Healthcare

Identify the systems whose loss would interrupt medication administration, diagnostics, scheduling, prescribing, or access to clinical histories. Document dependencies on identity services, communications, billing platforms, and external laboratories. A working application is not enough if staff cannot authenticate or retrieve the information needed to use it.

Create downtime procedures with clinicians, not just technology teams. Keep approved alternatives accessible during a network outage and rehearse reconciliation when normal systems return. Dewey can support response coordination, while clinical leaders retain authority over care delivery and safety-sensitive operational decisions.

• Exercise an outage affecting both electronic records and a major service provider.
• Restore identity, network dependencies, and clinical applications in a documented sequence.

Maintain an inventory of medical devices, remote-support paths, and vendor-managed systems. Record the manufacturer, clinical owner, software status, network location, and maintenance restrictions. Devices that cannot accept standard security software need compensating controls rather than unsupported modifications.

Segment clinical equipment from general office networks and limit vendor access to approved windows. Begin monitoring with methods reviewed by biomedical engineering. Librarian and Relay can support inventory and integration work; any testing, isolation, or configuration change requires approval from the relevant clinical and technical owners.

• Require strong authentication for remote access where supported.
• Confirm contracts address access, incident reporting, and return or deletion of patient information.

Map where protected health information is collected, exchanged, stored, and retained. Review access by role and investigate unusual exports without assuming every large transfer is malicious. Include research repositories, patient messaging, transcription services, and AI tools in the assessment.

Use Judge to organize evidence against applicable requirements and Growler to support incident documentation. Legal and privacy teams must determine whether an event is a reportable breach and which notices are required. Dewey may help prepare response materials, but notification decisions, submissions, and public statements remain subject to human approval.

• Test restoration of representative clinical records.
• Review minimum-necessary access when employees change roles.