When a ransomware attack or major outage hits, one of the first things to go is how you normally talk. Email may be offline, the chat platform may share the same compromised accounts, and the phone system might run on the same network. Worse, if an attacker has access to your mailboxes, they may be reading your response plans as you send them.
The answer is out-of-band communication: channels that do not depend on your primary systems, set up before you need them. This post covers how to build that for a small or mid-size healthcare or senior-living organization.
Think about what a typical operator relies on every day: email, a team chat tool, VoIP desk phones, a shared drive with the contact list. If a single identity platform or network outage disrupts all of them, you lose coordination exactly when leadership, IT, clinical staff and vendors need it most.
There is also a security reason. During an incident involving compromised accounts, you should assume the attacker can see anything sent through those accounts. Discussing containment steps over the same email tenant is risky.
Aim for at least two alternates that use different providers and different log-ins from your main systems:
Personal mobile phones and text messaging for the first hour. Everyone already has them.
A separate group messaging app with its own accounts, set up for the response team only.
A conference bridge or video account hosted by a different provider than your primary collaboration tool.
A free or low-cost external email account used only for incident coordination, with multi-factor authentication turned on.
Test each one with the people who would actually use it. An app nobody has installed is not a plan.
A contact list kept only on the network is a contact list you cannot reach. Create one that includes:
Executive leadership, administrators and directors of nursing for each facility
IT staff and your managed service provider, with after-hours numbers
Your cyber insurance carrier's incident hotline and policy number
Legal counsel and any breach response firm named in your policy
Key vendors, such as your EHR provider, internet carrier and phone provider
Medical director and pharmacy contacts for downtime procedures
Regulators and law enforcement contacts you may need to notify
Include more than one phone number where possible, and note who is the backup when the primary is unavailable.
Store the list in several places that do not depend on your network: printed copies in a binder at each facility's nurse station and administrator's office, a copy in each leader's phone contacts, and a secured file in a cloud account separate from your daily one. Review it quarterly, since staff turnover will break it quietly.
Communication in a crisis is also about roles. Name in advance:
Incident lead who makes decisions and runs the bridge
Communications lead who updates staff, residents' families and external parties
Scribe who records times, decisions and actions
Agree on how often updates will go out, even if the update is that nothing has changed. Silence breeds rumor, particularly among care staff who need to know whether to switch to paper documentation.
Clinical teams need clear instructions that do not depend on email. Put a one-page downtime guide at each nurse station, with the phone numbers to call and how to reach someone in charge. Make sure the downtime procedure for medication administration and charting is part of your regular drills.
Add an out-of-band check to your regular tabletop exercises. Once or twice a year, run a drill in which you assume email and chat are unavailable and see how long it takes to reach everyone on the list. Fix whatever breaks, such as old numbers or people who forgot a password to the backup app.
UnityCare IT helps healthcare organizations write incident response plans and run tabletop exercises, including setting up and testing alternate communication channels so your team can coordinate when the usual tools cannot.
An outsourced IT department with proactive maintenance and one number to call.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172