Commence Project: High-level executive sponsorship and continued oversight is an essential success factor for the project. The planner should understand the executive’s purpose and goals for the project as well as the requirements for reporting back on project status. A formal project charter may be useful in efficient project completion.

Convene Project Team: Form a multi-disciplinary planning team that includes physicians, nurses, information services, information security, hospital operations, contingency planning, clinical equipment, and supply chain specialists.

• Cut network and communications access.
• Cause the institution to shut down access to the Internet and network in order to:
  • Mitigate further damage.
  • Prevent data exfiltration.
• Damage or prevent connected medical equipment/devices from transferring data and therefore interfere with data storage and documentation. This includes wearable/implantable devices.
• Affect data confidentiality, integrity, and/or availability.

Complete the Clinical Impact Analysis: The main purpose of the Clinical Impact Analysis is to identify the most important clinical functions that are heavily dependent on connected medical devices that would be disrupted by a loss of network or a direct attack on the equipment in a cyber-attack.  Typically, the critical clinical functions would include: Radiology/Imaging, Laboratory, Cardiology, Clinical Equipment, Intensive Care, Nuclear Medicine, Neurology, et cetera.

The list of critical clinical functions will vary by institution, so the main purpose of the clinical impact analysis is to determine the prioritized list of critical functions for that particular institution. Prioritization can be based on an assessment of what loss of that function would have on the ability to continue to provide clinical healthcare services. Each of the critical functions (or departments) identified through the Clinical Impact Analysis will need to develop a Clinical Continuity Plan for their function or department.

With the guidance and assistance of the planning team, the department will continue the impact analysis by identifying and listing the networked equipment/devices that each function uses. Equipment should be listed in priority order based on criticality, vulnerability, availability of manual backup processes for data transfer and storage, or other criteria set by the planning team. A risk assessment for each piece of critical equipment should be completed. This risk assessment could consider e.g., the age of the equipment, compliance with FDA standards for cyber security, availability of manual processes for data communication and storage, etc.

External Healthcare Service Contractors/Other External Dependencies: The Clinical Impact Analysis must include any external contractors that provide a critical service (e.g. radiology interpretation). 

Disaster Recovery Tier List: Information Technology Services maintains a tier list of software and applications used at UTMB. They use this list to prioritize recovery efforts (e.g., Epic EMR will be brought back online before most other software). Some software/applications will have a higher time/resource cost to bring back online than e.g., cloud-based services managed by the vendor.

1. Ensure Information Technology Services and Information Security departments know what applications you are using. They can't help you diagnose or fix a problem if they don't know what software you are using. If they don't know about your application, it won't be on their Tier List, therefore you'll be waiting weeks at the back of the line in terms of restoration.
2. Know the disaster recovery tier of the software you use. There may be a discrepancy between how important you think the software is and what ITS deems it. Don't be caught thinking your applications will be restored earlier than they actually are.
   

Each Critical Function Drafts Their Plan: Each Critical Function Plan should identify the actions they would take for a cyber incident. These plans would build on traditional Downtime Procedures and specifically address how clinical care would continue if there were an attack or shutdown of the network or communications systems. This would include addressing how data might be transferred from a piece of connected medical equipment, e.g., if possible, transferring the data or image via hard media; and how those data could be stored for documentation. The collection of data for documentation should be limited to essential information. Once systems and the network are restored, the plan should address how data collected during the incident will be entered into permanent systems.

Plans should also address any plans for emergency access to the most recent electronic medical record, e.g. cloud-based backup systems that the institution may have.

DEVELOP A COMMUNICATIONS PLAN

Warning:  Notice/No-Notice Incidents: Information Services and Information Security may detect an intrusion and proactively shut down the network to mitigate risk, and in this case, a notification system could be used to warn departments/critical functions that the system is down. It is possible that an intrusion is not detected until a staff member recognizes the anomalous performance of the equipment that might be a sign of an attack. Plans must address both types of warning.

Internal / External Communications: The Critical Function Plan should include a Communications Plan that includes key staff, departmental officials, On-Call officials, and external partners and contractors. The Communications Plan should include alternative methods of communication that would be available if VOIP phones are down.

Identify Dependencies and Interoperability Concerns with Other Critical Functions: The Critical Function Plan should attempt to identify any dependencies with other critical functions within the institution.

Technology Migration Plan: Advanced planning for Clinical Continuity should also include a Technology Migration plan that would help manage movement away from more vulnerable equipment to more secure equipment meeting the highest cybersecurity standards. Another factor for migrating to another technology would be design features that facilitate data transfer backup procedures e.g. via hard media or other methods.

Train Staff and Test Critical Function Plans: Each Critical Function should develop training, plan tests and exercises to evaluate the effectiveness of the plan and identify opportunities for improvement. 

Once each of the Critical Functions identified on the Clinical Impact Analysis have drafted their plans, the project team will need to take an institutional view of the interoperability of those plans.  One technique would be to use several scenarios for moving patients through the system while all critical clinical functions are in downtime – and to assure that the workflows function without creating bottlenecks. Traditional process optimization techniques could be applied; and process flow diagrams for moving patients through the system could be useful.

Institutional Exercises: Once each of the individual Critical Function Plans have been developed and exercised internally (e.g. Radiology/Imaging tests its plan; Lab tests its plan; Pharmacy tests its plan...), an institutional exercise that incorporates all of the Critical Clinical Functions listed in the Clinical Impact Analysis should be conducted. The exercise should be analyzed and opportunities for plan improvement should be identified. If plan changes are made, the changes should be retested to assure that there is in fact an improvement.

Supply Chain Controls: Ideally procurement processes would not allow procurement of connected medical equipment or devices that are not tested for cyber vulnerabilities, that do not meet current standards for cybersecurity, and that are not approved for connection to the network by the institution’s Information Services and Information Security officials. Proliferation of devices should be limited to the extent that there is at least one knowledgeable official on staff that maintains knowledge on how to respond to an attack on each specific device.