Connor Walsh, CISO at Siemens Healthineers; Ron Mehring, CISO and VP of Technology & Security at Texas Health Resources; and Phil Truesdale, CISO at the Mayo Clinic, discussed preparation for cyberattacks that could disrupt healthcare services.

The exercise, facilitated by the Disaster Recovery Institute International (DRI), simulated an attack that began with a software patch issue and spread across a fictional healthcare ecosystem, affecting operations, patient information and connections between providers.

The scenario underscored how a disruption at one organization or service provider can trigger cascading problems throughout the healthcare system.

“Cyber safety is patient safety,” said Greg Garcia, highlighting how attacks affect clinical operations and patient outcomes.

Panelists said healthcare organizations must recognize that what initially appears to be a routine technology outage can develop into a cybersecurity incident. Effective response requires IT, cybersecurity, executive leadership, legal and compliance teams, and clinical staff to work together.

Phil Truesdale emphasized the need to activate multiple response processes in parallel, including security incident response, crisis management, business continuity, and patient safety measures.

Leaders also stressed the importance of identifying critical applications and understanding how services depend on one another before an incident occurs. Without that preparation, organizations may struggle to determine which systems to restore first when resources are limited.

Ron Mering said organizations need clear procedures for contacting vendors, assigning responsibility, and escalating urgent requests.

Panelists cautioned against automatically disconnecting third-party services during an incident. Although isolating systems can reduce risk, unnecessary disconnections may create additional disruptions. Organizations should establish criteria in advance for when to suspend connections and how to restore services safely.

The exercise highlighted the importance of collaboration among healthcare providers, medical technology manufacturers, cloud service providers and other third parties.

Walsh said organizations should regularly practice vendor communications and understand where single points of failure could affect multiple services.

Participants also emphasized sharing information through organizations such as the Health Information Sharing and Analysis Center (Health-ISAC), along with coordinating with incident response specialists and law enforcement when appropriate.

Because healthcare systems operate within local communities, panelists said regional communication is also essential to help neighboring providers understand potential disruptions and prepare for impacts on patient services.

A central theme was the need to maintain a minimum level of essential operations during a prolonged outage. Restoring a system technically does not necessarily mean it is ready to support safe clinical care.

Healthcare organizations should identify critical services, map dependencies, test downtime procedures, and prepare staff to continue operations when digital systems are unavailable. Panelists recommended visiting clinical teams to understand how care is delivered and what alternatives would be needed if key technology failed.

The discussion also raised concerns about growing reliance on artificial intelligence tools, including ambient documentation systems. If clinicians become dependent on automated tools, switching to paper-based processes during an outage could become increasingly difficult.

The HSCC Cybersecurity Working Group said it provides free guidance to help healthcare organizations improve operational continuity, coordinate incident response and support executive decision-making.

The panel’s message was clear: preparing for cyberattacks requires more than technical defenses. Healthcare organizations must rehearse cross-functional responses, understand their vendor dependencies, and ensure they can continue delivering safe patient care when critical systems fail.