Historical analysis: this article examines information published by the source on November 07, 2024. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What happened
On November 7, 2024, documentation regarding the Operational Continuity-Cyber Incident (OCCI) Checklist was detailed. This resource, a joint effort between the Department of Health and Human Services (HHS) and the Health Sector Coordinating Council (HSCC), provides a role-based action plan for healthcare and public health (HPH) organizations. It is specifically designed to assist operational staff and executive management in responding to and recovering from extended enterprise outages caused by severe cyber incidents, focusing on the critical first 12 hours of an event.
Who may be affected
This guidance is relevant to U.S. healthcare providers, practices, health plans, business associates, and clinical engineering teams of all sizes—from small organizations with limited resources to large integrated systems. It specifically targets those utilizing the Hospital Incident Command System (HICS) or those needing a starting point for cyber-resiliency planning.
Why it matters
Cyber incidents in the HPH sector can lead to direct patient impact, including delays in procedures and tests, longer hospital stays, increased patient diversions, and higher mortality rates. Ransomware is identified as the most likely cause of such harm.
Data indicates a significant gap in preparedness: over 40 percent of surveyed healthcare organizations have not implemented an Incident Response Plan (IRP). Furthermore, while discovery times for breaches decreased from 132 days in 2021 to 96 days in 2022, attackers still maintain access to protected health information (PHI) for months on average, increasing the risk of critical infrastructure disruption.
Mitigation priorities
To improve operational continuity and reduce the impact of a cyber event, organizations should prioritize the following:
- Incident Response Planning: Develop and maintain an IRP that provides a framework for identifying, containing, mitigating, and recovering from security incidents. This should be distinct from a Business Continuity Plan (BCP), which focuses on sustaining mission processes during disruptions.
- Role-Based Assignment: Identify primary and secondary personnel for critical command roles, including the Incident Commander, Medical-Technical Specialist, Safety Officer, and IT/IS Section Chief.
- Adoption of Performance Goals: Prioritize high-impact practices outlined in the voluntary Healthcare Cybersecurity Performance Goals (HPH CPGs) published by HHS in January 2024 to strengthen perimeter security, email security, and access controls.
- Communication Redundancy: Establish non-traditional communication modalities for use when typical networks are impacted, ensuring downtime plans can be communicated to staff via overhead paging or mass notification systems.
How to verify mitigation
Our recommended validation approach:
We advise that organizations avoid relying solely on a checklist review. Instead, we recommend the following validation methods:
* Scenario-Based Exercises: Conduct workshops, tabletop exercises, simulation drills, or full-scale functional exercises driven by measurable objectives at the department or facility level.
* After-Action Reviews: Perform a formal debrief after every exercise to identify gaps in the response process and update the OCCI checklist accordingly.
* Annual Review Cycle: Establish a mandatory annual review of the IRP and role assignments, or trigger an immediate review following any actual cyber incident.
* Authorized Testing: For technical controls mentioned in the HPH CPGs, we recommend agreeing upon a safe, authorized retest with the system owner to ensure perimeter and access controls are functioning as intended.
What remains uncertain
The source does not provide specific technical configurations for the recommended security controls. It also notes that the OCCI checklist is a flexible template; therefore, the exact effectiveness of its implementation depends on how an organization modifies the tasks to align with its specific size, resources, and operational complexity.
Source and editorial note
Operational Continuity-Cyber Incident (OCCI) Checklist · Source date: November 07, 2024 · Retrieved August 31, 2026.
Original analysis prepared with local AI and automated relevance and evidence checks. These checks are not a guarantee of accuracy. Recommendations are our defensive analysis unless attributed to the source.
Request a healthcare security assessment
Protect the systems your care depends on.
Discuss your healthcare environment, prioritize exposure, and establish evidence that safeguards work.
Request a healthcare assessment ↗