Healthcare IT teams at hospitals, clinics, and insurers are turning to tabletop exercises more often as ransomware and data-breach risks intensify, because the drills expose how an organization would actually respond if attackers disrupted care today. Unlike vulnerability scans or penetration tests, which identify technical flaws, tabletop sessions test decision-making, communication, escalation, and recovery planning across IT, clinical, legal, and executive teams, according to guidance from CISA and the U.S. Department of Health and Human Services.
Context
In a tabletop exercise, a facilitator walks participants through a realistic scenario, such as ransomware encrypting an electronic health record system, a vendor outage, or a suspected data exfiltration event. Participants talk through actions step by step instead of responding to a live attack, which lets organizations see where their plans break down before patients are affected.
That matters in healthcare more than in many other sectors because downtime can interrupt medication orders, imaging, admissions, billing, and transfer workflows. IBM’s 2024 Cost of a Data Breach Report placed the average healthcare breach cost at $9.77 million, the highest of any industry, reflecting both recovery expenses and operational disruption.
What the exercises uncover
Tabletop drills often reveal weaknesses that do not appear in a scan report. A hospital may know its firewall is patched, yet still discover that no one can quickly confirm who has authority to isolate a network segment, declare an incident, or notify leadership after hours.
They also expose gaps in handoffs. During a real event, IT may expect clinical leaders to follow downtime procedures, while clinicians assume the help desk or vendor will restore access. The exercise can show that those instructions are outdated, hard to find, or unfamiliar to staff who have never practiced them.
Vendor dependence is another common issue. Many healthcare operations rely on managed service providers, cloud platforms, imaging systems, and electronic health record vendors, so a response plan must include contact paths, service-level expectations, and alternate workflows if one of those partners is unavailable. The HHS Office for Civil Rights has repeatedly tracked large breaches involving business associates, underscoring how third-party relationships can shape response and reporting.
Why the human factor matters
Cybersecurity reports consistently show that people and process failures amplify technical attacks. Verizon’s 2024 Data Breach Investigations Report said the human element played a role in 68% of breaches, a reminder that confusion, delay, and miscommunication can be as damaging as malware itself.
Tabletop exercises are designed to surface those human factors. A scenario may reveal that executives need clearer criteria for when to shut down systems, that legal teams need earlier input on notification obligations, or that public affairs staff need preapproved messaging before social media speculation fills the gap.
Experts say those lessons are especially important in healthcare because patient safety can be affected within minutes. If clinicians cannot verify orders, access allergy lists, or retrieve radiology images, the response is no longer just an IT issue. It becomes an operational and clinical risk that must be managed in real time.
Expert perspectives and data points
Federal guidance has increasingly emphasized exercises as part of cyber resilience. CISA and HHS both encourage organizations to rehearse incident response and continuity plans, not just write them down, because plans that look complete on paper often fail under stress.
Industry analysts also note that exercises become more valuable when they include the people who would actually make decisions during an incident: bedside clinicians, compliance officers, privacy counsel, communications teams, and vendors. When those groups participate together, organizations can test whether backup workflows are realistic and whether escalation paths are fast enough to matter.
Health systems are also using more advanced scenarios, including multi-day outages, insider threats, supply chain compromise, and attacks that target both data and devices. That broader approach reflects how attackers operate now: they often aim to disrupt care, pressure executives, and force quick decisions that create secondary problems such as delayed treatment or incomplete notification.
Implications for healthcare teams
For readers, the takeaway is that cyber resilience is not measured only by the number of vulnerabilities patched. It also depends on how well an organization can coordinate under pressure, keep essential services running, and communicate clearly when normal systems fail.
For healthcare leaders, that means tabletop exercises should be frequent, realistic, and inclusive. The most useful drills are the ones that challenge assumptions about backup access, recovery time, call trees, vendor roles, and who can make the final call when a cyber incident threatens patient care.
What to watch next: as ransomware and third-party incidents continue to drive disruption across healthcare, expect regulators, insurers, and boards to ask not only whether a hospital has an incident response plan, but whether it has practiced that plan well enough to use it in the middle of a real attack.
Frequently Asked Questions
How is a tabletop exercise different from a vulnerability scan or penetration test?
A vulnerability scan or penetration test looks for technical weaknesses in systems and networks. A tabletop exercise tests how people and processes would actually respond during an incident. It reveals whether decision-making, escalation paths, communication, downtime procedures, and recovery roles work under pressure, which technical testing alone cannot show.
Which people should be included in a healthcare tabletop exercise?
The most useful sessions include the teams that would make real decisions during an incident: IT, clinical leaders, compliance, privacy counsel, executive leadership, communications, and sometimes vendors or managed service providers. Including bedside staff and operations leaders is especially important because they can identify workflow failures that technical teams may miss.
Why focus on scenarios like vendor outages or data exfiltration, not just ransomware?
Ransomware is only one way care can be disrupted. Vendor outages can stop imaging, billing, or EHR access, and data exfiltration events trigger legal, notification, and reputational concerns even if systems stay online. Tabletop exercises help organizations prepare for the full range of incidents that can interrupt care or create regulatory obligations.
What are the most common weaknesses these exercises uncover in hospitals and clinics?
They often expose unclear authority, outdated contact lists, confusing handoffs between IT and clinical teams, and downtime procedures that staff have not actually practiced. Exercises also reveal dependence on third parties, weak after-hours escalation, and uncertainty about when to notify leadership, legal, or public affairs during a fast-moving event.
How do tabletop exercises improve patient safety, not just cyber preparedness?
In healthcare, delays in access to medication orders, allergies, imaging, or patient records can quickly affect treatment decisions. A tabletop exercise shows whether staff can continue critical workflows safely when systems are unavailable. That makes it a patient safety drill as much as a cybersecurity drill, especially during minutes that matter.