Why hospital cyber resilience is a joint decision

When ransomware takes over a hospital’s systems, the effects show up offline, and patient safety becomes the main concern.

The organisation then has a few minutes to show it already knows what to do.

“This is no longer a technical problem, it becomes patient care, and it can become a marketing and political problem depending on the scale of the incident,” says Haber.

The difference between a hospital that recovers in days and one that struggles for weeks is not the attack itself but whether security, IT, and clinical leaders had agreed on what to do before the attack occurred, says Haber.

But often, this agreement hasn’t happened, he notes, and a recovery strategy is fragmented.

Because systems are rarely taken offline in a considered, joint decision, they are left compromised until service is degraded or unavailable. As a result, there is no conversation about what care looks like without these systems.

“Your incident response and planning must have the ability to do it old school, without computers,” Haber says, whether that means paper charting, manual blood pressure readings, or knowing how long records will take to restore.

That plan, he adds, is only one piece of a larger one. Incident response is a subset of a hospitals business continuity planning (BCP), which covers the whole organisation and any disruption, from ransomware to fires and earthquakes.

A hospital that prepares only for the cyber scenario is preparing for one failure potentially among many real world events.

Mean time to repair matters just as much, as it may determine whether a single system is isolated or the whole hospital goes dark.

Haber spoke to GovInsider on the sidelines of GovWare 2026, part of the Singapore International Cyber Week held from 13 to 15 October, about how cybersecurity plays out in critical environments like healthcare to ensure continuity of care.

Clinicians in the room

There’s one thing that healthcare and IT have in common: risk management.

While clinicians manage patient risk, security teams manage the systems’ risk, and the two need to reconcile on what each can accept.

For that reason, clinicians need a seat at the table when it comes to cybersecurity planning in healthcare.

“You can’t ask a doctor or a nurse to become cybersecurity [experts], but you want them as part of the conversation,” Haber says.

That means planning, tabletop exercises, and recovery, because neither side can guess what the other needs, he explains.

He illustrates this with the example of a surgery that gets interrupted by the monitors going down. What would the surgeons and medical staff need to keep the patient safe while the technical team responds?

The answer must be in the plan before the incident even happens, says Haber.

Going back to paper-based methods as a downtime procedure is not as alien as it sounds. With his own family working in critical healthcare, Haber has seen them rely on charting by hand when computers failed.

“It’s harder, but it’s not a problem,” he says, because they were trained for it.

The principle holds even in more extreme situations, such as disasters on the scale of Nepal’s, where whole communities were affected and local hospitals may have been hit. There is where a BCP plan becomes important.

A cyber-focused response plan is no use there “because there’s no way you’re going to recover when there’s nothing to recover to,” he says.

The question then becomes how to provide care with no systems or technology at all, which makes the broader continuity plan, and the clinicians’ input into it, more critical.

What makes a difference

When faced with the same attack, hospitals’ incident response and recovery usually differ because of planning and testing, with funding as a base layer.

“The difference between one hospital getting the job done quicker versus the other, is that the planning and testing was thorough compared to the other. The funding and everything else were in place.”

Backups are a clear example, says Haber. Storing data for longer costs more money, and compromised backups are worthless.

“You may be backing up ransomed encrypted files for a long time and not even know it.”

Smaller and nonprofit hospitals tend to lack the budget for the tools and expertise to prevent that, which makes them more susceptible to longer downtime periods, he says.

That’s why he suggests “a conscious approach to doing your planning, your incident response, funding the technology and the people, before an incident happens.”

Don’t depend on technology

To protect continuity of care, Haber points out that overreliance on artificial intelligence (AI) is not the way to go.

While the technology can be useful, its effect on care must always be monitored.

“AI can fail, it can break, it can be hacked. Always keep a human in the loop,” he says.

“Make sure that if implement AI, and need to turn it off, there’s still the expertise and workflows to go back to basics or however things were done before to ensure patient care is never interrupted,” he concludes.