White Paper · HIPAA · Incident Response

Healthcare Incident Response Tabletop Exercises: Designing One That Teaches the Team

A plan that has never been exercised is a theory. Objectives, scenarios, participants, legal decision points, and the after-action report.

By Lincoln Square Law · 7-minute read

An incident response plan that has never been exercised is a theory. The first real test usually arrives at the worst moment: a locked electronic health record on a Monday morning, a vendor’s call about suspicious activity, a reporter’s email asking about a breach the practice has not yet confirmed. A tabletop exercise is a structured discussion in which the people who would handle an incident walk through a realistic scenario and make the decisions they would have to make, before the stakes are real. Done well, it shows where the plan is vague, where authority is unclear, and where legal deadlines would be missed. This paper explains how to design a tabletop that teaches the team something, and how to connect it to the HIPAA obligations it helps satisfy.

Why the Security Rule expects it

The Security Rule requires procedures to identify and respond to suspected or known security incidents, mitigate their harmful effects, and document them and their outcomes (45 C.F.R. 164.308(a)(6)). It requires a contingency plan, including procedures for periodic testing and revision of that plan (45 C.F.R. 164.308(a)(7)(ii)(D)). It also requires periodic evaluation of the security program in response to environmental or operational changes (45 C.F.R. 164.308(a)(8)), and security awareness training for the workforce (45 C.F.R. 164.308(a)(5)). A documented tabletop, with an after-action report and a remediation plan, is evidence on all four points.

Start with objectives

The most common mistake is to start with a dramatic scenario and hope lessons emerge. Start instead with three to five objectives, each specific enough to judge afterward. Examples:

• Fix the discovery date. Can the team identify, within the first hour, the date and time the incident was first known and who knew it?
• Make the breach decision. Can the privacy officer run the four-factor risk assessment and document a conclusion?
• Keep the clinic running. Can clinical staff operate on downtime procedures for a full day without the electronic record?
• Reach the vendor. Does anyone know how to reach the managed service provider or EHR vendor after hours, and what the contract requires of them?
• Meet every deadline. Can the team build the notification calendar, including the Illinois Attorney General’s five-business-day window after notice to HHS (815 ILCS 530/50)?

Choose a realistic scenario

Draw the scenario from the organization’s own risk analysis. If the analysis identifies ransomware against the practice management system as the highest risk, exercise that. If the practice relies heavily on a single billing vendor, exercise a breach at that vendor. Useful scenarios for small and mid-sized practices include ransomware that encrypts the scheduling and records systems, a business associate that reports a breach weeks after it began, a misdirected email containing a patient list, a lost unencrypted laptop, and a workforce member who viewed records without a work reason. Each tests different decisions, and rotating them from year to year builds breadth.

Build the injects

A tabletop advances through injects, short pieces of new information released at set points. A ransomware exercise might begin with a help desk ticket about files that will not open, followed by a ransom note, a call from the EHR vendor, a patient complaint on social media, a request from law enforcement to delay notice, and a forensic update that the attackers exported data weeks earlier. Each inject should force a decision: who is told, what is shut down, whether to contact the cyber insurer, when the discovery clock started, and what must be preserved. Write the injects in advance, with the questions the facilitator will ask at each one.

Who should be in the room

Include the people who would actually act. That usually means the security official and privacy officer, a practice or operations leader with authority to make business decisions, the IT lead or managed service provider, a clinical leader who can speak to patient care during downtime, whoever handles communications, and counsel. The facilitator should not also be a key decision-maker, and a separate note-taker should record decisions, open questions, and the time each was raised. Keep the group small enough that everyone speaks.

Legal decision points to exercise

Every healthcare tabletop should reach the legal questions that decide the outcome after a real incident:

• Discovery. When did the organization know, or by reasonable diligence would it have known? (45 C.F.R. 164.404(a)(2))
• Breach or not. Can the team apply the exceptions and the four-factor assessment, and document a low probability of compromise if that is the conclusion? (45 C.F.R. 164.402)
• Deadlines. Individual notice within sixty days, media notice for more than 500 residents of a state, HHS notice by the applicable deadline, and the Illinois Attorney General within five business days after notifying HHS.
• Business associates. What the contract requires the vendor to report and when, and what the organization must do with that report (45 C.F.R. 164.410).
• Law enforcement. How a request to delay notice is handled and documented (45 C.F.R. 164.412).
• Privilege and preservation. Who engages the forensic firm, and whether logs and systems are preserved before they are rebuilt.

Running the session

Set ground rules at the start. The exercise is discussion-based and no-fault, and the goal is to find gaps, not to grade individuals. Two to three hours is enough for most practices. Keep the scenario moving on the schedule of injects, and when the group gets stuck, note the gap and move on instead of solving it in the room. Resist the temptation to let the scenario resolve neatly. The most useful exercises end with unanswered questions.

Gaps worth probing

A good facilitator presses on the places where plans are usually thinnest:

• Authority. Who can decide to take systems offline or pay for outside help at 2 a.m.?
• Contacts. Are after-hours numbers for the IT provider, the EHR vendor, the cyber insurer, and counsel written down somewhere that still works if email is down?
• Downtime. Do paper forms and procedures exist for scheduling, charting, and prescriptions, and does staff know where they are?
• Contracts. Does each business associate agreement say how quickly the vendor must report, and what it must include?
• Insurance. Does the cyber policy require notice to the insurer before engaging vendors, and has anyone read that clause?

The after-action report

Within two weeks, circulate a short report listing what worked, what did not, and each gap found, with an owner and a date for fixing it. Feed those items into the risk management plan, update the incident response and contingency plans, and keep the report with the security documentation for six years (45 C.F.R. 164.316(b)). If the exercise revealed that no one could reach the EHR vendor after hours, the fix is a contract term and a phone list, not a note that communication should improve.

Frameworks and free resources

Several government resources support tabletop design. NIST Special Publication 800-84 describes test, training, and exercise programs for IT plans. NIST Special Publication 800-61 Revision 3, published in April 2025, places incident response within the Cybersecurity Framework 2.0. The Cybersecurity and Infrastructure Security Agency publishes tabletop exercise packages with ready-made scenarios, and the HHS 405(d) program publishes health-sector cybersecurity practices. These resources also help show that the organization has recognized security practices in place, which HHS must consider when deciding fines and other remedies under the 2021 amendment to the HITECH Act (Pub. L. 116-321).

How often

Run a tabletop at least once a year, and again after major changes such as a new electronic health record, a move to cloud services, a merger, or a significant incident. Each exercise should test a different scenario and track whether the gaps found last time were closed.