CISA.GOV CTEP · SECTOR RESILIENCE
A phishing campaign and vendor activity precede radiology delays, orphaned accounts, corrupted records, unsafe medical-device behavior, ransomware, direct patient extortion, legal claims, and loss of public confidence.
EXERCISE PURPOSE
Phishing-enabled compromise affecting medical devices, patient records, PHI, clinical operations, and safety
DECISION PRESSURE
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
Who has authority when cyber containment conflicts with immediate patient care?
Which clinical services can continue safely on downtime procedures?
How are suspect records or device outputs identified and communicated?
When is ransomware activity presumed to involve PHI?
What clinical, technical, and legal evidence is required before systems return to care?
INSIDE THE EXERCISE
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
CISA, the FBI, and HHS HC3 warn of increased attacks on healthcare organizations using phishing, ransomware, remote hacking, DDoS, and data exfiltration.
Employees receive a message appearing to come from the MSP about a new HR system. The link requests portal credentials and returns a 404 page. Some employees also enable macros in an attached document.
Manufacturer updates for patient monitors are downloaded from the manufacturer’s website and installed without reported issues.
A third-party EMR vendor arrives without notice and says it must patch a new vulnerability affecting workstations, imaging, radiology, bedside monitors, and other clinical devices.
Radiology reports that an MRI workstation locks up, patient data loads slowly, and retrieving images now takes extraordinary time. Appointments are more than two hours behind.
A system administrator discovers and disables active accounts belonging to IT employees who left during the prior 12 months.
Nurses report incorrect medication, diagnosis, and personal information in patient records.
PARTICIPANTS
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
REAL-WORLD INCIDENTS
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
The UK National Audit Office documented widespread NHS disruption and later reported approximately 19,000 cancelled appointments.
Change Healthcare cyberattack↗UnitedHealth later estimated that approximately 190 million people were affected, alongside prolonged payment, claims, and care-delivery disruption.
Ascension network interruption↗Ascension reported interrupted access to systems during a cyber event, offering a concrete basis for clinical downtime and communications injects.
LEGAL, REGULATORY & STANDARDS LENS
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
The source collection for CISA Tabletop Exercise Packages covering ransomware, insider threats, phishing, supply-chain compromise, and sector incidents.
HHS HIPAA Security Rule guidance↗Covered entities and business associates must address security incidents and periodically evaluate safeguards.
HHS HIPAA audit protocol↗The protocol expressly examines incident response and periodic testing and revision of contingency plans.
HHS ransomware and HIPAA fact sheet↗A practical source for exercising breach presumptions, documentation, mitigation, and notice analysis.
PRACTITIONER PERSPECTIVES
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
EXPECTED OUTPUT