Historical analysis: this article examines information published by the source on November 07, 2024. Check the latest vendor guidance before acting.
What was published
On November 7, 2024, documentation was released regarding the Operational Continuity-Cyber Incident (OCCI) Checklist. This resource is a joint effort between the Department of Health and Human Services (HHS) and the Health Sector Coordinating Council (HSCC). It provides a flexible, role-based action plan designed to assist healthcare and public health (HPH) organizations in responding to and recovering from extended enterprise outages caused by severe cyber incidents.
Status and scope
The OCCI Checklist is a voluntary resource intended for HPH organizations of all sizes. While it is specifically tailored for Emergency Managers and individuals trained in the Hospital Incident Command System (HICS), it is designed as an inclusive starting point for smaller providers who may lack formal HICS training or dedicated personnel. The checklist focuses exclusively on the critical first 12 hours following a cyber event.
What the guidance covers
The framework aligns with HICS and defines specific responsibilities for several key roles during the initial response phase:
* Incident Commander: Provides strategic direction, declares the incident, and manages situational awareness.
* Medical-Technical Specialist: Acts as a subject matter expert/advisor.
* Safety Officer: Focuses on safety protocols during the outage.
* IT/IS Section Chief: Manages technical response efforts.
* Additional Support Roles: Includes Public Information Officer, Liaison, and Section Chiefs for Operations, Planning, Finance, and Logistics.
The guidance emphasizes that organizations should assume a cyber incident is malicious until proven otherwise. It also highlights the importance of integrating cybersecurity into patient care to ensure that “cyber safety is patient safety.”
How organizations can use it
Organizations are encouraged to integrate the OCCI Checklist as a component of their broader Incident Response Plan (IRP) and Business Continuity Plan (BCP). Our analysis suggests the following implementation steps:
1. Role Mapping: Identify primary and secondary personnel for each defined role, acknowledging that in smaller practices, one person may hold multiple secondary functions.
2. Accessibility: Store the checklist in locations easily accessible during a total network outage and include it in new staff onboarding.
3. Validation through Exercise: Regularly test the checklist using tabletop exercises, simulation drills, or functional exercises to ensure roles are understood and communication modalities are viable.
4. Iterative Review: Update the checklist annually or immediately following any actual cyber incident to refine processes based on after-action reviews.
Decisions and next steps
Security leaders and clinical engineering teams should evaluate whether their current IRP specifically addresses the first 12 hours of an enterprise-wide outage. A key decision point is determining which non-traditional communication methods (e.g., overhead paging or manual notifications) will be used if primary digital systems are unavailable.
Organizations should verify the effectiveness of this framework by conducting a simulation that tests the transition from normal operations to the activation of the Incident Command structure, specifically measuring the time it takes to establish situational awareness across clinical and administrative functions.
Limits and open questions
The OCCI Checklist is an operational aid; it does not replace a comprehensive IRP or BCP. It provides recommended procedures rather than mandatory legal requirements. Furthermore, following the checklist does not guarantee the prevention of business disruption or technical downtime. A remaining open question for organizations is how to maintain the balance between rapid technical recovery and the clinical necessity of pausing or diverting patient care during an active incident.
Source and editorial note
Operational Continuity-Cyber Incident (OCCI) Checklist · Source date: November 07, 2024 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: November 10, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: August 31, 2026 at 12:25 UTC.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