Perspective
Keep Treating Patients Through a Ransomware Outage: A Plan That Clinical Leaders Own and Rehearse
A restoration plan answers IT's question. Hospitals also need a rehearsed answer to how care continues without systems for weeks, owned by clinical leadership and covering suppliers.
4-minute read5 November 2026
In Brief
- When the hospital information system is unavailable, the question at the bedside is what happens to each patient tonight. Plans written by IT alone rarely answer it, and the outage can start at a supplier.
- We see four actions: plan on weeks, give the plan a clinical owner, rehearse one night on one ward, and extend the plan to the suppliers your hospital depends on.
- Thinqmesh ranks the systems and services you can least afford to lose, reviews access, and rehearses your incident response with your team. A ranked, costed plan takes four weeks.
Hospital ransomware plans are often written by IT, and they answer IT's question, which is how quickly systems can be restored. The question at the bedside is different. What happens to the patient in bed fourteen at two in the morning, with no record, no pharmacy system and no way of seeing a laboratory result?
Continuity Is a Clinical Programme
Restoration is a technical task and continuity is a clinical one. The second needs an owner in medical leadership, a plan written for weeks and not days, and a rehearsal by the people who work the night shift. It has to reach beyond your own network too, because the outage a hospital meets may begin at a supplier it depends on.
We rank the data, systems and services that would cause most harm if lost, leaked or stopped, tighten access, and then walk your team through a realistic scenario. The result is a plan that states who decides, who speaks and what happens first, and that has been practised before it is needed.
Four Actions That Keep Care Running When Systems Cannot
Each one involves clinical staff as well as IT, because the plan is judged at the bedside.
Plan on the Assumption of Weeks
A rebuild takes longer than a restart, and the plan should say what happens until it ends.
Write the downtime plan for an outage that lasts weeks, covering paper records, medicine charts, laboratory requests, imaging and discharge. A plan built for a day or two will be tested well beyond its design.
Get started
- Ask each ward lead what they would do on day three of an outage.
- List the forms and supplies that day three would need.
Give the Plan a Clinical Owner
Medical leadership owns continuity. IT owns restoration.
Name a senior clinician as the owner, with authority to decide what care is deferred, what is redirected and what must continue. When that role is clear, decisions at two in the morning do not wait for a meeting.
Get started
- Name one clinical owner and one deputy.
- Write down who decides on diverting patients.
Rehearse One Night on One Ward
A single night, with the hospital information system switched off, shows more than a document review.
Choose one ward and run its night shift on the downtime process. Record what staff could not find, what they improvised and what slowed them. The first rehearsal exposes the gaps while there is time to close them.
Get started
- Choose a ward and a date for a supervised night drill.
- Agree what the observer records.
Include the Suppliers You Cannot Do Without
A hosted record system, an outsourced laboratory and a remote imaging service each sit outside your walls.
List the suppliers whose failure would reach patient care, and ask each what happens to you if they are unavailable. Add their failure to the rehearsal scenario, so that the plan covers an outage that begins somewhere else.
Get started
- List your five most critical outside services.
- Ask each for its recovery arrangements in writing.
How Thinqmesh Solves This
Security spending delivers most when it follows what you can least afford to lose. We begin with that ranking, and each later stage is directed by it.
- Week 1
What Matters Most
We establish which data, systems and processes matter most to the hospital. That ranking directs each later stage.
- Week 2
Access and Exposure
We review who can reach what, and where the organisation is exposed, against that ranking.
- Week 3
Risk in Business Terms
Findings are ranked by business impact, so that leadership can see what each risk could cost and decide accordingly.
- Week 4
A Costed Plan
You receive the risk assessment and a costed plan to close the gaps, in the order that matters most.
You finish with a ranked risk assessment, a costed plan, and an incident response plan your team has rehearsed, so it is clear who decides, who speaks and what happens first.
