Healthcare Ransomware Tabletop Exercise: EHR Down at 2 a.m.

A healthcare ransomware tabletop exercise rehearses what happens when a hospital loses its electronic health record, imaging and clinical systems to encryption, and every IT decision becomes a patient-safety decision. It tests downtime procedures, ambulance diversion, clinical workflows, HIPAA obligations and restoration priorities in one three-hour session.

This hospital cyberattack tabletop is built for a mixed group of executives, clinical operations leaders and legal. The technical story is familiar from the generic ransomware scenario; what changes is the stakes. Clinical content is kept deliberately general so that any acute hospital can adapt it to its own services and regional arrangements.

Scenario at a glance

Exercise objectives

1. Activate the hospital's incident command structure for a cyber event and integrate IT and clinical leadership in one command.
2. Implement EHR downtime procedures across the emergency department, inpatient units, pharmacy and laboratory, and identify gaps.
3. Make and document an ambulance diversion decision using clinical criteria and regional coordination arrangements.
4. Agree restoration priorities based on clinical criticality, with named clinical and IT owners.
5. Assess HIPAA breach notification obligations and coordinate with health authorities and law enforcement.
6. Deliver consistent communications to patients, families, staff and media.

Starting situation

Read this aloud to players:

You are a 350-bed regional hospital with an emergency department, two intensive care units, surgical theatres and an on-site laboratory and imaging service. The EHR, the imaging archive (PACS) and the laboratory system run in the hospital's own data centre.

It is Saturday, 02:10. Night staffing is in place: one IT engineer on site, a CISO and CIO on call, and an administrator on call from the executive team. The emergency department is busy; two ambulances are en route. Your last full downtime drill was four years ago.

Injects timeline

Module 1 — Detection and command (T+00:00 to T+00:45)

Inject 1. At 02:10, nurses on three wards call the service desk: EHR logins fail with a database error. The ED tracking board has frozen with the last patient added at 02:04. The on-site engineer restarts an application server without effect and calls the on-call IT manager.

Inject 2. Twenty minutes later, radiographers report that the imaging archive is unreachable, and the laboratory analysers can no longer send results to the EHR. The on-call engineer finds text files demanding payment on several servers. Database and interface services have been stopped on the affected servers, apparently deliberately.

Inject 3. The CISO joins the call: "We need to isolate the data centre network from the rest of the hospital and from the internet now. That takes down anything still working, including the medication dispensing interfaces. I need a decision from the administrator on call."

Discussion questions:

• Who tells the clinical leadership, and how quickly? Does the administrator on call know this is their decision?
• At what point do you activate hospital incident command? Who is the incident commander, and where does IT sit in the structure?
• What clinical systems are still working, and what will stop if you isolate the network? Who can answer that at 02:45?
• How are downtime procedures activated across the hospital at night? Where are the paper forms, and does everyone know?
• Which communication channels do you use if email and the internal directory are affected? See out-of-band communications.

Module 2 — Clinical operations in downtime (T+01:30 to T+06:00)

Inject 4. The ED lead calls command: "We have no access to prior records, radiologists cannot see images from the archive, and lab results are coming back by phone. I have two ambulances inbound and a possible stroke patient. Do we go on diversion?"

Inject 5. The pharmacy lead reports that the team is verifying orders from printed medication lists generated before the outage, which are now several hours old. The laboratory is phoning critical results to wards and logging them on paper. A nurse reports a near-miss: a dose was almost repeated because the previous administration was recorded in the EHR and not visible on paper.

Inject 6. The CIO reports that the attacker deleted the online backup snapshots. An offline copy exists but is four days old, and the most optimistic estimate for restoring the EHR is five to seven days. Imaging and lab could be restored earlier if they are prioritised.

Discussion questions:

• What criteria trigger diversion, who decides, and how is the regional system informed? Is diversion partial (for example, stroke and trauma only) or total?
• How do you protect patients already in the building? Which units are most exposed during downtime?
• How are medication administration, orders and results reconciled when the EHR returns? Who owns that plan?
• Who decides restoration priority: IT, clinical leadership or both? What order would you choose, and why?
• Is four days of data loss acceptable? What clinical information from those days exists only on paper or in people's heads?

