Digital Care Hub has launched a series of new resources to help adult social care providers plan how they will communicate with key stakeholders in the event of a cyber incident. These include people drawing on care, families, staff, partner organisations and relevant public bodies. Developed in collaboration with Dr Jason R.C. Nurse, Reader in Cyber Security at Kent’s School of Computing (part of the LASE University Group), the resources help providers prepare clear, useful communications before an incident occurs.
The resources include separate checklists for home care and residential care services in the UK to help plan their response and communications. They are designed to sit alongside a provider’s Business Continuity Plan. The resources draw on Dr Nurse’s research framework for communicating following a cyber incident, and have been adapted to reflect guidance for the sector. More about this framework can be found in this research article, ‘A framework for effective corporate communication after cyber security incidents’.
When a cyber incident or attack occurs, the situation can escalate very quickly. Systems may be down, information may be unclear and staff, families, commissioners and suppliers may all need updates at the same time. Employees responsible for communicating may feel under pressure. In that moment, it is easy for people to panic or say too much too soon, or forget about a key contact. The checklists give providers a simple structure to follow, helping them decide who needs to be contacted, what should be said and when the next update should follow.
This is a first-of-its-kind communication toolkit for the sector because it’s not something that’s been widely considered by care providers. The checklists cover the practical steps that are easy to overlook until they are needed. They prompt providers to identify key roles, keep printed and offline copies of important contacts, agree back-up communication routes, prepare short holding statements and practise their response at least once a year. They also include prompts for the first few hours of an incident, stakeholder updates and post-incident review.
For residential care services, the checklist also looks at the extra risks linked to digital systems, connected equipment and building-based technology, such as digital care records, electronic medication administration records, nurse call systems, falls sensors, Wi-Fi, phones and access control.
Dr Nurse said: ‘Effective communication is essential to planning for and responding to cyber incidents, but it is often overlooked. These new resources will help care organisations strengthen their cyber resilience and respond more effectively when incidents occur. While good communication will not solve a cyber incident alone, it can help to manage a challenging, rapidly changing situation and empower staff to get their messaging right for affected individuals who need reassurance.’
Daniel O’Shaughnessy, Head of Delivery at Digital Care Hub, said: ‘A cyber incident is not just a technical problem. It can affect care, staff confidence, family trust and the ability to keep services running. That is why communications planning is an important part of business continuity planning. Providers need to know who they will contact, what they will say, when they will update people and how they will reach them if normal systems are not working. Even basic things, like keeping contact details up to date, can make a real difference in a crisis.’
The research framework which underpins this new toolkit has also been used to support other sectors, most notably the higher education sector, local government, and the business sector.