Does HIPAA require tabletop exercises?

Not by name. The Security Rule requires security incident procedures and a contingency plan, and includes testing and revision of contingency plans as an addressable implementation specification at 45 CFR 164.308(a)(7)(ii)(D). Addressable means you implement it if reasonable and appropriate, or document why not and what you do instead. A documented tabletop is a common, practical way to meet that expectation for the people and process side of the plan.

What are the HIPAA breach notification deadlines?

Under the Breach Notification Rule, covered entities notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets, and breaches affecting 500 or more individuals require notice to HHS at the same time as individuals. Smaller breaches are logged and reported to HHS annually.

Who should attend a healthcare tabletop exercise?

The security officer and privacy officer, IT and clinical systems leads, clinical and nursing leadership, legal or compliance, communications, and an operations or executive decision-maker. Add health information management, biomedical engineering if devices are in scope, and contacts at key business associates such as the EHR host or billing provider. Clinical leaders are essential because downtime decisions are patient-safety decisions.

How long should HIPAA exercise documentation be kept?

The Security Rule requires policies, procedures and required documentation of actions, activities and assessments to be retained for six years from the date of creation or the date when last in effect, whichever is later. Treat the exercise plan, attendance, after-action report and improvement plan as part of that documentation and retain them accordingly.

HIPAA Tabletop Exercise: A Guide for Healthcare Teams

A HIPAA tabletop exercise is a facilitated discussion in which a healthcare organisation's clinical, privacy, security, IT and leadership teams talk through a simulated incident, such as ransomware taking the EHR offline, to test their security incident procedures, contingency plan and breach notification process without touching live systems.

HIPAA does not use the word "tabletop". It does require security incident procedures, a contingency plan and, as an addressable specification, periodic testing and revision of that plan. A well-run exercise, properly documented, is one of the most practical ways to meet those expectations and to feed real findings into your risk analysis.

Note: This article summarises parts of the HIPAA Security and Breach Notification Rules for exercise design. It is not legal advice; confirm your obligations with qualified counsel.

What the Security Rule says

Three parts of the administrative safeguards at 45 CFR §164.308 shape a HIPAA exercise.

Security incident procedures: §164.308(a)(6)

Covered entities and business associates must implement policies and procedures to address security incidents. The required implementation specification, response and reporting, covers identifying and responding to suspected or known security incidents, mitigating harmful effects to the extent practicable, and documenting incidents and their outcomes. A tabletop tests whether the people named in those procedures can actually carry them out together.

Contingency plan: §164.308(a)(7)

The contingency plan standard covers responding to emergencies that damage systems containing electronic protected health information (ePHI). It has five implementation specifications:

Specification	Status	What a tabletop can test
(A) Data backup plan	Required	Whether people know what is backed up, where, and who can initiate a restore
(B) Disaster recovery plan	Required	Whether restoration priorities and decision owners are clear
(C) Emergency mode operation plan	Required	Whether clinical operations can continue safely on downtime procedures while protecting ePHI
(D) Testing and revision procedures	Addressable	The exercise itself is the test; the after-action report drives the revision
(E) Applications and data criticality analysis	Addressable	Whether the criticality ranking survives contact with clinical reality

"Addressable" does not mean optional. Under §164.306(d), you assess whether the specification is reasonable and appropriate for your environment. If it is, you implement it. If it is not, you document why and implement an equivalent alternative measure if that is reasonable and appropriate. Few organisations can credibly argue that testing their contingency plan is unreasonable.

Risk analysis and evaluation

The risk analysis required under §164.308(a)(1)(ii)(A) is meant to be an accurate and thorough assessment of risks to ePHI. The evaluation standard at §164.308(a)(8) requires periodic technical and non-technical evaluation of how well your security policies and procedures meet the rule. Exercise findings are useful inputs to both: they show where a documented control depends on a person, a phone number or a system that would not be available in a real incident.

Separately, the 2021 amendment to the HITECH Act directs HHS to consider whether a regulated entity had recognised security practices in place for the previous 12 months when making certain enforcement decisions. The HHS 405(d) Health Industry Cybersecurity Practices (HICP) publication is one voluntary source of such practices, and incident response is among the practices it covers. Documented exercises help you show those practices were real and ongoing.

HHS has also proposed changes to the Security Rule. Proposals are not law; check the current status of any rulemaking before changing your programme on the basis of it.

