Why We're Here

What This Exercise Tests

Ground Rules

4-Hour Exercise Flow

Who Should Be In the Room

The Setting

The Threat Landscape

Module 01: Reconnaissance & Shared Vulnerabilities

Live Recon Sprint: What Can You Find in 15 Minutes?

The Weak Link Is Already Public

Do we know which of our members share a vendor or platform with each other right now, and would we know if that vendor were compromised?

If a smaller member noticed something odd on their system today, do they know who to call, and would that call reach the coalition?

Module 02: Cascading Impact & Coalition Communications

Comms Relay: Pass the Alert

One Vendor, Four Facilities, No Warning

When a member realizes something's wrong, what's the actual first call they make today, and does that path reach the coalition fast enough to warn everyone else?

What's our coalition's real method for pushing one alert to every member type at once, hospital, SNF, hospice, public health, and does it reach a person who can act on it, not just an inbox?

BREAK

Module 03: Regional Coordination Under Pressure

Day 2: Four Messages, One Region

Who speaks for the region right now, and how do we keep a hospice's message to grieving families consistent with a hospital's message to the press, without either one waiting on the other?

Is the coalition's role here resource broker, information hub, or both, and does everyone in this room actually agree on that answer today?

Module 04: Resiliency, Redundancy & EHR Downtime

Day 10: Who Actually Had a Backup

Which of our members could actually run a full clinical day on paper right now, for more than 72 hours, and which of us are assuming we could, without ever timing it?

Where does each member's backup actually live, and how many of us have verified it isn't one outage away from the same vendor or system it's supposed to protect?

Hotwash & After-Action Review

What Your Coalition Should Resolve

Thank You

EHR Down — Clinical Downtime Declared

Patient Implications

No EHR Access — Downtime Procedures

Clinical Decision-Making Under Downtime

Medication Safety & Reconciliation

Restoring the EHR — Clinical Readiness

Hospital Cyber Leadership — Unified Command

Risk, Legal & Regulatory (HIPAA / OCR)

Key Decisions: Diverts, Electives, Internal Disaster

Patient Safety & Standard of Care

Communications Strategy

Recovery & Continuity of Operations