Hospital downtime checklist for a large cyber incident

When a cyber incident takes clinical systems offline, hospitals shift to downtime procedures. An ASPR TRACIE operations checklist lists what to prepare: accessible go-bags, posted quick-start cards, manual care instruction cards, offline credentials, alternative communication, runners, and workarounds for admission tracking and imaging. Most of it is about people and paper.

Why a checklist at all

Downtime from a power cut is short and familiar. A cyber incident can be long and can hit the tools staff would use to cope. The checklist assumes a rapid shift to a downtime protocol or a modified operational state.

What the checklist asks for

Grouped from the document:

Supplies and posting

• Store downtime go-bags or boxes where staff can reach them, with items allocated to predetermined staff.
• Post resources, instructions and quick-start cards in obvious places.
• Distribute manual clinical instruction cards, such as how to count drips and take vitals.

Access and identity

• Staff should know their user IDs and identifiers for paper records.
• Keep local endpoint administrative passwords accessible offline.
• Identify other ways to communicate inside the hospital and with patients and families.

Workflow workarounds

• Set up downtime workstations that keep charts organized, in time order, and consider carbon copies if printers are down.
• If admission, discharge and transfer systems are down, use a centralized workstation and a shared spreadsheet to replace the bed board.
• Use runners for messages and orders, and move pharmacists to the floor with a way to confirm orders.
• Use a reading and results workaround if imaging storage is down.
• Use the SBAR technique when communication is limited, and document all services.

What is easy to miss

The checklist points at small things that fail first: nobody knows their own ID number, the admin password is in a system that is down, there is no printed copy of the quick-start card. A drill finds these in an afternoon.

Practicing it

1. Run a four-hour drill on one ward with the EHR turned off by agreement.
2. Time how long it takes to find the go-bag.
3. Ask a night-shift nurse to find the instruction card unaided.
4. Record gaps and fix three before the next drill.

The document is dated from file metadata at February 2021 and carries no named author in that data, so confirm the current version at ASPR TRACIE.

Safeguard does not run clinical operations. For the software side of a hospital, SBOM and dependency scanning and asset discovery can help you know what systems must be recovered first.

Quick check

Sources

• ASPR TRACIE: Hospital Downtime Operations Checklist (PDF)

Last reviewed: 19 October 2026.