Close

New Research from CDW Explores AI and Cybersecurity

Learn how AI is helping IT teams manage risk and improve resilience.

Sep 22 2026
Security

Clinical Care Resilience Planning Is Not a Passive Act

Downtime can happen for any reason, from severe weather to an unexpected IT outage. Whatever the case, healthcare providers must be prepared.

Downtime in a hospital can happen for a number of reasons: Sometimes, it’s scheduled, and care teams received enough warning to plan for it. Other times, it can be an unplanned IT outage or an actual system disruption from a cyberattack, a third-party dependency being unavailable or a natural disaster.

Whatever the case, healthcare organizations must be prepared to stay operational during downtime. Otherwise, they could face serious patient care and financial setbacks that can shutter entire facilities

Clinical care resilience must therefore be as active and deeply ingrained as any other policy that supports uninterrupted care delivery. It can’t be emergency planning kept in a binder, dusted off annually to meet compliance checks. It can’t be limited to discussions and roleplay. Tabletop exercises don’t account for stress.

When I served as a healthcare CIO, I once let my leadership team know we were going to need to take the electronic health record (EHR) system offline for 72 hours for maintenance. Of course, I received immediate pushback. But it caught their attention: If our organization couldn’t survive three days without its most critical application, how could we provide care for a longer downtime? The answer should not only be applied throughout a health system but should also have department-specific approaches.

DISCOVER: Ensure healthcare business continuity when IT fails.

Clinical Care Resilience Starts With a Thorough Assessment

Healthcare IT should work as seamlessly as any utility, like electricity: It’s expected to work without much thought. Unfortunately, with today’s changing cyberthreat environment and other operational uncertainties, organizations must be more willing to think about what happens when things don’t work quite as expected.

At CDW, we offer a free tool that healthcare organizations can use to review every clinical and business unit — from primary care and the emergency department to the pharmacy and billings department — that asks how long each team can provide its necessary clinical or business function without any technology. These are nontechnical conversations that allow us to understand downtime in real terms that affect how a nurse, a billing specialist or a pharmacist can (or cannot) do their jobs when a critical application or device doesn’t work.

It’s also important to plan differently for downtime duration. Instead of framing it as “what do we do when a system is down” it needs to be considered in two parts: the duration and its specific impact. Downtime that happens for an hour in the pharmacy department has different implications than downtime that happens for four hours or across shifts.

Even fractional downtime has its own considerations. If the pharmacy has PCs that are offline, even though the EHR system remains functional, the orders that clinicians are putting in may not be going through, which can have a negative impact and could have snowballing operational consequences. That’s why reviewing plans for each department and aligning them to organizational policy will help improve overall resilience.

Click on the banner below to learn more about how IT leaders are tackling newer cyber risks.

 

Realistic Simulations Should be Used To Prepare for Healthcare Crises

In the aviation industry, pilots regularly test emergency scenarios in a physical simulator, working through what happens when autopilot disengages or screens go dark. They can replicate a potential situation and start building a bit of muscle memory around it.

Healthcare organizations should start taking a similar approach, moving away from tabletop exercises that are limited to discussions in a conference room and introducing a simulated environment that will better prepare hospital staff for crises.

And training should not be limited to a small sample of scenarios. What if downtime happens during a shift change? How is information coordinated as one team replaces another? Every department should be tested.

The Importance of Dependency Mapping in Healthcare for Resilience

Modern healthcare organizations not only have their internal teams to oversee, they’re likely working with multiple vendors and relying on a number of outside services, whether it’s third-party payroll applications or a cloud environment. That means a sizeable chunk of their ecosystem is not under their direct control, which is where dependency mapping can help.

Organizations that understand all of the relationships and connecting points that go into clinical workflows will improve their approach to resilience because then they know before an emergency what their safe minimum practice is. Dependency mapping identifies the people, devices, applications and vendors that each clinical function relies on:

  • People – What happens when you don’t have the right number of nurses to work a shift because there’s a hurricane? What’s the limit for a lean staff that can still keep a unit safe?
  • Devices and applications – If a majority of workstations go down on a unit, could a single operating workstation still meet the demands of care? If an EHR system goes offline for radiology, can imaging still be accessed locally? What is a minimal application set?
  • Vendors – If a formulary lookup tool is offline, can a unit still operate safely?

There's a major difference between a hidden dependency during a crisis that an organization wasn’t aware of ahead of time versus a plan for working with that limitation.

GET EXPERT INSIGHTS: Reduce the business impact of downtime and maintain positive patient outcomes.

Going Beyond System Restoration and Prioritizing Recovery Validation

One of the most consequential gaps in clinical care resilience planning is treating system restoration as the finish line. Having a system available again is not in itself a clinical release criterion. Recovery validation is just as important to safe patient care, and it’s not as simple as turning to a backup system and continuing work.

For instance, before teams can resume work within an EHR system that was offline, has data been properly reconciled? If medications were noted manually on a scratch pad, was that data moved to the EHR system once it was back up? Is information flowing freely between multiple systems again? Data reconciliation and interface validation are often overlooked processes.

As cyberthreats continue to evolve — especially with the rapid evolution of artificial intelligence — and natural disasters become more severe, clinical care resilience is critical for healthcare organizations to build. Operational disruptions are not only a financial risk but a patient safety one, so organizations must adapt their downtime procedures to changing expectations.

This article is part of HealthTech’s MonITor blog series featuring analysis and recommendations from CDW experts.

MonITor_logo_sized.jpg

FS Productions/Getty Images