Operational continuity when a cyber incident disrupts hospital systems.

Ransomware response requires security containment and uninterrupted care operations to work together. Hospitals should establish an approved continuity model before an incident, including clinical priorities, command structure, alternative communication and recovery ownership.

Readiness priorities

• Define who can activate downtime procedures and communicate the operating status.
• Identify essential clinical, operational and revenue workflows by department.
• Validate authorised local access, approved devices and paper fallback procedures.
• Practice escalation, documentation, handoffs and recovery through drills.
• Conduct a structured after-action review following each event or exercise.

Review security considerations · Plan a downtime drill