Contract Fracture Exposes the Operational Cost of a Hospital Cyberattack
Zia Diagnostic Imaging has taken Lovelace Health System to court, accusing the Albuquerque system of breaching an exclusive radiology agreement and failing to contain the fallout from a 2023 cyberattack that crippled imaging workflows for months. The dispute, filed Oct. 15 in Bernalillo County district court, goes beyond a standard contract quarrel. It puts a hard legal edge on a familiar clinical problem: when imaging systems fail, radiology is forced into manual workarounds, and patient safety can move from an abstract concern to a daily operational burden.
The contract at the center of the case dated to 2020, when Zia became the exclusive radiology services provider for Lovelace’s five Albuquerque hospitals. Exclusive arrangements in radiology are meant to create continuity, preserve turnaround times, and keep interpretation pathways stable across emergency, inpatient, and outpatient settings. When those arrangements unravel, the result is rarely limited to billing or staffing. It can alter the entire flow of diagnostic care.
One of the central allegations concerns staffing itself. Zia says Lovelace hired away its interventional radiologists after offering them jobs in 2022. Those physicians left in October 2023 and began performing non-interventional diagnostic services as Lovelace employees. Zia argues that move violated the exclusivity clause in the agreement. The complaint also says the departures triggered a wider erosion of the group’s radiology workforce, with other radiologists resigning soon afterward and the remaining six leaving New Mexico after Zia terminated the agreement effective spring 2024.
The abrupt breakdown matters because radiology departments depend on subspecialty coverage and stable interpretation chains. Interventional radiologists are not interchangeable with every diagnostic reader, and losing them can destabilize both procedure volume and overnight or on-call coverage. Once a service line starts shedding clinicians, the effect often compounds. Staffing shortages feed delays, delayed studies generate frustration, and the remaining physicians absorb more work until the system reaches a breaking point.
Manual Radiology Workflows After the Cyberattack
The other major pillar of the lawsuit focuses on the November 2023 cyberattack against Lovelace’s parent company, Ardent Health, based in Brentwood, Tenn. That ransomware attack hit 30 Ardent hospitals across six states, including Lovelace, and left patients struggling to refill prescriptions while systems recovered. In radiology, the complaint says, the disruption lasted months and interfered with basic clinical operations that modern imaging depends on: secure access, order tracking, report transmission, and patient identification.
According to the complaint, radiologists had to hand-write reports and then fax, call, or physically walk them to clinical sites. Imaging studies were allegedly delayed for days, weeks, or months before reaching Zia radiologists. Patients were also sent to scanners without identification bracelets or room numbers, a breakdown that led to mislabeled images. In a discipline where the wrong image can be almost as dangerous as no image at all, identification errors are not administrative inconveniences; they are diagnostic hazards.
Manual workflows can keep a service alive during an outage, but they come with steep clinical risk. Handwritten reports invite transcription errors. Faxed and phoned results fragment the chain of custody. Missing patient identifiers can contaminate the imaging record and create confusion that follows the patient into the next encounter. Even a short disruption can slow emergency evaluations, postpone procedures, and increase the odds that urgent abnormalities are not escalated promptly. When the complaint describes “hundreds or perhaps thousands” of studies delayed from review, it is describing a breakdown in the engine room of diagnostic care.
Alleged Breach, Damages, and the Cost of Lost Coverage
Zia’s legal team has said the group sought a settlement of several million dollars and that Lovelace declined mediation. If the radiology group prevails, it plans to seek about $5 million to $7 million in damages. The health system has declined to comment to the Albuquerque Journal, citing policy against discussing pending litigation.
The financial stakes mirror the operational ones. Radiology is not a peripheral hospital service; it is a core diagnostic utility used by emergency medicine, surgery, oncology, and inpatient care. When a hospital loses reliable imaging coverage, downstream services feel the pressure quickly. Surgeons wait for scans, emergency physicians wait for reads, and referring clinicians lose the continuity they need to make time-sensitive decisions. A legal fight over exclusivity therefore touches more than contract language. It exposes whether a system can preserve safe clinical throughput when its staffing model and technology stack are both under strain.
The allegation that Lovelace failed to mitigate the effects of the cyberattack is especially consequential because ransomware events often persist long after the first systems go dark. Recovery is not limited to restoring servers. It requires reestablishing identity verification, order routing, image transfer, and report delivery without compromising accuracy. When those steps remain broken, the hospital may technically be open while its diagnostic backbone still functions in a degraded state.
What the Dispute Says About Radiology Resilience
Radiology departments now sit at the intersection of labor competition and cyber resilience. The Zia-Lovelace dispute shows how quickly both can fail at once. A staffing loss can weaken interpretive coverage, but a cyberattack can turn that staffing loss into a clinical bottleneck by removing the digital tools radiologists use to process and distribute results. In that setting, even a well-trained team is forced into improvised methods that were never meant to carry high-volume imaging for months on end.
The complaint also raises a broader question for hospital systems that rely on exclusive service contracts: what obligations remain when the relationship turns adversarial and infrastructure breaks down at the same time? If the contract requires adequate equipment and services, a prolonged ransomware recovery may become not just an IT problem but a legal breach with direct clinical consequences. The case will turn on contract language, staffing decisions, and the scope of the outage, but the underlying facts point to a familiar vulnerability in modern medicine—diagnostic care depends on fragile systems, and when those systems fail, the damage is measured in delayed images, mislabeled studies, and lost continuity rather than in software logs alone.