Microsoft 365 Outage 2026: What Florida Physicians Must Do

On Thursday afternoon, a physician in Toronto, a GP in Gloucestershire and an administrator at a New Jersey health system all lost the same thing at roughly the same moment: the email account that their referrals, schedules and team messages ran through. The electronic health records kept working, and so did the phones. What failed was everything that connects one clinician to another, and that turned out to matter more than most of us would have guessed.

What happened

Microsoft 365 began failing early Thursday afternoon Eastern time, November 12. Microsoft opened its incident at about 1:26 p.m. ET, and by 1:30 p.m. Downdetector showed close to 150,000 Outlook reports from the United States and Canada combined. The failure started in Exchange Online, the service that runs Outlook email and calendars for most organizations on Microsoft 365, and spread to Teams, SharePoint, Copilot and Microsoft’s own Defender security tools. Problems were reported in at least 74 countries.

Microsoft has said the outage was not a cyberattack. Its explanation so far is that some servers unexpectedly went offline and the remaining servers were overwhelmed by the extra load. On Friday the company reported email backlogs approaching normal levels, although its service health page still listed Microsoft 365 as degraded and some users were still seeing delays. A full post-incident report has been promised, and practice administrators can follow incidents EX1550543 and MO1550821 in the Microsoft 365 admin center.

This is at least the third widespread Exchange Online disruption of 2026, after outages on January 22 and August 31. It also comes eight months after Iran-linked hackers turned Stryker’s own Microsoft management tools against it, in an attack the group claimed reached devices in 79 countries. That was an attack and this was not, but both showed how much of medicine now runs through a single vendor’s environment.

How it reached patients

The United Kingdom experienced the most clinical disruption. NHS England said local services were enacting long-standing measures for IT outages, including paper records where possible. The BBC reported anecdotal accounts of cancelled caesarean sections, because much of the NHS calendar lives in Microsoft diaries, and of hospitals accepting only urgent referrals. GP surgeries reported trouble processing prescription requests and sending referrals, and doctors warned of possible delays to urgent cancer referrals. The National Pharmacy Association said pharmacies had trouble reaching GP practices, and Bloomberg reported that the NHS had to reschedule some procedures.

In Canada, Unity Health Toronto, which runs St. Michael’s Hospital, declared a code grey, the alert hospitals use for a loss of infrastructure, and asked patients to call rather than email. In Australia, Queensland Health stood up its State Health Emergency Command Centre and reported no known clinical impact, but individual patients in Melbourne described scans being cancelled because referrals could not move by email or fax.

In the United States the effect was patchier. Becker’s Hospital Review reported email disruptions at Atlantic Health, ChristianaCare, University of Iowa Health Care, Jefferson Health, Michigan Medicine, Henry Ford Health and UTMB Health. Atlantic Health’s chief information and digital officer, Sunil Dadlani, said the impact went beyond email to patient care and the supply chain. ChristianaCare reported something every Florida practice should note, which is that faxes and pagers relying on email addresses failed as well. As of this writing, we have not seen a Florida hospital or health system publicly report clinical disruption.

In all three countries, emergency lines stayed up. The GMB union’s national secretary said life-threatening callouts in the UK appeared unaffected, while warning that 111 and 999 staff could not pass on patient details in the normal way.

Why it matters for Florida physicians

The lesson of this outage is that the clinical record is no longer the most fragile part of a practice. Most of us have downtime procedures for the EHR. Very few of us have one for the referral that arrives as an email attachment, the lab result that triggers an email notification, the pharmacy callback routed through a shared inbox, or the multifactor code that is sent to an Outlook account. Some Australian users ran into that last problem on Friday, when they could not log in to unrelated business software because their verification codes were delivered by email. We saw a smaller version of the same problem two weeks ago, when Quest Diagnostics took its Quanum portal offline after a breach and pointed practices that ordered through it to paper requisitions.

These failures rarely produce a dramatic headline. They produce a cancer referral that sits for three days, a critical result that nobody sees, or a prescription that is never reconciled, and that kind of harm tends to surface weeks later in a chart review or a deposition. It is the same loss of continuity I described in The Fragmented Patient, arriving this time through infrastructure rather than insurance networks.

The second risk outlasts the outage. When approved tools fail, staff under pressure tend to reach for whatever works: a personal Gmail account, a text thread, a consumer file-sharing link. Security experts quoted by Insurance Business called this workaround behavior the bigger concern, and for American covered entities it raises HIPAA questions even when the practice’s own systems were never breached. A consumer Gmail account does not come with a business associate agreement. Under the HIPAA Breach Notification Rule, an impermissible disclosure of protected health information is presumed to be a breach unless the practice documents a risk assessment showing a low probability that the information was compromised. Florida’s Information Protection Act adds its own 30-day notice clock for breaches affecting Florida residents, one of the state rules covered in our Florida scope of practice and medical regulation guide.

It would be easy to conclude from all this that practices should pull their email back onto their own servers, and that argument has real merit. Concentrating the communications of much of the English-speaking health care world on one vendor creates exactly the single point of failure we saw on Thursday, and an outage at a small regional host would not have taken down St. Michael’s and the NHS on the same afternoon. The counterargument is just as real. A three-physician practice running its own Exchange server is far more likely to suffer a ransomware attack or an unpatched vulnerability than Microsoft is to have another day like this one, and a self-managed server failure has no global incident team working on it. The sensible position is a hybrid option: keep primary email on a hardened cloud platform, and keep an independent backup channel for referrals and critical results that does not run through Microsoft.

