A tabletop exercise is the highest-return security investment a home health agency can make that does not require a technology purchase. Ninety minutes. A conference room. The right scenario. And a willingness to be honest about what the exercise reveals. I have facilitated tabletop exercises at dozens of home health agencies over my career, and the pattern is consistent: agencies that are confident in their incident response plans discover in the first twenty minutes of a realistic scenario that the plan works in theory and not yet in practice. The discoveries range from mildly embarrassing (nobody knows the cyber insurance carrier's claim reporting number) to genuinely alarming (the incident response plan lists a person who left the agency two years ago as the primary security contact).
These discoveries made in a tabletop exercise cost nothing to fix. Made during a real incident at 2am, they cost significantly more.
The Right Scenario for a Home Health Agency Tabletop
The scenario must be realistic enough to generate genuine engagement and reveal real gaps — not so catastrophic that participants disengage because the situation seems implausible. The scenario I use most frequently for home health agencies: it is a Friday afternoon in late October. Several staff members report receiving emails that appear to be from the agency's EHR vendor asking them to update their login credentials through a link in the email. Two administrative staff clicked the link and entered their credentials before the emails were flagged as suspicious. At 5:30pm, the agency's billing coordinator notices that she cannot log into the EHR. By 6pm, the IT vendor's after-hours line confirms that the EHR is inaccessible from the agency's network. Monday morning, seventeen field nurses are scheduled to begin visits at 7am.
This scenario is realistic, specific to home health operations, and time-pressured in a way that generates the decision-making urgency that reveals plan gaps. Adjust the specific details — the vendor, the staff roles, the timing — to match your agency's actual operational context.
Who Belongs in the Room
The tabletop should include the individuals who would be making real decisions during a real incident: the executive director or CEO, the HIPAA Security Officer, the director of clinical operations, the billing director, the HR director if workforce issues could arise, and — critically — the agency's managed security provider representative. Not the IT vendor who manages your network as a side business, but the person who would actually lead the incident response if this scenario were real.
Do not include the entire staff. Tabletop exercises are most effective with 6–12 participants who have genuine decision authority. Too many participants leads to discussion that is too broad and too shallow. Too few leaves blind spots where a missing department's perspective would have revealed a gap.