built before the attack decides how far behind it falls.

Amelior helps health systems prepare for exactly this gap, through the Archer readiness assessment and the Anchor continuity platform that keeps registration and charge capture running when the EHR and the portal are down. To pressure-test your own downtime exposure, visit ameliormss.com/contact.