What Should a Hospital Board Ask About Cybersecurity?

A hospital board should ask five kinds of cybersecurity questions: what keeps patient care running if systems go down, how fast the hospital can recover, who is accountable, which vendors could take the hospital offline, and how the board will know any of this before a crisis answers for it. HIPAA compliance status matters. It is the floor, not the answer.

Here is how it usually goes. The quarterly packet has one cybersecurity slide near the back. Patching is on track, phishing tests look better, the annual risk assessment is done. Everything is green, so nobody asks a follow-up question.

Then the EHR goes dark on a Tuesday night. The board learns, in real time, that nobody ever tested how long the emergency department could run on paper.

If the board only hears about IT when something breaks, it's hearing about it too late.

The stakes are measured in patients, not tickets. Researchers at the University of Minnesota School of Public Health linked hospital ransomware attacks to Medicare claims. Among patients already admitted when an attack began, in-hospital mortality rose 35% to 41%, and hospital volume fell 17% to 26% in the first week.

Why does cybersecurity belong on the hospital board agenda?

Short answer: A cyberattack on a hospital is a patient safety event and a financial event before it is an IT event. Research from the University of Minnesota found mortality rose for patients admitted during ransomware attacks, and volume dropped for weeks. Five Nines Technology Group treats board cyber oversight the same way boards treat clinical quality: as a duty, not a briefing.

Boards already own the risks that can close a hospital: quality, finance, reputation, regulatory standing. A ransomware attack touches all four at once. Ambulances divert. Elective procedures get postponed. Claims stop moving. In the Minnesota study, volume took up to three weeks to recover.

The American Hospital Association has said the same thing for years. Its national advisor for cybersecurity and risk, John Riggi, has told leaders that cyber risk is not just an IT issue or the security team's job alone (AHRQ PSNet interview).

That raises the harder question. If the risk is this big, why does it get one slide?

What is wrong with the way most boards hear about cybersecurity?

Short answer: Most hospital board reports measure activity and compliance: patches applied, training completed, assessments filed. Those numbers describe the IT department. They do not tell the board how long clinical operations can continue during an outage or how fast systems come back. Five Nines calls that the gap between being compliant and being recoverable.

Most boards think their cyber problem is a knowledge problem. It is not. It is a reporting problem.

Board members do not need to understand endpoint detection or log correlation. They need management to report the numbers that connect technology to care. When the packet only shows controls, the board can only ask about controls.

What Leadership Misses

A report full of green checkmarks tells the board the controls exist. It does not tell the board whether the hospital can keep treating patients when those controls fail.

What are the 10 questions a hospital board should ask about cybersecurity?

Short answer: The most useful board questions focus on continuity and recovery, not tools. Five Nines recommends ten, grouped around four themes: can we keep caring for patients, how fast can we recover, who could take us down from the outside, and who is accountable. Each has a clear sign of a strong answer.

1. If our network went down tonight, what would still work, what wouldn't, and what's the plan? This is the AHA's own three-part test for leadership (AHA Trustee Insights). A strong answer names systems and departments, not general reassurance.
2. How many hours can each clinical area safely run on downtime procedures, and when did we last test that? A strong answer has a number per area and a date. "We have a downtime binder" is not a number.
3. How long would it take to restore the EHR from backup, and have we proven it? A strong answer comes from a timed test, not a vendor estimate.
4. Could an attacker inside our network reach our backups? A strong answer describes backups that are isolated or immutable, so ransomware cannot encrypt or delete them.
5. Which vendors could stop patient care or billing if they were breached, and what's our plan for each? A strong answer is a ranked list with a workaround for the top names.
6. Who owns cyber risk on the leadership team, and who makes the call to divert or go to paper? A strong answer names people, not departments.
7. What would a ransomware event cost us, and how much of that does our cyber insurance actually cover? A strong answer includes lost volume and recovery cost, plus confirmation that our insurance attestations match the real environment.
8. Who is watching our environment at 2 a.m., and how fast do they act? A strong answer describes people investigating around the clock, not alerts waiting in an inbox until morning.
9. When would the board be called during an incident? A strong answer points to a written escalation policy, which the AHA's trustee guidance recommends every incident response plan include (AHA).
10. What are we funding next year, and which risk does each dollar retire? A strong answer ties each investment to a named risk and a measurable change, often mapped to the HHS Healthcare and Public Health Cybersecurity Performance Goals.

