Healthcare Business Continuity Planning Guide: Backup, Ransomware & Recovery

Understanding the Unique Risks in Healthcare

While the principles of business continuity are generally the same regardless of industry, healthcare business continuity stands apart in several ways. When a healthcare facility experiences data loss or other disasters, the downtime affects more than just the “business.” It also affects:

• Patients: If a facility experiences an emergency and hasn’t planned properly, patient care might be disrupted or delayed, which can have serious long-term effects.
• Patient data: Cyberattacks and data breaches can expose sensitive health and identifying information to unauthorized parties, creating the risk of identity theft.
• Legal liabilities: If a loss in care puts patients’ health at risk, the facility may face accusations of negligence.
• Regulatory liabilities: Facilities that are found to be noncompliant with federal laws like the Health Insurance Portability and Accountability Act (HIPAA) can be hit with huge fines—on top of all the other losses caused by the disruption.

The importance of healthcare business continuity planning cannot be overstated. Every facility—whether it’s a small-town doctor’s office or a sprawling regional hospital system—must have a comprehensive plan for disaster prevention and recovery.

Potential Continuity Disruptions for Healthcare Organizations

Healthcare facilities face a wide range of risks that can interrupt operations, take critical systems offline, and limit the ability to care for patients. When developing a business continuity strategy, it’s important to consider all potential disruptions, including:

• Power, water & utility outages
• IT system failure
• Natural disasters such as earthquakes, hurricanes and fires
• Widespread staff illnesses
• Supply chain disruptions
• Cyberattacks, including data loss from malware and ransomware

While a single organization is unlikely to experience multiple emergencies on a regular basis, evaluating each type of threat and how it would affect your facility is an essential step. Knowing the risks you face empowers you to adequately prepare, which, in turn, shortens recovery times and significantly reduces financial losses.

The Threat of Ransomware in Healthcare

While hospitals and other healthcare providers face a variety of threats, ransomware has become particularly disruptive and dangerous. In recent years, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (HHS), has issued  about the risk of ransomware attacks against the healthcare industry. Let’s dig into the details of how ransomware affects healthcare business continuity.

Frequency and Severity

Healthcare organizations are under regular siege by cyberattackers. Data breaches have been on an upward trajectory for several years, particularly in cases involving large quantities of patient information. In 2023, U.S. healthcare organizations saw 745 large-scale data breaches – a figure that has tripled over the past decade.

Recent Statistics

A 2024 report from Sophos revealed that two-thirds of healthcare organizations were hit by ransomware in the previous year.

Ransomware is not only becoming more frequent but also more disruptive. Sophos’s statistics revealed that:

• In 2024, 27% of attacks involving data encryption also involved data exfiltration, meaning that attackers stole the data in addition to locking it.
• The average ransomware demand was $342,000 (while the actual ransom paid by healthcare organizations was $150,000).
• 48% of healthcare organizations took more than a week to recover from the ransomware attacks.
• 33% of respondents said that exploited vulnerabilities were the leading root cause of the attacks, followed by malicious emails and credential-based attacks.

These statistics underscore the importance of healthcare business continuity planning, which integrates prevention and recovery strategies that can reduce the likelihood that a ransomware attack will occur and minimize the damage if it does.

Case Study: The CommonSpirit Health Ransomware Attack

A ransomware attack against CommonSpirit Health in 2022 perfectly captures the danger posed by ransomware to healthcare organizations. The cost of the attack exceeded $160 million for CommonSpirit, which is the second-largest nonprofit hospital chain in the United States. Though the organization says it acted quickly to prevent extensive damage, the effects speak for themselves:

• Many of CommonSpirit’s hospitals had to cancel appointments and take patient portals and electronic health records offline.
• The attack exposed the personal health and personal identifying information of more than 600,000 patients.
• CommonSpirit has faced multiple class-action lawsuits on behalf of plaintiffs who argue that the organization didn’t take adequate steps to protect sensitive data.

The ransomware attack on CommonSpirit is a prime example of how such incidents can cause not only an immediate disruption but also a long-term impact on a healthcare provider (and on patient trust).

