Hospital Cyberattack Tabletop Exercise: 7 Critical Decisions Leadership Must Practice

When a hospital's electronic health record goes offline during a cyberattack, the incident stops being just an IT problem. It becomes an organization-wide patient safety and leadership challenge.

Imagine it's 9:15 on a Tuesday morning.

Your hospital's IT security team identifies suspicious activity across several systems. Access to the electronic health record (EHR) becomes unreliable. The pharmacy reports problems verifying medication orders. Laboratory results aren't reaching clinicians through normal channels.

Your cybersecurity team recommends isolating affected systems.

But who actually has the authority to make that decision?

Who determines whether patient care can safely continue? Who communicates with clinical departments? And what happens when leadership cannot access its normal email or paging systems?

These are exactly the kinds of questions a hospital cyberattack tabletop exercise should help leadership teams work through before an actual emergency.

Why hospital cybersecurity exercises must go beyond IT

Hospitals are uniquely vulnerable to the operational consequences of cyber incidents because digital systems support nearly every aspect of patient care.

An EHR outage can affect medication administration, patient identification, laboratory reporting, clinical documentation, patient transfers and communication between departments.

The U.S. Department of Health and Human Services identifies incident planning and preparedness as an essential healthcare cybersecurity performance goal. Its guidance emphasizes organizational readiness, response and recovery.

Explore the HHS Healthcare Cybersecurity Performance Goals.

Technical cybersecurity exercises are important. But hospital executives, clinical leaders, emergency managers and patient safety personnel also need opportunities to practice making difficult decisions together.

A well-designed tabletop exercise helps reveal where those responsibilities intersect—and where assumptions may not match reality.

Seven critical decisions every hospital should exercise

1. Who has the authority to disconnect critical systems?

Your cybersecurity team identifies a potential ransomware attack and recommends immediately isolating several network segments.

Unfortunately, some of those systems support clinical operations.

Does the CISO have unilateral authority to isolate them? Must the chief medical officer approve? Does the hospital incident commander make the decision?

What happens if the designated decision-maker is unavailable?

Exercise discussion: Identify who recommends, who approves, who implements and who must be notified. Document alternates and emergency decision thresholds.

2. When should the hospital activate its incident command structure?

A cyber incident may begin as a technical problem but quickly escalate into an operational emergency.

At what point should hospital incident command activate?

Consider whether your organization has clearly defined triggers for:

• Widespread EHR downtime.

• Loss of essential communications.

• Significant disruption to clinical services.

• Potential patient safety consequences.

• Extended system recovery timelines.

The important question isn't simply whether the hospital has an incident command plan. It's whether leadership knows when to activate it and how cyber response integrates with clinical operations.

3. Can clinical teams safely operate without the EHR?

Paper downtime procedures may exist, but having them in a binder is different from being prepared to use them.

During a cyberattack, clinicians may need alternative methods to document treatment, identify patients, reconcile medications and communicate critical results.

Consider these questions:

• Are current downtime forms available in every affected department?

• How will pharmacy staff verify medication histories and orders?

• How will clinicians receive and acknowledge critical laboratory results?

• How will staff reconcile paper records when electronic systems return?

Exercise discussion: Ask clinical leaders to walk through a realistic patient-care scenario without assuming electronic systems will be restored quickly.

4. What happens when normal communications fail?

Hospitals depend on interconnected communications systems.

Email, internal messaging, paging and other communication tools may share infrastructure affected by a cyber incident.

An effective healthcare ransomware tabletop exercise should challenge participants to identify alternative communication methods.

Who contacts department leaders? How are urgent clinical updates distributed? Can the hospital communicate with EMS, regional healthcare partners and public health agencies?

Exercise discussion: Require participants to identify communication methods that do not depend on the compromised systems, and determine how those methods would be activated.

5. Who decides whether patient services should be reduced or redirected?

Cyber incidents can affect a hospital's ability to safely maintain normal operations.

Leadership may need to consider postponing elective procedures, limiting certain services, coordinating transfers or requesting regional support.

These decisions involve clinical judgment, operational capacity, patient safety and external coordination.

Who recommends a change in service capacity? Who approves it? How are EMS and receiving facilities notified?

Exercise discussion: Present a scenario in which technical recovery is uncertain and clinical departments report increasing operational strain.

Ask leaders to establish decision thresholds rather than relying on assumptions.

6. Who manages public communication and required notifications?

A cyberattack can quickly generate questions from patients, employees, regulators, vendors and the media.

However, the organization may not initially know the full scope of the incident or whether protected information was compromised.

Leadership needs a coordinated process for factual communication while legal, privacy and compliance personnel evaluate applicable notification obligations.

The exercise should identify who approves public statements, who maintains the incident timeline and who assigns regulatory and contractual reviews.

