.jpg)
When ransomware hits a hospital, the first thing staff often lose is the ability to talk to each other. VoIP phones, paging, email and the patient-facing call center all depend on the same network the attackers just encrypted. Yet most ransomware tabletop drills for hospitals focus on servers and data, not on what happens when nobody can pick up a phone.
If your drills don’t test communication failure, they’re missing the scenario most likely to slow your recovery.
Modern hospital phone systems are software running on the same infrastructure as everything else. A compromised domain controller or encrypted call manager can silence internal extensions, nurse call integrations and patient hotlines at once. Clinicians can’t reach pharmacy, families can’t reach the switchboard, and the incident response team can’t coordinate.
A strong hospital ransomware response plan assumes the primary phone system is untrustworthy, or simply gone.
An interactive voice response (IVR) menu hosted outside your core network lets you reroute callers during an incident. Build dedicated extensions for each audience:
In a tabletop drill, ask who has authority to activate these extensions, how fast it can be done, and who updates the recorded message as the situation changes.
Messaging apps like WhatsApp give your incident team a channel that doesn’t rely on hospital systems. Set up pre-approved groups for the incident command team, department leads and IT recovery staff, and keep membership current.
Use these channels for logistics and coordination, such as meeting times, system status and task assignments. Don’t share patient information over consumer apps. Your drill should test that your privacy officer has defined exactly what can and can’t be said, in line with applicable health privacy law such as PHIPA in Ontario.
Maintain a small pool of mobile or cloud-based numbers registered to a carrier or provider that is independent of your network. Designate them for the incident commander, IT recovery lead, communications lead and executive sponsor, and publish the list in a printed contact sheet. Drills should confirm the sheet is current and that people know where physical copies are kept.
Communication plans only work if recovery itself is dependable. Storage Guardian helps healthcare organizations protect and restore critical data, so that once your teams are coordinating through out-of-band channels, they have clean, verified backups to restore from rather than negotiating with attackers.
Tabletop drills are also the right place to test recovery assumptions alongside communication ones. With Storage Guardian’s backup and disaster recovery approach, your team can rehearse questions like:
Pairing documented recovery priorities with a tested communication plan gives leadership realistic recovery time estimates instead of guesses.
Repeat at least twice a year and after any major system change.
Ransomware readiness is as much about people and process as technology. Build communication failure into your next tabletop drill, and make sure your recovery foundation is as tested as your call tree. To strengthen the data protection side of your plan, contact Storage Guardian to discuss backup and recovery options for your hospital.
