Joint Commission and AHA leaders say hospitals should be prepared to sustain patient care for weeks when critical technology and connected medical equipment are unavailable.
By Alyx Arnett
When a cyberattack knocks a hospital into what industry leaders call “digital darkness,” the impact can extend well beyond the electronic health record, according to William Walders, MHA, MBA, executive vice president and chief digital and information officer at Joint Commission.
Linear accelerators can become inaccessible. Infusion pumps can lose connections to centralized systems. In some cases, clinical staff have been locked in rooms when systems went down and doors failed shut, Walders says.
Those scenarios are shaping the second phase of the Cyber Resilience Readiness program, which Joint Commission and the American Hospital Association (AHA) rolled out as an expansion of the voluntary initiative first announced in May 2026.
“Our focus isn’t around cyber maturity. Our focus isn’t around helping people understand their cyber risk. It’s truly to continue clinical operations,” Walders says.
What the Expanded Program Does
The Cyber Resilience Readiness program began in May with a free self-assessment designed to help hospitals evaluate their ability to maintain clinical operations during a prolonged technology outage. Organizations can use the questions internally or submit their results for expert review. The newly launched second phase adds fee-based advisory services from Joint Commission and AHA, along with a formal Cyber Resilience Readiness certification managed by Joint Commission.
Walders says dozens of organizations have completed the assessment since its launch, while thousands more have viewed the questions. The assessment asks multidisciplinary teams to consider how patient care would continue during a technology outage.
“It’s been eye-opening for these multidisciplinary teams to look at it not from the lens of IT, not from the lens of emergency management, not from the lens of operations, but truly on how to deliver clinical care safely,” Walders says.
Organizations that want additional assistance can pursue advisory services from Joint Commission or AHA. Those seeking certification can move into a formal review intended to identify gaps as well as areas where an organization is already well prepared.
Planning for a 30-Day Outage
One of the challenges hospitals are being asked to consider is how they would maintain those clinical operations during a prolonged outage. According to Walders, the average period of “digital darkness” lasts 28 days. AHA recommends hospitals and health systems be prepared to sustain safe, high-quality care for at least 30 days without the technologies they normally rely on.
“They probably are comfortable surviving technology disruptions for 28 minutes, 28 hours, and then it starts to get hard when it’s prolonged,” he says.
Scott Gee, deputy national advisor for cybersecurity and risk of the AHA, says hospitals need operational plans for extended outages. Short-term workarounds, such as documenting on paper with the expectation that information can be entered into electronic systems once they return, become impractical when an outage stretches for weeks.
“That’s not sustainable for 30 days, so we’re encouraging people to build plans that they can execute and sustain for up to 30 days,” says Gee.
Walders says prolonged downtime also raises questions about how hospitals prepare for medical equipment and other systems that may become disconnected. Organizations may need to consider whether to make the investment required to harden certain technologies or build a separate network that can continue functioning during an outage. For some, he says, the answer may be to accept that risk and plan for how operations will continue instead.
“For some organizations, the decision may be: ‘We’re not going to spend millions of dollars hardwiring every piece of clinical engineering equipment, from Da Vinci robots and linear accelerators to infant security systems and room controls. Instead, we’ll build operational plans. We’ll station staff at doors, bring radiologists onsite, and implement other manual processes that allow care to continue during an outage,'” Walders says.
Making those decisions before an outage occurs reflects a shift Walders says he has seen during his 20 years in healthcare—from hoping a major technology outage won’t happen to planning for the likelihood that it will.
For HTM teams, he says that planning should also accompany the adoption of increasingly connected and automated systems. “Every time somebody has a good idea around centralized monitoring, capacity management, automation should come with the immediate plan on what happens when we don’t have that,” he says.
Keeping Care Going in Digital Darkness
Ken Grubbs, DNP, MBA, RN, chief nursing executive and executive vice president of accreditation and certification operations at Joint Commission, says continuity planning also has to account for the clinical functions that cannot stop when technology becomes unavailable. Hospitals still have to administer medications if automated dispensing cabinets are down, he says, and emergency department patients still need to be evaluated when imaging or laboratory systems are unavailable.
For Grubbs, preparedness means ensuring healthcare teams have a way to continue delivering that care during an outage.
“At the end of the day, we’re all here for patients,” Grubbs says. “If you think about the impact of a cyberattack, it impacts both those groups of individuals: the patients that are trying to receive care, and the healthcare team that wants to deliver that care.”
ID 449093385 © Andrey Popov | Dreamstime.com