What does good board-level cybersecurity reporting look like?

Short answer: Good reporting tells the board what the hospital can survive, not just what the IT team did. The Five Nines Board Cyber Oversight Ladder describes four stages, from boards that only hear about IT when something breaks to boards that know their tested downtime hours and restore times. Most hospitals can identify their stage in under a minute.

The Five Nines Board Cyber Oversight Ladder

The jump that matters most is from Stage 2 to Stage 3. Compliance answers the regulator's question. Risk reporting starts answering the board's. Stage 4 is where the board stops asking "are we protected?" and starts asking "what can we survive?"

Five Nines Insight

A board that knows its uptime percentage but not its downtime hours is measuring the wrong side of the problem.

How long can your hospital keep caring for patients if systems go down?

Short answer: Most hospitals do not know, because the number has never been tested. The board should ask for two measured figures: how many hours each clinical area can safely operate on downtime procedures, and how long a full EHR restore takes. Five Nines builds board reporting around those two numbers because they translate directly into patient risk.

The AHA's 2025 trustee guidance puts it plainly: cybersecurity is no longer only about preventing breaches. It is about safe continuity of care during an attack, with readiness measures that are tested (AHA Trustee Insights).

Testing changes the conversation. A downtime plan reviewed in a meeting feels complete. A downtime drill on the med-surg floor shows where the paper forms are missing, who doesn't know the backup login, and which lab results stop flowing.

The Hidden Risk

Most downtime plans are written for an EHR outage that lasts an afternoon. Ransomware recovery is measured in weeks.

Who is accountable when a hospital vendor is breached?

Short answer: The hospital is. Under HIPAA, the covered entity remains ultimately responsible for breach notification even when the breach happens at a business associate, according to the HHS Office for Civil Rights. Boards should expect a vendor criticality list, current business associate agreements, and a continuity plan for the vendors patient care depends on.

The Change Healthcare attack made this real for thousands of providers that never touched the compromised systems. In its Change Healthcare FAQ, HHS OCR states that Change Healthcare reported approximately 192.7 million people affected. The same guidance confirms the covered entity is responsible for making sure notifications happen.

For a board, the lesson is direct. Your risk includes every vendor that touches claims, imaging, labs, scheduling, and the EHR. If management cannot rank those vendors by how much patient care depends on them, that is the first gap to close.

What does Five Nines look for when a hospital board asks for a cyber briefing?

• Reports that stop one level short. Security metrics reach the CIO but never make it into the board packet in a form directors can use.
• Backups that run but have never been timed. Nightly jobs succeed, yet nobody has measured a full EHR restore from start to finish.
• Downtime procedures written by IT, not clinicians. The plan covers servers in detail and says little about how a nurse documents a medication pass.
• Vendor lists with no ranking. Every vendor has a contract on file. None are ranked by how much patient care depends on them.
• Insurance answers that drift from reality. Questionnaire responses about MFA or monitoring were accurate at renewal and have not been checked since.
• No named decision-maker for going to paper. Everyone agrees it would be decided quickly. Nobody can say who decides.

Does your board know how long your hospital can run offline?

If your last cyber update was one green slide, you are not alone, and you are not alone in not knowing what it left out.

A Five Nines board cybersecurity briefing identifies:

• Where your board sits on the Five Nines Board Cyber Oversight Ladder today
• Tested versus assumed downtime hours for your key clinical areas
• Your real EHR restore time compared with what leadership expects
• The vendors patient care depends on most, and the single points of failure behind them
• Gaps between your cyber insurance attestations and your actual environment

You leave with a board-ready risk summary and a 12-month roadmap that ties each investment to the risk it retires.

The best time for a board to learn its recovery time is in a conference room, not in a crisis.