Exercise discussion: Ask participants to prepare an initial factual holding statement without speculating about the cause, impact or recovery timeline.

7. Who decides when systems are safe to restore?

Restoring a hospital system isn't simply a matter of bringing a server back online.

Technical teams may determine that a system is available, while clinical teams still need to verify that workflows, patient records and interfaces are safe to use.

Leadership should establish joint technical and clinical restoration criteria.

Consider:

• What evidence supports a restoration decision?

• Who approves the return to normal workflows?

• How will paper documentation be reconciled?

• What conditions would trigger a rollback?

• Who communicates the transition to clinical departments?

Exercise discussion: Present a technically restored system with unresolved clinical workflow concerns. Require participants to agree on the decision process before proceeding.

How to run a hospital cyberattack tabletop exercise

An effective exercise doesn't require a large conference, complicated simulation or outside facilitator.

Start by bringing together the people responsible for the decisions being tested.

Depending on your organization, participants might include hospital administration, emergency preparedness, clinical leadership, IT, cybersecurity, pharmacy, patient safety, communications and legal or compliance representatives.

A practical exercise follows five steps:

Step 1: Define the objectives. Identify the decisions, coordination processes and continuity procedures you want to examine.

Step 2: Present a realistic scenario. Begin with a fictional cyber incident that creates operational uncertainty and competing priorities.

Step 3: Introduce new information. Use timed scenario updates to challenge assumptions and require participants to reconsider earlier decisions.

Step 4: Capture decisions and gaps. Record unclear authorities, missing procedures, communication dependencies and unresolved questions.

Step 5: Assign improvements. Turn observations into specific corrective actions with responsible owners and target completion dates.

FEMA's Homeland Security Exercise and Evaluation Program (HSEEP) provides a recognized approach to exercise design, evaluation and improvement planning.

Learn more about HSEEP exercise principles.

A tabletop discussion can identify preparedness gaps, but it cannot by itself demonstrate that an organization can perform every required action during a real incident. Operational validation requires additional testing and exercises.

A ready-to-run hospital cyberattack exercise package

Building a coordinated exercise from scratch takes time.

The scenario must be written, leadership roles identified, discussion questions developed, facilitator materials prepared and improvement tracking established.

That's why Response-Depot developed the Hospital Cyberattack: Executive Crisis Decision Exercise System.

View the Hospital Cyberattack Exercise System

This downloadable package provides a structured, fictional hospital ransomware scenario with coordinated materials designed to help an internal facilitator lead a productive executive discussion.

What's included?

• A master facilitator guide with scripts and delivery agendas.

• Three exercise options: 60, 120 or 180 minutes.

• An executive player handbook and 15 individual role handouts.

• Matching coach guides with discussion prompts.

• Five core scenario updates and five optional extended injects.

• A 23-slide editable PowerPoint presentation.

• Decision worksheets and an executive evaluation dashboard.

• Editable After-Action Report and improvement planning templates.

• An Excel corrective-action tracker with a summary dashboard.

• Decision authority, communications, downtime and recovery planning tools.

The materials are designed for approximately 6–15 participants, with a facilitator and recorder. Optional coaches and an evaluator can support larger or more detailed sessions.

No outside facilitator is required. The package provides scripts, instructions and coordinated exercise materials. Your organization's clinical, technical and legal personnel supply the local expertise needed to evaluate decisions.

Choose the exercise format that fits your leadership team

The package is editable and reusable internally by the purchasing organization, allowing hospitals to adapt the exercise to their own departments, facilities and leadership structures.

Complete exercise system: $249, one-time purchase.

Explore the Hospital Cyberattack Exercise System

Turn the discussion into measurable improvement

The real value of an exercise comes after participants leave the room.

If an exercise identifies unclear shutdown authority, someone should be assigned to resolve it.

If clinical departments lack reliable downtime communication procedures, those gaps should become tracked corrective actions.

If leadership cannot agree on restoration criteria, the organization should develop and review those criteria before a real emergency.

A useful improvement plan answers four questions:

1. What needs to change?

2. Who owns the corrective action?

3. When should it be completed?

4. How will completion be verified?

Hospital cybersecurity preparedness is not exclusively a technical responsibility.

It's a shared leadership responsibility involving patient safety, emergency management, clinical operations, technology and organizational continuity.

The best time to discover a gap in decision authority is during an exercise—not while patient care systems are unavailable.

Explore Response-Depot's Hospital Cyberattack: Executive Crisis Decision Exercise System and give your leadership team a structured opportunity to work through these decisions before a real incident.

View the Hospital Cyberattack Exercise System

*This product is a discussion-based preparedness exercise, not a penetration test, clinical protocol or compliance certification. It has not yet been field-tested with hospital professionals.