Why Ransomware Targets Healthcare Facilities

With such a variety of businesses available to target, why do ransomware gangs continue to focus on hospitals and healthcare? One reason is that many organizations implement woefully inadequate cybersecurity measures despite the imminent threat of a cyberattack. The most common vulnerabilities include:

• Lack of system patching: Organizations often have lax protocols for updating applications and operating systems.
• Not enough cybersecurity training: Healthcare workers, including physicians, often fall prey to malicious emails containing malware or links to infected sites, and they don’t receive enough training in recognizing the signs of a phishing scam.
• Weak passwords: Lax password-management policies at healthcare facilities make it easy for hackers to break into otherwise secure applications.
• Unprotected devices: Today’s advanced medical devices are increasingly connected to the Internet, but they often aren’t protected with the same cybersecurity measures as traditional hardware.
• Outdated data backup systems: Historically, healthcare groups have been slow to upgrade to more advanced data backup solutions that could help them minimize the risk of data loss after an attack like ransomware.

Hackers are well aware of cybersecurity weaknesses in the healthcare industry, and they’re happy to exploit them for personal financial gain. They also know that patient data is voluminous and highly sensitive, which increases the likelihood that healthcare facilities will pay the ransom. Maintaining business continuity in healthcare will remain a challenge until these vulnerabilities are resolved across the industry.

The Sky-High Costs of Downtime in Healthcare

An operational disruption can be expensive for any business. For smaller companies, a single hour can easily cost more than $10,000. But for large healthcare organizations, those downtime costs can balloon into millions of dollars.

A 2024 report highlighted by Healthcare IT News found that a single day of downtime costs healthcare provides an average of $1.9 million, when the downtime is caused by ransomware. Over a 6-year period, these losses totaled an estimated $21.9 billion for attacks on 654 healthcare organizations.

The Risk of Regulatory Noncompliance

Federal regulations are especially strict for healthcare organizations. A failure in healthcare business continuity planning can not only put patients at risk but also compromise their private medical data. To help prevent these risks, the U.S. government developed regulations like HIPAA, which sets specific rules for how healthcare organizations handle sensitive data, including:

• Storage
• Transmission and processing
• Protections against theft and instruction
• Back-up methods

Under the law’s HIPAA Security Rule, a healthcare organization must deploy technology and protocols that enable it to quickly restore data after a disruptive event so that it can continue operating in “emergency mode.” A failure to comply with HIPAA comes with steep costs, with each violation carrying a fine of up to $50,000. As such, every healthcare organization should have a HIPAA compliant disaster recovery plan.

Key Steps to Healthcare Business Continuity

For healthcare organizations, building an effective continuity plan is essential for preventing costly, potentially life-threatening disruptions. Here are some of the key steps and goals for developing a BCP for your organization:

1. Form a Planning Team: Assemble a multidisciplinary committee with representatives from key areas (clinical, IT, administration, facilities and compliance) to lead the planning process.
2. Conduct a Business Impact Analysis (BIA):
   • Identify all critical clinical functions and business operations (e.g., patient care, EHR access, pharmacy, billing).
   • Determine the maximum allowable downtime for each function before patient care is severely impacted.
   • Identify the resources (staff, equipment, supplies, IT) required for each critical function.
3. Perform a Risk Assessment (or Hazard Vulnerability Analysis):
   • Identify potential threats (e.g., natural disasters, cyberattacks, utility failures, pandemics, supply chain disruptions).
   • Analyze the likelihood and potential impact of each threat on your critical functions.
4. Develop Recovery & Mitigation Strategies:
   • Based on the BIA and risk assessment, create strategies to maintain continuity.
   • Patient Care: Plan for alternate care sites, patient evacuation/transfer and managing patient surges.
   • IT & Data: Implement robust data backup and recovery plans for Electronic Health Records (EHR) and other critical systems. Ensure HIPAA compliance for all data, even during a disaster.
   • Staffing: Create plans for staff shortages, cross-training and establishing a clear order of succession.
   • Supply Chain: Identify alternate vendors for essential medical supplies, pharmaceuticals and food.
5. Create a Formal Communication Plan:
   • Develop a clear plan for communicating with staff, patients, families and authorities during a disruption.
   • Establish multiple communication methods (e.g., text alerts, phone trees, intranet) that do not rely on a single system.
6. Document the Plan: Consolidate all analyses, strategies, contact lists and step-by-step procedures into a single, accessible document. Ensure copies are available both digitally and physically (offline).
7. Test, Train, and Update:
   • Train: Educate all staff on their specific roles and responsibilities within the plan.
   • Test: Regularly conduct drills and tabletop exercises to test the plan’s effectiveness and identify gaps.
   • Update: Review and update the plan at least annually, or anytime there is a significant change in operations, technology or facilities.

