Strengthening Healthcare Operations Against Extended Cyber Outages
A large academic healthcare provider partnered with Arcova to enhance operational resilience and business continuity. They developed comprehensive strategies for extended cyber incidents, validated through exercises, resulting in a robust program that aligns business, clinical, and technology recovery needs, integrates emergency preparedness, and ensures continuous improvement.
Project Information
- Client: Academic Healthcare Provider
- Services: Operational Resilience & Business Continuity
- Areas of Expertise: Program Design/Governance, Business Impact Analysis (BIA), Operational Resilience Strategies, Business Continuity Plans (BCP), Exercising, DR Alignment
- Sector: Healthcare Provider / Higher Education
Challenge
A large academic healthcare provider system needed a consulting partner to help establish operational resilience and business continuity capabilities for their business and clinical operations. Although the organization believed they had strong downtime procedures in place for short-term disruptions, they were worried about the possibility of an extended outage caused by a ransomware attack or other type of longer-term cyber/technology incident that could disrupt operations for 30 days or more. Thus, they wanted to develop strategies and plans to extend the viability of downtime procedures for several weeks and integrate response and recovery procedures into business continuity and crisis management efforts.
Solution
Our efforts were focused on several areas, including understanding existing capabilities, determining and validating key requirements for resilience and continuity, documenting continuity strategies and plans for critical business or clinical operations, and building sustainable processes to keep resilience capabilities current and viable.
A core focus was on extending or developing downtime procedures to create viable continuity strategies and plans that could sustain an extended cyber outage for critical care and business operations. Additionally, we conducted tabletop exercises to validate the viability of defined strategies. We also conducted a high-level exercise for hospital leadership to validate decision-making strategies.
Impact
The resulting outcome for the client was a fully functional and implemented resilience program that aligned business, clinical, and technology recovery requirements. The program provided business continuity plans to address an extended cyber outage, and integrated related functions of emergency preparedness and incident response and established a sustainable and continuously improving program that can be monitored and measured through well-defined metrics and reporting processes.
Key Results
Enhanced Resilience Program
Successfully implemented a comprehensive resilience program aligning business, clinical, and technology recovery needs.
Extended Downtime Procedures
Developed viable continuity strategies and plans to sustain operations during extended cyber outages.
Validated Decision Making
Conducted high-level exercises for hospital leadership to ensure robust decision-making processes.
Continuous Improvement
Established a sustainable program monitored and measured through well-defined metrics and reporting processes.