Can patient services continue during a cyber incident?

A patient pathway reveals dependencies a system list can miss

Consider a hypothetical outpatient clinic group. Its patient management application becomes unavailable, but telephone service remains operational. The clinic has paper forms and assumes it can continue its usual appointment load.

A walkthrough reveals additional dependencies: staff need a reliable way to match each person to the correct record, distinguish recent from older information, handle outstanding investigations and reconcile documents created during downtime. The forms provide a recording medium; they do not resolve these questions by themselves.

This example does not establish that paper workflows are unsafe. It shows why a fallback must be assessed as an operating process with staffing, information and handoff requirements. Its acceptable scope may be narrower than normal service, and that scope should be explicit before an incident.

Define what acceptable continuity means

Select one service such as outpatient registration through consultation and follow-up. The clinical lead should identify information or functions whose absence could change the service decision. Operations should identify staff, facilities and partner dependencies. Technology should describe availability and data-recovery options.

Distinguish system availability from information trust. A database may be accessible while some records are incomplete or under investigation. Conversely, a core application might be unavailable while a separately protected, approved information source remains usable. The appropriate clinical response depends on the information's scope, currency and reliability.

Record the approved operating boundary in language staff can apply. State which activities may proceed, who authorises exceptions, how uncertainty is escalated and when the service must be restricted. This report does not prescribe those clinical boundaries; it proposes how to make their ownership and evidence visible.

Five questions that should shape the review

The review should document areas it did not examine. Testing registration does not establish that diagnostic ordering or result acknowledgement works. A group-level policy does not prove that every site has the same equipment, staffing or contact routes.

Extend supplier assurance to the service boundary

For hosted systems, ask the vendor to explain recovery responsibilities, data retrieval and the operating assumptions behind its recovery claims. Determine what the clinic must provide, such as authorised contacts, administrative access or integration support.

A vendor's platform test may not include the clinic's local network, devices or partner interfaces. Mark that boundary in the evidence record. Where the vendor's restored system requires local configuration or reconciliation, include those tasks in the provider's readiness plan.

The same principle applies to outsourced support. If the response plan depends on one support engineer or one communication channel, exercise an alternative contact route. Do not assume that a contract's existence establishes availability during the chosen scenario.

Exercise the transitions

A useful exercise tests three transitions: entering downtime, operating within approved limits and returning to normal. Each transition introduces decisions that a backup restoration test can miss.

At activation, observe whether staff recognise the trigger, find the current plan and identify who is in charge. During restricted operation, observe how work is recorded, protected and handed over. At restoration, observe how staff distinguish pending, completed and uncertain activities.

Use synthetic patient information in a controlled setting. The exercise should not interrupt live care or encourage staff to improvise unapproved clinical workarounds. If the provider cannot safely test a technical step, record it as untested and use a simulation or walkthrough with a narrower assurance claim.

Include a representative handover. A process that works when its designer is present may be difficult for another shift or site to follow. Record unclear instructions as findings to improve, rather than individual staff failures.

Measure service performance and remaining work

Report what the exercise demonstrated: activities completed, operating capacity under the scenario, time to activate the fallback, unresolved information and time or effort required to reconcile records. Explain the exercise conditions so management can judge transferability.

Keep recovery time and data recovery point separate. A system might return quickly using an older copy of information. Whether that result supports a patient service depends on the clinical significance of the missing period and the ability to reconstruct work. Clinical acceptance should be based on that context.

Avoid universal recovery promises. Different services have different dependencies, and a small clinic's viable fallback may differ from a specialist centre's. Targets should be approved locally and supported by observations, not borrowed without testing from another provider.