BCP Healthcare Template

What documentation should go in a BCP for healthcare? While a general business continuity plan template usually can be adapted for companies in any industry, healthcare businesses have specific requirements and objectives, such as concerns for protecting sensitive data and ensuring continuity of critical patient services.

Example structure of a BCP healthcare planning document:

• Executive Summary
  1. BCP Objectives and Purpose
  2. Plan Scope and Limitations
• Governance & Responsibilities
  1. BCP Leadership Team
  2. Roles and Responsibilities
  3. Delegation of Authority
• Risk Assessment & Business Impact Analysis (BIA)
  1. Threat Identification
  2. Impact Analysis
  3. Prioritization
• Preventive Measures
  1. Infrastructure Hardening
  2. Data Protection
  3. Access Control & Security
• Continuity Strategies
  1. Clinical Operations Continuity
  2. IT and Data Recovery
  3. Facilities Continuity
  4. Supply Chain Continuity
• Emergency Response Procedures
  1. Incident Identification & Notification
  2. Immediate Response Actions
  3. Evacuation and Shelter-in-Place Plans
• Recovery Procedures
  1. System Restoration Sequence
  2. Data Backup Recovery
• Communication Plan
• Training & Awareness
• Testing & Maintenance
  1. Testing Schedule
  2. Metrics for Evaluation:
  3. Plan Review & Update Schedule
  4. Post-Incident Updates
• Appendices

Tips for Assessing Risks and Impacts

One of the most critical steps to setting any business continuity objective at a healthcare organization is performing a risk assessment and business impact analysis.

Healthcare organizations must assess all the risks that pose a threat to their operations, including data breaches, ransomware attacks, hardware failure and non-IT events, such as power outages, fire, medical surges from mass casualty incidents and so on.

Following a risk assessment, every hospital facility should conduct a business impact analysis to determine how each type of event would disrupt operations. Important questions to ask include:

• How long would recovery take?
• What costs would accrue?
• What services might be disrupted?

An impact analysis reveals just how bad things could get, thus helping an organization understand which solutions are needed to mitigate and recover from such events.

Establish Stronger Data Protection

Data threats like ransomware aren’t going away anytime soon. However, high-quality backup solutions significantly reduce the risk of data loss and downtime, even after a large-scale ransomware attack. Plus, robust solutions like Datto SIRIS backup feature built-in ransomware detection to stop potential infections before they spread.

Backup frequency and storage type are also important considerations. With the ability to schedule backups as often as every five minutes and recover a virtualized backup in seconds, healthcare firms can maintain continuity through nearly any data disruption.

The Essentials of IT Disaster Recovery for Healthcare

All components of a healthcare organization’s IT infrastructure must be adequately protected against downtime threats. Similarly, when any of those systems are disrupted, the organization must have a solution in place that enables a rapid recovery. Essential components for disaster recovery in healthcare include:

• Network security and redundancy
• Data backup solutions
• Antimalware systems
• Redundant telecommunications lines
• Backup power generators

However, recovery alone is not enough. Prevention is also crucial to business continuity. Among the most important preventative measures are:

• Cybersecurity training for personnel
• Disaster recovery testing and drills
• Network penetration tests
• Test recoveries of data backups

Failure to employ any one of these strategies could leave healthcare organizations unprepared to cope with potential crises and disasters.

Don’t Risk It. Upgrade Your Healthcare BC/DR Today

If your healthcare organization needs stronger protection against ransomware and other threats to your continuity, schedule a call with our data protection specialists at Invenio IT or request Datto SIRIS pricing to learn more. You can also reach us by calling (646) 395-1170 or emailing success@invenioIT.com.