At 6:45 on a Tuesday morning in September 2024, a home health agency in Connecticut discovered that their EHR platform was inaccessible — the first visible indicator of a ransomware attack that had been spreading through their systems since the previous Friday evening. At that moment, seventeen field nurses were preparing for morning visits. Three patients were scheduled for OASIS assessment visits that generated Medicare billing. One patient was receiving daily wound care that required the nurse to reference the physician's current order. And the clinical coordinator who normally dispatches nurses, verifies care plans, and handles urgent clinical questions could not access any patient records.
The agency had no documented downtime procedures. By 10am, three nurses had postponed visits because they could not confirm patient addresses from their personal phones. Two OASIS assessments were not completed on schedule. The wound care visit was completed by a nurse who called the patient's physician directly from her personal cell phone to verbally confirm the current order — a process that worked, but that is not a policy, not documented, and not reproducible at scale. Business continuity planning is not about preventing cyberattacks. It is about ensuring that when an attack occurs, patient care continues while the technical response unfolds.
The Five Components of a Complete Home Health Business Continuity Plan
Component 1: Clinical Downtime Procedures
Clinical downtime procedures are the most critical and most absent component of home health business continuity plans. They define exactly how nurses continue to provide care when the EHR is unavailable. Every field nurse should carry — in their nursing bag, on a laminated card — the following minimum information that allows care to continue without EHR access:
- Their assigned patient roster for the day: patient names, home addresses, and scheduled visit times — printed each morning before leaving the office, or generated automatically by the scheduling system and sent to a personal device before the EHR went down
- The current care plan summary for each patient: the primary diagnosis, the care goals, the active orders, and any special instructions — a one-page summary that a nurse can reference for routine visits without real-time EHR access
- Emergency contact information: the clinical supervisor's direct cell phone number, the on-call physician number, and the agency's downtime coordination number — not email addresses, not the general office line, direct phone numbers that function without internet
- Paper documentation forms: a standardised visit note form, a medication administration record template, and an unusual occurrence form that captures any clinical events requiring immediate physician notification
Component 2: Communication Protocols During an Incident
When the EHR goes down, three communication challenges emerge simultaneously: nurses in the field need to know what happened and what to do; clinical supervisors need to coordinate care across their caseloads without their normal tools; and families and physicians who contact the agency during the outage need to be informed appropriately without creating panic or undermining trust. Each of these communication streams needs a documented protocol: