A health system can have a detailed downtime plan and still face a surprisingly local question: what happens at this clinic, with this team, when its technology stops working?
The enterprise plan may name recovery priorities and response leaders. A site manager also needs to know which number works after hours, where approved instructions can be found without the shared drive, and who confirms that the location is ready to resume normal operations.
That local view deserves its own review. ASPR TRACIE’s healthcare cybersecurity preparedness guidance specifically calls for collaboration between enterprise and facility teams, including off-campus and ancillary services in response planning.
Source: ASPR TRACIE healthcare cybersecurity preparedness guidance ↗
Start with the work at each location
Choose a few important workflows with the people who perform them: receiving calls, managing appointments, or completing registration. Record the technology each depends on and who owns it.
A service inventory answers what a location has. This exercise asks what the location needs to accomplish and which dependencies could interrupt it.
Keep the scope practical. The first discussion can focus on one workflow at one location. Include the site lead, IT, and relevant operational owners. Clinical workflows and decisions belong with the organization’s authorized clinical and continuity teams.
Check the hours, not just the contact
Consider a hypothetical clinic open until 8 p.m. Its escalation sheet names a support desk staffed until 5. The name and number are accurate; the route for the last three hours still needs verifying.
Compare operating hours with actual support arrangements. Confirm the escalation route when the first contact is unavailable, who coordinates a problem spanning providers, and who gives local staff updates.
ASPR TRACIE’s guidance includes off-hours contacts, secondary contacts, and access to response information when normal systems are unavailable. Put those details where the local team can use them under the organization’s security policies.
Make the approved fallback reachable
“We have a procedure” should lead to a second question: can the people on shift find and follow it under the conditions it covers?
The SAFER Contingency Planning Guide addresses staff preparation, downtime communications, and recovery procedures. It also emphasizes clinical participation in planning.
Source: SAFER Contingency Planning Guide ↗
For a site-level review, confirm where approved instructions are kept, how staff access them if the usual system is unavailable, and who can authorize a change in operating status. Record unresolved questions for the appropriate owners. A technology worksheet supports the organization’s existing continuity processes; it does not establish clinical procedures or determine regulatory compliance.
Ask for evidence from this location
A useful discussion ends with something more specific than “covered by the enterprise plan.”
Ask when the location last participated in an approved exercise, which workflows were reviewed, what gaps emerged, and whether corrective actions were completed. A tabletop discussion can expose unanswered questions without interrupting live services. Any technical testing should follow the organization’s approved process.
Keep a short record: workflow, dependency, responsible owner, approved fallback reference, last verification, and next action. Use system and role information rather than patient details.
Make the next improvement small enough to finish
Choose one location and one unresolved dependency. Assign an owner and a date to verify it. Then use what you learn to improve the next site’s review.
For organizations coordinating technology across healthcare facilities, consistency comes from asking dependable questions while preserving important local differences.
The value of a downtime plan is clearest when the people at a particular location can explain what it means for their next decision.
