For most of Friday 13 November, Australian hospitals lost Outlook, Teams and much of the Microsoft 365 suite. The outage began at around 3.15 am AEDT and, for many organisations, lasted the entire working day. Microsoft has attributed it to elevated load on its infrastructure following a network capacity upgrade, has apologised, and has promised a post-incident report.
The official response from health services was reassuringly consistent. Canberra Health Services reported no impact to the delivery of clinical care. Queensland Health reported no known clinical impacts. The Australian Medical Association described administrative and clerical problems, but not harm to patients.
I have no reason to doubt any of those statements. They are, however, statements about what was known on the day. That is a different thing.
The paradox
There is an uncomfortable observation to make first. For many clinicians, Friday was a reasonably good day. Meetings were cancelled, dashboards went blank and the inbox stopped growing. Theatre lists ran, ward rounds happened and patients were cared for, largely because core clinical systems run on other platforms.
Measured productivity collapsed. Clinical work continued.
It is worth asking what that says about how much of the modern hospital week is spent servicing the administrative machine rather than patients.
That said, the paradox only holds up to a point.
The arteries run through the admin layer
The distinction between clinical and administrative systems is neater on an organisational chart than in practice. A referral is a clinical act that travels by email. Results, discharge summaries and GP correspondence move along the same channels.
At Canberra Health Services, voicemail and faxes converted to email were also affected. The old fallback had, in other words, been routed through the new single point of failure. Some facilities reverted to paper prescriptions because multifactor authentication for prescribing software depended on Microsoft-supported email. In Melbourne, a patient reported that her scans were cancelled because neither she nor her clinic could access referrals sent by email or fax.
None of this appears in an incident register on the day. Delayed referrals, unsent results and missed follow-up surface weeks later, if they surface at all. "No known impact" is therefore a description of what has been measured, rather than of what has happened.
We have been here before
In September 2019, a ransomware attack on hospitals in the South West Alliance of Rural Health and the Gippsland Health Alliance, including Barwon Health in Geelong, forced a return to paper-based systems. Some elective surgery and outpatient appointments were cancelled. Shared IT infrastructure appears to have helped it spread, and some staff were still without email in November. Months earlier, the Victorian Auditor-General had reported that Barwon Health was not proactive enough on cyber security.
In July 2024, the CrowdStrike failure sent Western Health back to paper-based patient records.
The causes differ – a criminal attack, a faulty vendor update, a cloud capacity failure. The pattern does not. Concentrated digital infrastructure, manual alternatives that are improvised rather than rehearsed, and reassurance that precedes assessment.
Accountability
Microsoft is responsible for the reliability of its services. Health service boards are responsible for the decision to route clinical communication through a single provider without a tested alternative. That second risk belongs on the organisational risk register, rather than buried within an IT contract.
The Commonwealth activated its digital resilience agreement with Microsoft on Friday, and the Australian Computer Society has renewed calls for a review of critical systems that depend on a single provider. Health should be part of that review.
What should change
First, every health service should map the clinical pathways that depend on Microsoft 365: referrals, results, fax-to-email, voicemail, prescriber authentication, rosters and on-call lists.
Second, authentication for prescribing and clinical systems should not depend on email.
Third, downtime procedures should be rehearsed, not merely documented. A realistic test is an unannounced Friday morning without email or Teams.
Fourth, health services should conduct a clinical look-back over the coming weeks, auditing delayed referrals, results and imaging.
Finally, resilience funding should protect the clinical arteries first. Meetings and reporting can wait. Referrals cannot.
Friday was an unplanned audit, and a useful one. The question is whether, this time, anyone acts on the findings.
Sources
- ABC News: live coverage of the Microsoft outage, 13 November 2026
- ABC News: How the global Microsoft Outlook outage affects Australians
- ABC News: Microsoft 'deeply sorry' for outage, 14 November 2026
- Canberra Health Services: Microsoft outage affecting email and voice messages
- pharmaphorum: Microsoft outage disrupting healthcare
- Stockpil: Microsoft outage drags into second day (Australian costs, ACS comments)
- GovInfoSecurity: Australian medical facilities hit by ransomware (2019)
- Geelong Advertiser: An ailing system? (2019)
- inkl: CrowdStrike outage, Australian hospitals including Western Health (2024)
The views in this commentary are my own and do not represent Alfred Health, ANZCA or any other organisation with which I am associated.