Breach notification timelines to rehearse

Most healthcare exercises should include a breach assessment, because an impermissible acquisition, access, use or disclosure of PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the information has been compromised. The Breach Notification Rule then sets these timelines for breaches of unsecured PHI:

Who is notified	When	Trigger
Affected individuals	Without unreasonable delay, no later than 60 calendar days after discovery	Any breach of unsecured PHI
Prominent media outlets	Same timeline as individuals	More than 500 residents of a state or jurisdiction affected
HHS	Contemporaneously with notice to individuals	500 or more individuals affected
HHS	Within 60 days after the end of the calendar year	Fewer than 500 individuals affected (logged and reported annually)
Covered entity (by a business associate)	Without unreasonable delay, no later than 60 days after discovery	Breach at the business associate

Note that 60 days is an outer limit, not a target. An exercise that lets the team relax because "we have two months" has missed the point. State breach laws and contracts may add their own requirements; if you operate across jurisdictions, include them in your notification matrix. The data breach notification scenario shows how to run several regulatory clocks in parallel.

Who should attend

Healthcare incidents cross the boundary between IT and patient care faster than in almost any other sector. The attendee list has to reflect that.

Role	Why they are needed
Security officer	Owns security incident procedures and the technical response
Privacy officer	Owns the breach risk assessment and notification decisions
Clinical leadership (CMO, CNO or delegates)	Decides on diversion, downtime procedures and patient-safety trade-offs
IT and clinical applications leads	Know EHR, PACS, lab and pharmacy dependencies and restore order
Legal and compliance	Interpret notification duties, contracts and law-enforcement contact
Communications	Patients, staff, media and community messaging
Operations or executive decision-maker	Authorises spending, diversion and external support
Health information management	Knows where PHI lives and how records are handled during downtime
Business associate contacts	EHR host, billing, IT managed services: their response time is part of yours
Biomedical engineering (if in scope)	Connected medical devices and their isolation

Keep the room to around 10 to 15 players. If the list is longer, run a technical session and a leadership session rather than one crowded exercise.

Three healthcare scenario ideas

Choose a scenario that tests a plan you actually have, not the most dramatic one you can imagine.

1. Ransomware takes down the EHR

Encryption spreads across clinical systems overnight. The emergency department moves to paper, lab results are delayed, and an extortion note threatens to publish patient data. This tests emergency mode operations, restoration priorities, diversion decisions and breach assessment together. A full, ready-to-run version is the healthcare ransomware tabletop.

2. Breach at a business associate

Your billing or transcription provider tells you, days after the fact, that an attacker accessed a system containing your patients' data. You have limited information, a vendor who is managing their own crisis, and a clock that may already be running. This tests business associate agreements, the privacy officer's risk assessment and who communicates with patients. The third-party vendor breach scenario can be adapted with healthcare-specific injects.

3. Lost or stolen device with PHI

A clinician's laptop or a USB drive with patient records goes missing. Whether it was encrypted determines whether the PHI was "unsecured", which changes the entire notification picture. This is a good first exercise for smaller practices and tests asset inventory, encryption evidence and the four-factor risk assessment. See the lost laptop data breach scenario.

Designing injects for healthcare

A few principles make healthcare injects realistic:

Put patient impact in every module. "The EHR is down" means little. "Two patients in the ED need medication reconciliation and pharmacy cannot see allergy records" forces a decision.
Test downtime procedures, not just their existence. Ask who has the latest downtime forms, where the read-only census printout is, and how orders placed on paper get reconciled after recovery.
Make the breach question arrive early. The privacy officer should start the risk assessment while IT is still containing, not after.
Include the business associate. Have a white cell member play the vendor, including slow answers and incomplete information.
Use realistic clocks. Compress time between modules and state where the 60-day outer limit stands.

The guide to designing tabletop injects covers structure and timing in detail. If you want to run the exercise on players' phones instead of paper handouts, the site's live exercise runner releases injects, collects decisions and exports the after-action report, which also simplifies the documentation below.

How the exercise supports your risk analysis

The biggest mistake healthcare organisations make is treating the tabletop as a standalone compliance event. It is more valuable as an input to the risk management process.

Before the exercise, pick objectives from your current risk analysis. If the analysis rates EHR unavailability as high risk, test the controls that are supposed to reduce it.
During the exercise, have the scribe tag each gap against the relevant risk or control.
After the exercise, update the risk analysis where the exercise showed a control is weaker than assumed, and add remediation to the risk management plan.
At the next evaluation, cite the exercise and the closed findings as evidence that procedures were tested and revised.

That loop is what turns a meeting into evidence of an ongoing security management process.

Documentation checklist

HIPAA requires documentation of required actions, activities and assessments to be retained for six years from creation or from the date it was last in effect, whichever is later. For each exercise, keep:

Mark exercise reports as confidential. They describe exactly where your defences are weakest.

How often to exercise

The Security Rule speaks of periodic testing and evaluation without fixing a frequency. A defensible baseline for most organisations is at least one documented exercise a year covering the contingency plan and breach response, plus an extra exercise after major changes: a new EHR, a merger or affiliation, a new critical business associate, or a real incident. Larger systems often rotate scenarios across hospitals and departments through the year. The tabletop exercise compliance requirements page compares HIPAA with other frameworks your organisation may also answer to.