admin
For Melissa Tizon, the Chief Communications Officer at Providence Health & Services, the magnitude of a global technological collapse began with a single, persistent vibration of her phone at 11 p.m. In the high-stakes world of healthcare communications, late-night calls are rarely social, yet Tizon’s first instinct was to dismiss the interruption as an accidental "butt dial." When the phone rang a second time moments later, the gravity of the situation became clear. On the other end of the line was a member of the Providence IT team, calling from the cabin of a grounded aircraft. The world’s digital infrastructure was fracturing, and Providence, one of the largest health systems in the United States, was in the direct path of the fallout.
The disruption was the result of a faulty software update issued by CrowdStrike, a leading cybersecurity firm, which triggered a "Blue Screen of Death" (BSOD) on millions of Microsoft Windows machines worldwide. For a healthcare provider like Providence, which operates 51 hospitals and nearly 1,000 clinics across seven states, the outage was not merely an IT inconvenience; it was a critical threat to patient care, record accessibility, and operational safety. Tizon’s subsequent actions over the following 48 hours would serve as a masterclass in crisis management, emphasizing the role of the communicator as a translator between technical chaos and public calm.
The Anatomy of a Global Digital Disaster
To understand the pressure facing Tizon and her team, one must look at the scale of the CrowdStrike incident. On July 19, 2024, CrowdStrike released a routine configuration update for its Falcon sensor, a piece of software designed to protect against cyberattacks. However, a defect in the update caused Windows systems to crash and enter a continuous loop of restarts. Because the Falcon sensor operates at the kernel level of the operating system—the most fundamental layer of software—the crash was total.
Approximately 8.5 million Windows devices were affected globally. While that number represents less than one percent of all Windows machines, the affected systems belonged to the world’s most critical infrastructure: airlines, banks, emergency 911 services, and hospitals. At Providence, the outage struck at the heart of their digital ecosystem, impacting the Epic electronic health record (EHR) system, which clinicians rely on for everything from checking patient allergies to documenting life-saving surgeries.
Translating Technical Complexity into Plain English
As the crisis unfolded through the early morning hours, Tizon identified her primary objective: clarity. In the initial stages of a technological disaster, technical teams are often consumed by "war room" logistics—identifying the "root cause" and attempting manual "remediation." For the general public and frontline healthcare workers, this jargon is meaningless.
Tizon’s strategy focused on a rigorous process of "ascertaining the situation." She remained in constant contact with IT leadership, not to offer technical advice, but to demand simplicity. "You do have to take a pause and just say, ‘OK, subject matter expert, you need to tell me what’s happening,’" Tizon noted. "And just get them to explain it in plain English."
This role of "communicator as translator" is vital. Tizon argued that if a communications lead does not fully grasp the mechanics of the problem, they cannot hope to provide an audience with a sense of security. The goal was not to provide an immediate solution—which was in the hands of the engineers—but to translate the status of the fix into a narrative that stakeholders could follow.
A Chronology of the Providence Response
The timeline of the response reflects the rapid escalation required during a Tier-1 emergency:
- 11:00 PM (Night Zero): Initial notification of system failures. Tizon begins mobilizing the core communications and leadership teams.
- 12:00 AM – 4:00 AM: Intensive briefing sessions with IT. It is determined that the issue is a global third-party failure (CrowdStrike) rather than a localized cyberattack or internal Providence error. This distinction is crucial for public messaging.
- 6:00 AM: Tizon schedules a virtual meeting with executive leadership and broadens the internal communication net. An initial email is dispatched to the organization’s tens of thousands of employees, outlining the known facts.
- 8:00 AM: Frontline staff at hospitals and clinics are provided with specific scripts. These scripts allow nurses and receptionists to explain delays or the need to reschedule appointments without needing to understand the nuances of kernel-level software defects.
- Mid-Morning: Providence issues its first public statement via social media and news outlets. The message acknowledges the impact but highlights a critical victory: IT teams had restored key functionality to the Epic EHR system, ensuring physicians could access patient records.
Supporting Data: The Cost of the Outage
The financial and operational data surrounding the CrowdStrike outage underscores the stakes Tizon faced. According to analysis by Parametrix, a specialist insurer, the total financial loss for U.S. Fortune 500 companies (excluding Microsoft) was estimated at $5.4 billion. The healthcare sector was among the hardest hit, with estimated losses exceeding $1.9 billion.
In the medical field, the "cost" is also measured in human terms. Thousands of elective surgeries were postponed nationwide, and emergency departments were forced to revert to paper charting—a slow, error-prone process that hadn’t been the primary standard in over a decade. By maintaining a steady flow of information, Tizon’s team helped mitigate the secondary crisis: a loss of trust. By being transparent about what was broken and what was being prioritized, Providence managed to maintain patient cooperation despite significant service delays.
Thinking Like the Audience: Internal and External Stakeholders
A recurring theme in Tizon’s approach is "perspective-taking." In a crisis, different audiences require different layers of information.
For patients, the priority was reassurance. They needed to know if their upcoming surgery was still happening and if their medical data was secure. Providence’s statement was carefully crafted to emphasize that the outage was a technical glitch, not a data breach, addressing the immediate fear of identity or medical record theft.
For frontline caregivers, the priority was operational guidance. Tizon’s team focused on providing tools that eased the burden on staff who were already dealing with the stress of manual workflows. By giving them "plain-language" explanations to offer patients, the communications team reduced the friction at the point of care.
For the media, the priority was facts and updates. Tizon ensured that Providence was seen as an active participant in the resolution rather than a passive victim. The statement issued to the media was proactive: "Our IT teams have been working overnight to respond to the issue… we will provide updates as soon as they have more information."
Broader Implications for Crisis Management
The CrowdStrike incident has sparked a broader conversation about the fragility of the "monoculture" in global IT—where a single point of failure can paralyze the world. For communicators, the event highlighted several evolving truths in the digital age:
- Speed vs. Clarity: While the digital age demands instant responses, Tizon advocates for a brief "pause" to ensure the message is accurate. An incorrect update can cause more panic than a slightly delayed, accurate one.
- The "Human" Element in Tech Crises: Even when the problem is purely silicon and code, the solution for the public is human. Tizon’s focus on "scripts for humans" rather than "technical logs" was a key differentiator in the Providence response.
- Advocacy within Leadership: Tizon noted that communicators must sometimes advocate for internal fixes. If a process is broken and causing reputational or operational harm, the CCO must have the seat at the table to demand a resolution, acting as the voice of the customer or patient.
Conclusion: The Path Forward
The CrowdStrike outage was an unprecedented event that tested the resilience of global systems. For Melissa Tizon and Providence Health & Services, the event was a reminder that the most powerful tool in a communicator’s arsenal is not a high-tech platform, but the ability to simplify the complex.
As Tizon prepares to share her insights at the upcoming PR Daily Conference in Brooklyn, the lesson for the industry is clear: In an era of increasing technological complexity, the communicator’s value lies in their ability to remain human. By stripping away the jargon and focusing on the immediate needs of the audience, Tizon didn’t just manage a crisis—she maintained the bridge of trust between a healthcare giant and the community it serves. The technical failure was outside of Providence’s control, but the narrative of the recovery was firmly in their hands.
