Scenario library / Sector dependency
Healthcare Clearinghouse Outage: a tabletop exercise scenario
A processing intermediary takes its platform offline after a cyber incident. Claims, eligibility checks and pharmacy routing stop with no restoration date.
90 min · Executive + operations + clinical leadership
What this is modelled on
Modelled on attacks against shared healthcare processing intermediaries, where a single compromised provider halts claims, eligibility checks and prescription routing for thousands of downstream organisations for weeks.
Why it matters
The incident is not yours, but the operational and financial damage is. Cash flow, patient access and manual workaround capacity become security decisions.
Exercise objectives
- Test continuity plans for a multi-week third-party outage
- Quantify cash-flow exposure and the point of financial escalation
- Confirm manual workaround capacity and who authorises it
- Rehearse patient and staff communications
Decision points tested
- Switch to manual processing or an alternate intermediary
- Whether to reconnect when the provider restores partially
- Patient-facing messaging and complaint handling
- Escalation to board and payer relationships
Sample inject timeline
- T+0
Service down
The intermediary posts a security notice; all submissions fail.
- T+20
No ETA
The provider declines to give a restoration estimate and asks customers not to reconnect.
- T+45
Cash impact
Finance reports that unbilled revenue reaches a material threshold within ten days.
- T+70
Patient impact
Front-line staff report prescription delays and rising complaint volume.
What the after-action report should capture
- Continuity coverage for critical dependencies
- Financial trigger points and owners
- Manual capacity limits discovered
- Reconnection risk criteria
Run this scenario with your team
Tailor it to your environment with AI, run the injects live, and export a web or PDF after-action report when the exercise ends.