A branching, choose-your-path tabletop built for a regional health system. Hospitals can't close for the day, and every technical decision is also a clinical one. Six shared injects establish the attack, then incident command's own decision — go dark system-wide, or isolate and keep the clinical systems running — sends the exercise down one of two independent, fully-scripted paths. Patients keep arriving either way.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any health system that runs its clinical operations on shared technology.
A nonprofit regional health system headquartered in Knoxville, Tennessee, with four hospitals — including a Level II trauma center — 38 outpatient clinics, 1,100 beds, ~9,500 employees, and $2.4B in annual revenue. All four hospitals share one electronic health record, hosted in Ridgeway's own data center.
Ridgeway has downtime procedures for losing the health record. They were last drilled system-wide three years ago, before a third of today's nurses were hired. The plan assumes the outage is short and the rest of the network is still working. Ransomware doesn't make either assumption.
Six injects, delivered over the first ten hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
Medication dispensing cabinets at two hospitals lose their connection to the pharmacy system. Minutes later, the help desk gets a report of files with an unfamiliar extension on an imaging department share. The on-call engineer logs it as a network issue.
Security confirms ransomware on about 140 servers, including imaging and the laboratory system. The electronic health record is unaffected so far, but attacker accounts with domain administrator rights are still active on the network.
With imaging down, radiologists can't read CT scans at the trauma center. The on-call trauma surgeon asks whether to put the hospital on diversion for stroke and trauma patients. Nobody in the incident command structure is sure who has the authority to decide.
A ransom note demands $9M and claims 1.2TB of patient data was stolen, including behavioral health records. The attackers threaten to contact patients directly if Ridgeway doesn't respond within 72 hours.
Day shift arrives. Downtime forms exist, but half the nurses on the trauma center's med-surg floors have never used them. The printed medication records from the last automatic downtime report are already nine hours old.
Forensics says the attackers still have privileged access and can't guarantee the health record servers are clean. Going dark means shutting down every network connection and the health record at all four hospitals — paper operations for possibly two to three weeks, and likely diversion. Targeted isolation keeps the health record running while the infected segments are cut off, at the risk that the attackers reach it next. Incident command has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
The network is shut down and all four hospitals move to paper. Then the internal phone system goes silent — it runs over the same network. Units start using overhead paging, runners, and personal cell phones to coordinate care.
Regional EMS diverts trauma and stroke patients away from Ridgeway Medical Center. The next-closest trauma center is 70 minutes away for some rural counties. A neighboring hospital's CEO calls to say his emergency department is already over capacity.
A transcription error on a paper order leads to a patient nearly receiving a double dose of a blood thinner. A nurse catches it at the bedside. It's the third medication near-miss reported since the shutdown.
Nurses are working sixteen-hour shifts to keep up with paper documentation. Agency nurses can't work effectively without the health record, and the nurses' union files a formal safe-staffing concern.
Ridgeway hasn't billed a claim in four days and is losing about $14M in cash flow a week. The CFO argues the revenue cycle systems should be restored before some clinical systems, to protect the system's cash position.
The attackers publish 10,000 patient records on their leak site, including behavioral health notes. Patients begin calling, some in distress. Local media start reading the records.
Forensics clears the health record environment for restoration from backups. But six days of paper records — orders, notes, medication administrations — now have to be entered back into the system before clinicians can rely on it again.
Federal and state health regulators ask for an incident report, including how patient safety was maintained during the downtime and how many patients were diverted.
The trauma center's systems could be brought back two days before the other hospitals, ending diversion sooner. Forensics warns that a partial restoration increases the risk of reinfection if any attacker foothold remains. Incident command has to decide.
The post-incident review finds that infusion pumps and patient monitors share a flat network with business systems. Proper segmentation will take about 18 months and $30M that isn't in the capital plan.
Imaging and laboratory networks are cut off, and the health record stays online. Clinicians are relieved. Nobody writes down what would trigger a full shutdown, or who would call it.
With the lab system isolated, results are called and faxed to units. Emergency department waits pass six hours, and admitted patients board in hallways while beds wait on lab clearance.
The attackers use a service account to reach a health record interface server. Two application servers are encrypted before security cuts them off. The health record goes down at two hospitals mid-shift — with no fresh downtime printouts.
For three hours, nurses at the trauma center have no medication records for 400 inpatients. They reconstruct schedules with pharmacy from memory and handwritten notes. One missed insulin dose is reported.
Incident command shuts down the entire network — the decision it declined the day before, now made at night, after an unplanned outage, with staff already exhausted.
Ridgeway goes on diversion. EMS leaders are frustrated by the back-and-forth and ask why they weren't warned that a full shutdown was possible.
The attackers email several hundred patients directly, attaching excerpts of their own records and urging them to pressure Ridgeway to pay.
The cyber insurer questions whether the decision to keep systems running despite active attacker access breached the policy's duty to mitigate. Coverage for parts of the loss is now in dispute.
Forensics finds the attackers had access to the backup management console. The most recent backups can't be verified as clean for another week. Offline backups from nine days ago are clean, but restoring them loses nine days of clinical data. Incident command has to decide.
The board asks why the option chosen to protect clinical operations ended up causing a worse outage — and whether the decision on Day 1 was made by clinical and technical leaders together.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Ridgeway scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Ridgeway exercise is a sample — built to show how a healthcare ransomware simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your hospitals, your clinical systems, and your downtime procedures.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio