Most facilities that have an incident response plan have never tried it. A document on a shelf says who calls whom, but nobody knows whether the phone numbers work, whether the downtime forms are where they should be or who has authority to take the EHR offline. A tabletop exercise is a simple, low-cost way to find out.
A tabletop is a discussion, not a technical drill. Leaders sit around a table, walk through a made-up scenario and talk about what they would do. No systems are touched, and no one is graded. The value comes from the gaps you discover.
Aim for six to ten people:
Administrator or executive director
Director of nursing
Privacy or compliance officer
Business office manager
Maintenance or environmental services lead
A representative from your IT provider
Medical director, if available
HR or marketing lead, who may handle communications
Choose a facilitator who will keep time and ask questions. It may be someone from IT or compliance, but they should not be the only voice.
This is a safe space. The goal is to learn.
Use real names and roles.
Stick to the information the facilitator provides as the scenario unfolds.
Write down gaps, assumptions and questions.
Here is an example, which is hypothetical. Adapt it to your facility.
It is a Saturday at 5:30 a.m. The night nurse reports that the charting computers are showing a message demanding payment, and she cannot open files. Another aide says the phones seem to be down too.
Explain the purpose and rules, and read the scenario.
Discussion questions:
Who does the nurse call first? Does she have the number?
Who decides to disconnect computers or shut down systems?
Who contacts IT, and how, if phones and email are down?
Who is in charge of the response?
What should staff do and avoid doing right now?
Facilitator adds: Ninety minutes later, the EHR is still unavailable, and the morning medication pass is due.
Where are the downtime forms, and are they current?
How will nurses know the latest medication orders?
How will physicians and pharmacies be reached?
How are residents and families kept informed?
What happens with admissions, discharges and transfers?
Facilitator adds: IT reports that backups may have been affected, and there are signs that data was copied.
Who do we notify: the cyber insurer, counsel, law enforcement, HHS, state agencies?
Who owns the HIPAA breach analysis, and what are the deadlines?
Who speaks for the facility, and what do we tell families, staff and media?
Who makes decisions about paying a ransom or not, and what information is needed?
How do we preserve evidence?
What must be restored first, and who decides?
How long can we operate on paper?
What would we change if this were real?
What are the top three actions to take after today?
During the discussion, a scribe writes down gaps in a simple table: issue, owner, due date. Common findings include:
Contact lists that are outdated or stored only on the network
Unclear authority for emergency decisions
Missing or old downtime forms
No one who knows the cyber insurance policy terms
Backups with unknown restore times
Staff who would not know whom to call
No communications plan for families
Within a week:
Circulate a short summary.
Assign owners and dates to each action.
Update the incident response plan.
Fix easy issues immediately, such as updating phone numbers and printing forms.
Schedule the next exercise, with a different scenario, in six to twelve months.
Keep notes and attendance records as evidence of testing for compliance and insurance purposes.
A lost laptop with resident information
A fake invoice that leads to a fraudulent payment
A vendor reports a breach affecting your data
A long power outage combined with an internet failure
A former employee who still has access
UnityCare IT can facilitate a tabletop for your leadership team, bring realistic scenarios for healthcare and help turn the findings into a practical plan. Contact us if you would like help running your first one.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034