What you can do

1. Ask your office manager one question on Monday. Did anyone send patient information to a personal email account, a personal phone or a consumer messaging app between Thursday afternoon and Friday? If the answer is yes, document it and complete the four-factor breach risk assessment now, while memories are fresh.
2. Map every workflow that depends on email. Include referrals in and out, lab and imaging result notifications, e-fax services that route to inboxes, pharmacy communication, scheduling and the delivery of multifactor authentication codes. Anything on that list needs a written fallback.
3. Move multifactor authentication off email. An authenticator app or a hardware key means an email outage will not also lock your staff out of the EHR, the clearinghouse or the bank.
4. Update your HIPAA contingency plan. The Security Rule already requires a data backup plan, a disaster recovery plan and an emergency mode operation plan. Add a printed phone list with direct numbers for your main referring practices, hospitals, labs and pharmacies, and keep it somewhere other than SharePoint. Most Florida practices already plan for hurricane downtime, as the offices reopening after Hurricane Isaias did last month, and an email outage deserves the same written plan.
5. Give staff an approved fallback before the next outage. If the practice has a secure messaging tool covered by a business associate agreement, tell everyone that it is the backup channel. Staff will improvise if you have not decided for them.
6. Call your hospital medical staff office. Ask how the hospital’s downtime procedures handle referrals and critical results for outside physicians, and whether anything sent to your practice on Thursday or Friday may not have arrived.

The bigger picture

Physicians did not choose to run medicine on a single company’s email servers. That decision was made gradually by IT departments, vendors and administrators, often for good reasons. When it fails, though, the consequence falls on the physician whose patient’s referral disappeared. Our profession should have a voice in how this infrastructure is built and in how much redundancy is enough, and that starts with every practice knowing which of its workflows would stop if email stopped tomorrow.

In June I wrote that the physicians who do best in this decade will be the antifragile ones, the ones who come out of each disruption stronger rather than merely intact. The same idea applies to the practice itself. A practice that uses this outage to map its dependencies will be in a better position the next time than it was on Thursday. Physicians who want a collective voice on questions like these can find one in The Atlas Accord, the physician-led alliance working to keep doctors leading the decisions that shape their practices.

Frequently Asked Questions

Was the November 2026 Microsoft outage a cyberattack?

Microsoft has said it found no evidence of malicious activity. The company attributes the outage to servers unexpectedly going offline and overloading the remaining infrastructure, and it has promised a full root-cause report.

Did the Microsoft outage affect Florida hospitals?

As of November 13, we have not seen a Florida hospital or health system publicly report clinical disruption. Florida practices that use Microsoft 365 for email were likely affected the same way as organizations elsewhere, losing email, Teams and calendar access for part of Thursday and Friday.

Is it a HIPAA violation if staff used personal email during the outage?

It can be. Sending protected health information to a personal account with no business associate agreement may be an impermissible disclosure, which HIPAA presumes to be a breach unless a documented risk assessment shows a low probability of compromise.

What should a Florida practice have in place for the next email outage?

At minimum, a written list of email-dependent workflows with a fallback for each, multifactor authentication that does not depend on email, a printed contact list for key referral partners, and an approved secure messaging backup covered by a business associate agreement.

This article was drafted with the assistance of AI writing tools, then reviewed, edited, and approved by Dr. Sean C. Orr, M.D., who holds full editorial responsibility for its content. Illustration created with AI image tools.

References

1. Insurance Business, “Hospitals, airlines and governments hit by Microsoft outage as employee risk warnings mount” (November 13, 2026). insurancebusinessmag.com
2. Insurance Business Canada, “Hospitals, Via Rail and governments hit as Microsoft outage spreads across Canada” (November 13, 2026). insurancebusinessmag.com
3. BleepingComputer, “Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide” (November 2026). bleepingcomputer.com
4. GeekWire, “Microsoft 365 starts to recover after a day of global email turmoil” (November 13, 2026). geekwire.com
5. Becker’s Hospital Review, “Microsoft outage disrupts health systems: 9 updates” (November 13, 2026). beckershospitalreview.com
6. Healthcare Leader, “Microsoft outage disrupts NHS email services” (November 13, 2026). healthcareleadernews.com
7. Helsinki Times, “Microsoft outage disrupts services across 74 countries,” summarizing BBC reporting (November 13, 2026). helsinkitimes.fi
8. Bloomberg, “NHS Reschedules Procedures, Test Results After Microsoft Outage” (November 13, 2026). bloomberg.com
9. AOL (PA Media), “Microsoft outage hits hospitals, GPs, schools and police across UK” (November 13, 2026). aol.co.uk
10. CTV News, “Microsoft outage impacting hospitals, universities and Via Rail services” (November 13, 2026). ctvnews.ca
11. ABC News (Australia), “How the global Microsoft Outlook outage affects Australians” (November 13, 2026). abc.net.au
12. ABC News (Australia), “Microsoft outage hits users worldwide, affecting Teams, Outlook and Copilot” (November 13, 2026). abc.net.au
13. TechCrunch, “Microsoft 365 hit by outage, preventing access to emails and files” (January 22, 2026). techcrunch.com
14. Santa Fe College, “SF affected by Microsoft Outlook outage” (August 31, 2026). sfcollege.edu
15. U.S. Department of Health and Human Services, Breach Notification Rule. hhs.gov
16. 45 CFR 164.308(a)(7), HIPAA Security Rule contingency plan standard. ecfr.gov
17. Florida Statutes, section 501.171, Security of confidential personal information. flsenate.gov