All tabletop exercises
Ransomware·Advanced·Mixed audience
EHR ransomware forces a hospital to decide on ambulance diversion
The prompt — read this to the room
It is 02:40 on a Saturday at a 450-bed regional hospital. The night supervisor calls: the electronic health record is frozen, workstations on three wards show a ransom note, and the pharmacy dispensing system has dropped offline. The emergency department has 31 patients, two ambulances are ten minutes out, and the trauma surgeon on call wants to know whether to divert. Downtime procedures exist on paper, but nobody has run them for longer than four hours. The ransom note says patient data has already been copied. Who decides on diversion, and what do you tell the ambulance service right now?
Total duration
2 h 30 min
People to involve
7
Best fit
Healthcare
Who to involve
Most important first.
- CEO / Managing director
- CISO / Head of security
- CIO / CTO
- Incident response lead
- IT operations
- Legal counsel
- Communications / PR
What it tests
- Make and record an ambulance-diversion decision with clinical and technical input inside the first 30 minutes
- Run paper downtime procedures past the four-hour mark, including pharmacy, lab results and imaging
- Choose containment steps (segmentation, EHR shutdown) that do not cut off life-critical systems
- Start the HIPAA breach assessment and law-enforcement contact while recovery is under way
Outline of activities
- 1Night call: EHR frozen, ransom note, ambulances inbound
- 2Diversion and downtime decision under hospital incident command
- 3Containment versus clinical safety: what can be switched off
- 4Day two: extended downtime, staff fatigue and the data-theft claim
- 5Restoration order and return to normal operations
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…