Key topics covered in this article:

• Healthcare cybersecurity is a patient-care and business-continuity issue, not solely an IT or privacy issue.
• Recent disruptions show that cyber incidents can close clinics, cancel procedures, delay treatment, and force employees into manual workflows.
• HHS and CMS guidance increasingly connects cybersecurity with patient safety, emergency preparedness, communication planning, and testing.
• Leaders should define critical services, test downtime procedures, validate recovery priorities, address vendor dependencies, and exercise the response across departments.
• A companion readiness checklist turns the detailed questions into a practical, trackable download and a natural entry point for client discussions

Why healthcare leaders must connect cybersecurity, patient safety, emergency preparedness and continuity of care.

A healthcare organization can be compliant on paper and still be unable to deliver care when its systems go down.

Ransomware, cloud outages, vendor failures, power disruptions, and compromised medical devices can interrupt scheduling, registration, access to patient records, medication administration, diagnostics, billing and communication.

1. Healthcare leaders should be able to answer five questions:
2. Which patient care and business services must continue during an outage?
3. How long can each critical service operate without its supporting systems?
4. Can employees perform essential activities manually – and have they practiced?
5. Which vendors, interfaces, devices and infrastructure create critical dependencies?
6. In what order will systems be restored, and has that process been tested?

HIPAA compliance is an important part of the answer, but it is not the entire answer. Operational resilience requires healthcare organizations to connect cybersecurity, emergency preparedness, patient safety, vendor risk, incident response, and business continuity.

When a Cyber Incident Becomes a Patient-Care Event

Healthcare cybersecurity is often discussed in terms of privacy: Was patient information accessed? Does the incident constitute a reportable breach? Were HIPAA requirements met? Those questions matter, but clinicians and patients may face a more immediate concern: can care continue safely when the technology is unavailable?

In February 2026, a ransomware attack forced the University of Mississippi Medical Center to close approximately three dozen clinics and cancel elective procedures while employees reverted to manual operations. One patient reportedly traveled three hours for bloodwork and chemotherapy treatment only to find that the services were unavailable. The incident showed how quickly a cyberattack can affect access to care.

The Change Healthcare incident provided an industry-wide example. Its effects extended beyond a single organization because providers, pharmacies, payers, and patients depended on the same interconnected services. Operational risk extends beyond the systems an organization owns.

HIPAA Compliance Does Not Automatically Create Resilience

The HIPAA Security Rule requires Covered Entities and Business Associates to protect the confidentiality, integrity and availability of electronic protected health information. Its contingency-planning provisions address data backup, disaster recovery, emergency-mode operations, testing, and revision. OCR’s Ransomware and HIPAA guidance reinforces that organizations should plan for how they will respond to and recover from ransomware affecting ePHI.

Those requirements provide an important foundation. But a backup may exist without restoring fast enough for clinical operations. A downtime policy may be documented but unfamiliar to employees. An incident-response plan may address technical containment without explaining who can divert patients, suspend services or communicate with families.

The question is not only whether required documentation exists. It is whether the organization can operate safely when normal technology, communications or third-party services are unavailable.

Federal Guidance Is Connecting Cybersecurity With Emergency Preparedness

HHS’s healthcare-specific Cybersecurity Performance Goals are intended to help organizations prioritize practices that strengthen preparedness, resilience, and patient safety. The goals include incident planning, backup strategies, asset inventories, vulnerability management, and network segmentation. The HHS Cyber Gateway’s Hospital Resiliency Landscape Analysis reinforces the connection between cyber resilience, continuity of care and patient safety.

In 2026, HHS’s Administration for Strategic Preparedness and Response added a Cybersecurity Module to its RISC 2.0 resource. CMS emergency-preparedness guidance also centers on risk assessment and planning, policies and procedures, communication, and training and testing. CMS expressly includes interruptions in communications, including cyberattacks, among the conditions organizations should consider.

Five Areas Where Healthcare Organizations Commonly Fall Short

1. The Downtime Plan Is Too Narrow

Many plans focus on the EHR even though care also depends on identity systems, laboratory and imaging interfaces, pharmacy platforms, phones, printers, cloud applications, medical devices and outside providers. A plan that assumes these dependencies will remain available may fail when it is needed most.

Action: Map each critical service to the people, systems, information, facilities, communications and vendors required to operate it.

2. Recovery Priorities Have Not Been Defined by the Business

IT may know which systems are technically important, but clinical and operational leaders must determine which services need to return first. An application may be technically restored but unusable because authentication, connectivity, interfaces or required data remain unavailable.

