You would not wait for a real fire to find out whether staff know where to go. Fire drills exist for that reason. Cyber incidents deserve the same treatment, yet many organizations have a written plan that no one has tried. A tabletop exercise is the simplest way to test it. It involves no computers, no outages and no special software, only a group of people talking through a realistic scenario.
You can run one in under two hours. Here is how.
It reveals gaps in your plan, such as missing phone numbers or unclear decision-makers
It builds familiarity, so people know their roles in a real event
It helps leaders understand what an incident would mean for care
It supports HIPAA contingency planning and security incident procedure requirements, which call for testing and revising plans
Insurers and CMS emergency preparedness expectations both favor regular exercises
Invite people who would be involved in a real event:
Administrator or executive director
Director of nursing and a charge nurse or unit manager
Privacy and security officers
IT lead or your managed provider's representative
HR and the business office
Maintenance or facilities, where relevant
Someone to take notes
Between six and twelve people is a manageable size. Appoint a facilitator who is not responsible for the answers, whose job is to present the scenario and keep time.
Introduction (10 minutes): explain that the goal is learning, not grading. No one will be blamed for gaps.
Scenario part one (25 minutes): present the first situation and discuss.
Scenario part two (25 minutes): add a development and discuss.
Scenario part three (25 minutes): add the final twist and discuss.
Debrief (25 minutes): list what worked, what did not and what to fix.
Wrap-up (10 minutes): assign owners and dates for each action item.
This is hypothetical and can be adjusted for your facility.
At 5:30 a.m. on a Saturday, the night nurse calls the on-call supervisor to say that the EHR will not load and several computers show a message demanding payment. Questions to discuss:
Who is called first? Do the people on this list have after-hours numbers available on paper?
What does the nurse do with the affected computers right now?
How does care continue? Where are the downtime forms and who authorizes their use?
By 7 a.m., IT reports that the file server and some workstations are encrypted, and the phone system is intermittent. A staff member says she clicked on an email link on Friday. Questions:
Who decides whether to shut down systems or isolate the network?
When do we contact our insurer, our EHR vendor and counsel?
Who speaks to staff, and what do we tell them?
How do we handle medication administration and orders in the meantime?
At noon, a local reporter calls, and a family member posts on social media that they cannot reach the facility. The attackers claim they have copied resident data and will publish it. Questions:
Who speaks to media and families, and what is said?
How do we determine what data was affected, and who does that analysis?
What are our HIPAA breach notification responsibilities and timelines?
Do we involve law enforcement, and who makes the call?
How would we decide about restoring from backups?
Where did we hesitate or disagree?
What information did we need that we did not have?
Were roles clear? Who was missing from the room?
Which contacts, documents or tools were out of date?
What would have worked better on paper than on screens?
Record each gap with an owner and a deadline. Typical outcomes include updating the contact list, printing downtime forms and storing them where staff can reach them, clarifying who can authorize system shutdowns, drafting family and staff communication templates and confirming backup restore times. Review progress at your next leadership meeting, and schedule the next exercise for six or twelve months later, using a different scenario such as a vendor outage or a lost laptop.
Save the attendance list, scenario, notes and action items. This documentation shows that you test your plan and revise it, which supports both HIPAA and emergency preparedness expectations.
An outside facilitator can keep discussion honest and bring experience from other organizations. UnityCare IT can facilitate tabletop exercises tailored to long-term care and clinic settings and help turn the findings into updated plans and checklists.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172