Hospital Cyberattack: Executive Crisis Decision Exercise System

A complete hospital cyberattack exercise your leadership team can run without hiring an outside facilitator.

When the electronic health record goes down, leadership decisions reach far beyond IT. Who can isolate systems? How will clinical teams verify medications and receive critical results? What evidence is required before care workflows resume?

Hospital Cyberattack: Executive Crisis Decision Exercise System gives your team a structured, fictional scenario and a clear path from the opening briefing to an actionable improvement plan. Choose a 60-minute executive briefing, a 120-minute standard tabletop or a 180-minute extended session.

Designed around the decisions hospitals face

• Incident recognition, activation and delegated decision authority.
• EHR downtime, paper forms, patient identification and clinical handoffs.
• Medication reconciliation, pharmacy verification and critical-result acknowledgement.
• Out-of-band communication, service capacity and regional coordination.
• Factual public messages and assigned legal and contractual notification reviews.
• Joint technical and clinical restoration criteria, record reconciliation and rollback triggers.

What is included

• A 3-page quick start, preparation checklist, planning checklist and file index.
• A 14-page master facilitator guide with actual scripts and exact delivery agendas.
• Five facilitator phase cards, a scenario control guide and troubleshooting support.
• An executive player handbook, 15 individual player handouts and 15 matching coach guides.
• Five core scenario updates and five optional extended-session injects, with controlled release instructions.
• Decision and observation worksheets, an evaluator guide and a one-page executive dashboard.
• A 23-slide editable PowerPoint with private speaker notes and a slide PDF.
• An editable AAR template with a worked example, leadership brief and 15-minute hotwash guide.
• An Excel improvement tracker with dropdowns, filters, overdue indicators and a summary dashboard.
• Decision authority, dependency, downtime, communications, recovery and 30/60/90-day follow-up tools.

Who it is for

Hospital emergency preparedness directors, clinical leaders, IT and cybersecurity leaders, patient safety teams and executive sponsors. Adaptation guidance supports community hospitals, larger medical centers and multihospital systems. Plan for approximately 6–15 participants, a facilitator and a recorder. Coaches and a separate evaluator are optional.

More than a blank tabletop template

The scenario, scripts, role questions, injects, evaluation cues and follow-up tools are already written and coordinated. Your facilitator chooses a delivery route, assigns functions and leads the discussion. Player materials remain separate from controlled coaching information.

Preparation and formats

The default scenario includes a 30-minute facilitator preparation checklist after scheduling and role selection. Local customization, legal review and meeting logistics take additional time. The 60-minute route concentrates on three decisions; the longer formats cover all five phases.

Download an organized ZIP containing editable DOCX documents with print PDFs, PPTX slides with a PDF version, and an XLSX tracker. Use desktop Microsoft Word, PowerPoint and Excel or compatible software. No macros, subscriptions or software installation are required for the package itself. Test compatibility before distributing edited files.

Frequently asked questions

Does the facilitator need cybersecurity expertise?
No. The guide supports an executive discussion. Local clinical, technical and legal staff supply organization-specific expertise and authority.

Can we combine roles?
Yes. Smaller organizations can combine functions while explicitly identifying recommendations, approvals and alternates.

Can we reuse and edit it?
Yes. The purchasing organization may edit, print and reuse it internally across its facilities. Resale, public redistribution and transfer to other organizations are prohibited. See the included license.

Is this a technical penetration test or a clinical protocol?
No. It is a discussion exercise about leadership decisions and continuity. It does not direct actual system changes or patient treatment.

Does it certify compliance or operational readiness?
No. Evaluation and improvement planning use HSEEP principles, with official regulatory references for local review. Discussion does not demonstrate operational capability. The package has not been field-tested with hospital professionals.

Is anything shipped?
No. This is a digital exercise package. The download is intended for your organization’s planning team, which distributes the appropriate player files.