Action: Establish business-approved downtime tolerances and recovery objectives, then confirm internal and vendor capabilities can meet them.

3. Manual Procedures Exist but Have Not Been Tested

A binder of downtime forms does not establish readiness. Employees may not know which forms to use, where they are stored, how orders and results will be communicated, or how downtime activity will be reconciled after recovery. A process that works for several hours may become unsafe over several days.

Action: Require employees to use the actual downtime procedures during exercises and test both short and extended outages.

4. Vendor Resilience Is Assumed

Healthcare organizations depend on EHR providers, managed service providers, cloud platforms, billing companies, laboratories, pharmacies and telecommunications providers. A signed agreement does not demonstrate that a critical vendor can recover within the timeframe the organization needs.

Action: Tier vendors by operational importance and validate recovery commitments, notification requirements, alternative communications, subcontractor dependencies and supporting evidence.

5. Cybersecurity and Emergency Preparedness Are Planned Separately

Cyber response may sit with IT, emergency operations with clinical, or facilities leadership, HIPAA with compliance, and vendor management with procurement or finance. During a serious disruption, these groups must operate as one team with clear decision authority and communication responsibilities.

Action: Conduct a cross-functional exercise that includes clinical, operational, technology, compliance, communications and executive leaders.

A Practical Approach for Smaller Healthcare Organizations

Smaller practices, surgery centers, long-term care providers and community healthcare organizations may not have dedicated cybersecurity, continuity and emergency-management teams. They do not need to recreate the capabilities of a major health system. They do need a practical plan proportionate to their operations and risks.

Start with the services that must continue to protect patients and sustain operations. Document their dependencies, create accessible downtime procedures, confirm responsibilities with the managed service provider and critical vendors, and conduct a focused tabletop exercise. Outside providers can supply technical support, but management should understand the plan, assign internal decision makers and verify that responsibilities are documented and tested.

Resilience is not measured by the size of the security budget. It is measured by whether the organization has identified its most important risks, taken reasonable steps to address them, and can act decisively during disruption.

What Preparedness Should Produce

Operational resilience should produce evidence that leadership can use, not simply another plan on a shelf. At a minimum, the organization should maintain a prioritized inventory of critical services, documented technology and vendor dependencies, approved downtime tolerances, current manual procedures, defined decision authority and a coordinated communication structure.

Preparedness should also be tested. Leadership should receive the results of backup restoration testing, downtime and cross-functional tabletop exercises, together with corrective actions, accountable owners, and target dates. Significant unresolved risks should be reported and formally evaluated rather than carried forward without explanation.

This documentation helps the organization demonstrate more than compliance. It shows that management understands how disruption could affect patient care and critical operations, has established realistic priorities and is actively addressing weaknesses before an incident occurs.

Questions Leadership and the Board Should Be Asking

1. Which services would create the greatest patient or operational impact if unavailable?
2. When did we last restore a critical system from backup?
3. Have clinical teams practiced extended downtime procedures?
4. Which vendors could stop or materially degrade our operations?
5. Can we communicate if normal systems are unavailable?
6. Do incident response, emergency preparedness and continuity plans work together?

Turn the Questions into Action

Utilize our Healthcare Operational Disruption Readiness Checklist (download below) to evaluate critical services, downtime procedures, recovery capabilities, vendor dependencies, communication, and testing. The checklist is designed to help leadership identify where answers are clear, where assumptions need to be validated, and where corrective action should begin.

If several responses are ‘no’ or ‘not sure,’ PBMares can facilitate a focused Healthcare Operational Resilience Assessment or tabletop exercise to identify gaps and prioritize practical next steps.

Final Thoughts

For healthcare organizations, a cyberattack can become a patient care, operational, financial, regulatory and reputational crisis within minutes. HIPAA compliance remains essential, but compliance alone does not establish that the organization can continue operating through an extended outage.

Prepared organizations know which services must continue, understand what those services depend on, practice operating without normal systems, and test whether recovery expectations are realistic. The question is whether the organization will be ready to protect patients and keep essential operations moving when disruption occurs.

You don’t need to wait for a disruption to evaluate your readiness. PBMares’ Cyber & Risk Advisory and Healthcare teams can help assess operational resilience, identify gaps in downtime planning and recovery capabilities, evaluate critical vendor dependencies, and prioritize practical improvements.  Contact your PBMares advisor, Partner Antonina McAvoy, or Partner Jonny Rosch to discuss your organization’s readiness to respond to and recover from operational disruption.