Healthcare Ransomware Tabletop Checklist: Decisions to Test Before Downtime

By Michael Messina

A healthcare ransomware tabletop exercise should test more than whether IT can restore a server. It should test how clinical, operational, communications, legal, security, vendor, and leadership teams make decisions while systems are unavailable and facts are incomplete.

This checklist is a planning aid for hospitals, health systems, clinics, EMS agencies, and healthcare partners preparing a discussion-based exercise. It is not a complete exercise package, legal advice, incident-response direction, or a substitute for your organization’s plans and professional obligations.

Testing a plan you have not written yet? Start with EHR Downtime Procedures: What to Put in Writing.

Before the Exercise

  • Define two to four exercise objectives that describe what the group should test.
  • Select a realistic scope. Decide which facilities, systems, services, vendors, and time period are affected.
  • Invite decision owners from clinical operations, nursing, medicine, EMS or transport, IT, cybersecurity, compliance or privacy, legal, communications, facilities, finance, supply chain, and executive leadership as applicable.
  • Identify an external facilitator or an internal facilitator who is not expected to solve every problem during play.
  • Choose evaluators and a method for recording decisions, assumptions, strengths, gaps, and corrective actions.
  • Set ground rules. This is a learning exercise, not a test of individual performance.

1. Detection and Initial Escalation

  1. What observable event tells the organization this is more than a routine outage?
  2. Who has authority to activate the incident structure, and what information do they need first?
  3. How are clinical and operational leaders notified if normal messaging or email is unavailable?
  4. What decisions must be recorded during the first 30 minutes, and where will that record be kept?

2. Patient Care and Downtime Operations

  1. Which clinical services can continue safely, which require modified workflows, and which may need to pause?
  2. How will staff access critical patient information, orders, results, medication records, and care instructions during downtime?
  3. What paper or manual processes are available, where are the materials stored, and who knows how to use them?
  4. What triggers diversion, transfer, cancellation, or a change in patient-flow decisions?

3. EMS, Partners, and External Coordination

  1. How will EMS, dispatch, receiving facilities, healthcare coalition partners, public health, and other response partners be notified?
  2. What information can be shared, by whom, and through which verified channels?
  3. If regional systems are also affected, how will patient distribution and resource requests be coordinated?
  4. Which vendors are essential to downtime operations or recovery, and how will they be reached if normal contact methods fail?

For an EMS-led system outage scenario, use the EMS Downtime Exercise Guide.

4. Communications, Privacy, and Leadership Decisions

  1. Who approves internal messages, patient or family communications, media statements, and partner notifications?
  2. How will the organization communicate without speculating about cause, scope, data exposure, or recovery time?
  3. Who coordinates legal, privacy, insurance, law-enforcement, and regulatory considerations under the organization’s applicable requirements?
  4. How will leadership compare patient-safety, operational, financial, reputational, and recovery tradeoffs as facts change?

5. Recovery and Restoration Priorities

  1. Which services and systems are restored first, and who approved that order before the incident?
  2. What evidence is required before a restored system is trusted for clinical or operational use?
  3. How will the organization reconcile paper records, delayed entries, medication information, orders, results, charges, and other transactions after systems return?
  4. What happens if the outage lasts 24 hours, 72 hours, or longer than existing downtime supplies and staffing assumptions support?

6. Improvement Planning

  1. Which decisions were delayed because ownership, authority, or information was unclear?
  2. Which workaround depended on one person, one vendor, one device, or an untested assumption?
  3. What corrective action will address each material gap, who owns it, and what is the target date?
  4. How will completed actions be verified and tested again?

What the Exercise Record Should Capture

  • Objective tested
  • Decision or action discussed
  • Plan, procedure, system, or role involved
  • Observed strength or gap
  • Operational consequence
  • Corrective action
  • Responsible owner
  • Target date and closure evidence

Use the Checklist Three Ways

Run it internally: Use the questions to structure a short planning discussion around your current plans and systems.

Use a ready-to-run package: FSL offers a ransomware tabletop exercise package for organizations that want facilitator and participant materials they can adapt and run themselves.

Home health agency? Write the downtime plan first.

The Home Health Downtime & Continuity Kit ($29 on Etsy) gives you an editable plan with an EHR downtime procedure, a 2-page ransomware and downtime checklist, and a continuity workbook, so the questions in section 2 have written answers before you run an exercise. See what’s inside.

Scope a custom exercise: If you need healthcare-specific objectives, scenario design, facilitation, evaluation, or AAR/IP development, review tabletop exercise consulting or discuss the project with Michael.

Primary Planning References