Module 3 — Coordination, communication and obligations (T+10:00 to T+30:00)

Inject 7. The regional health authority asks how long diversion will last and whether you need to transfer patients. Two neighbouring hospitals report that their emergency departments are filling. A law enforcement agent returns your call and asks for indicators of compromise and whether you have been contacted by the attacker.

Inject 8. A local television crew is filming at the ED entrance and interviewing families who were told to go elsewhere. Staff are messaging managers asking what they can say to patients, and some are posting on social media.

Inject 9. Threat intelligence reports that the attacker has published a sample of files on its leak site, including discharge summaries and a spreadsheet of patient demographics. The privacy officer asks legal to start the HIPAA breach assessment and notification planning.

Discussion questions:

• Who is the single point of contact for the health authority, and how often do you update them? What information do neighbouring hospitals need?
• What do you share with law enforcement, and who approves it?
• Who approves the public statement? How do you reassure patients without overstating how quickly services will return?
• What do staff say to patients and families? Have you briefed them before the media did?
• Under the HIPAA Breach Notification Rule, individuals must be notified without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more residents of a state or jurisdiction also require notice to prominent media, and 500 or more require contemporaneous notice to HHS. Who owns that timeline, and when does the clock start?

Discussion questions

Consolidated themes for the hotwash:

• Command: Did IT and clinical leadership work in one command structure, or in parallel? Who made the decisions that mattered?
• Downtime readiness: Did paper procedures work as written? What was missing: forms, printers, staff familiarity, pre-printed patient lists?
• Patient safety: Where was the highest clinical risk, and was it identified by the right people early enough?
• Restoration priority: Is clinical criticality documented in the contingency plan, with realistic restore times? See recovery time objective.
• Obligations: Which notification clocks started, and who tracks them? For more on HIPAA exercise requirements, see the HIPAA tabletop exercise guide.

Curveballs / optional injects

Use one or two if the group is moving quickly:

• The blood bank system is also affected, and the lab cannot confirm compatibility electronically.
• The attacker contacts a patient directly, threatening to publish their records unless they pay.
• A medical device vendor asks to connect remotely to check whether its devices are affected.
• The CEO is abroad and wants to be consulted on every major decision by phone.

Facilitator notes

Expected decisions. A strong team activates hospital incident command within the first hour, with IT represented inside it rather than reporting from outside. It isolates the network with an explicit decision by the administrator on call, declares downtime across the hospital, and makes a documented diversion decision using clinical criteria and the regional process. Restoration priorities are agreed by clinical and IT leaders together, a reconciliation plan for the downtime period is assigned, and one person owns external coordination.

Common pitfalls.

• IT works the problem for an hour before clinical leadership is told.
• Downtime forms exist but nobody knows where they are, and the printers that produce patient lists depend on the encrypted systems.
• Restoration order is chosen by what is technically easiest rather than what is clinically most urgent.
• Diversion is treated as all-or-nothing, without considering partial diversion or transfers.
• The breach assessment is postponed until recovery, even though data theft is already visible.

On clinical realism. Keep clinical detail general and let your own clinicians fill it in. The aim is to test decisions and communication, not clinical knowledge. If you have a clinical safety officer, ask them to review the injects before the session and to play the role of a ward that raises safety concerns.

On regulatory detail. Use only what your compliance team confirms. The HIPAA Security Rule requires security incident procedures (§164.308(a)(6)) and a contingency plan (§164.308(a)(7)), and the Breach Notification Rule sets the deadlines quoted in Module 3. HHS 405(d) Health Industry Cybersecurity Practices is voluntary guidance that many hospitals use as a benchmark. The exercise is not legal advice.

Adapting the audience. For an executive session, summarise Module 1 in a short briefing and spend the time on injects 4, 6, 7 and 9. For a clinical operations session, expand Module 2 with unit-level downtime walkthroughs and the reconciliation process. You can run this scenario live with the exercise runner, which releases injects to players' phones and records decisions for the after-action report.

Evaluating the exercise

Related

• Ransomware tabletop scenario
• HIPAA tabletop exercise guide
• Data breach and regulatory notification scenario
• Executive tabletop exercises
• Glossary: incident commander, out-of-band communications, recovery time objective