Most organizations have an incident response plan, but how well would it hold up if your normal communication channels suddenly couldn’t be trusted? In this episode, we dive into a nationwide healthcare cybersecurity exercise that challenged participants to think beyond compliance and technical defenses, exposing just how critical preparation, collaboration, and secure communication become during a large-scale cyber crisis. Along the way, a surprising real-world AI development reminds us that tomorrow’s threats may arrive sooner than anyone expects.
In this episode:
Operation Vital Signs Got Real – Ep 572
Today’s Episode is brought to you by:
Kardon
and
HIPAA for MSPs with Security First IT
Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity.
Great idea! Share Help Me With HIPAA with one person this week!
Learn more about Kardon Club and HIPAA for MSPs!
Thanks to our donors. We appreciate your support!
If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com
Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA
Episode Roadmap
[01:00] HIPAA Right of Access—Big Changes Delayed, What to Expect Next [05:20] Operation Vital Signs: Sector-Wide Cyber Tabletop Hits Healthcare [08:02] Tabletop Exercise Basics—Learning by Simulation [10:05] Real-World Scenarios: Responding to a Cloud Identity Provider Crisis [12:19] Sector Collaboration—Handling Insurance, Forensics, and Massive Claims [16:04] Stepping Outside the Microsoft Ecosystem—Why Alternative Communication Matters [18:48] Communication: The Core Challenge in Healthcare Cyber Incidents [23:21] OpenAI’s Autopilot Hack—AI Launches an Attack on Its Own [29:16] AI Attacks: What Happens When the Tool Goes Stealth and Wide [36:01] Lessons Learned—Sector Readiness, Trusted Relationships, and Avoiding OverconfidenceOperation Vital Signs Got Real
Before we get started we have great news – maybe! There was something else posted in the OCR Agenda that we missed when we were talking about the Privacy Rule changes coming soon:
HIPAA Privacy Rule to Promote Individuals’ Timely Access to their Protected Health Information
HHS plans to issue a notice of proposed rulemaking (NPRM) to solicit comments on proposals to modify the Privacy Rule. The proposals would address the amount of time that covered entities have to respond to requests for protected health information (PHI) made pursuant to the right of access.
We caught this one up from The Washington Debrief that is published by the team at CHIME. If you don’t subscribe to it, you should.
What Is Operation Vital Signs
Here are the bullets from the opening session that covers that question perfectly:
- A sector-wide tabletop exercise focused on response, impact management, recovery, and coordination.
- Hosted by HSCC and Health-ISAC for the Healthcare and Public Health Sector
- Two half-day virtual sessions on July 21-22, 2026
- Designed to examine organizational response, impact management, and recovery from a significant cyber incident
- Final output: a sector-wide report summarizing insights, strengths, gaps, and opportunities for improvement
How Did It Work
The exercise itself was run by Booz Allen. There would be an Inject of information on the scenario and then each organization would do an internal discussion for 30-45 minutes.
After that we would go back to the group meeting for a discussion in the meeting space with a variety of panelists from the sector. Most were actually participating with their org in some way.
Then, it would begin again with another Inject. We did a total of 7 Injects over the two days.
We promoted it with our Kardon Club Members who were also invited to join us at any time plus a follow up at the end of each day. We opened the Hangout meeting link and kept it open all afternoon both days. People could come and go with questions and discussions.
How Did It Go
Turns out it was very timely and super informative. Everyone attending learned something new.
The first session was attended by over 600 participants logging into the meeting space. Even by the last sessions there were well over 400 still participating. Keeping in mind that some of those were entire meeting rooms full of people we could see but they only counted as one of those numbers. Very exciting to have so many attend and even in our club we had several organizations participating.
It was really surprising just how eerily timely the scenario turned out to be:
OpenAI says rogue AI models broke free from human control. Some see it as a ‘warning shot’
I think there will be a lot of action that comes from this session – we had so many major things in those group discussions coming from all over the space.
The following comment from a Kardon Club Member just after the first day pretty much sums up the value even the small groups got from the experience:
Coming from the person at a smaller scale organization that is direct support, in the past I would have to rely on information coming out on the news releases and support articles. Definitely great experience that has given some tools and resources for future events.
The biggest takeaway from this discussion is simple: preparation happens long before an incident ever occurs. Whether it’s building relationships, testing response plans, or identifying secure ways to communicate when normal systems fail, the organizations that practice today will be in a much better position when the next major cyber event arrives. Hopefully, this conversation gives you a few ideas to put into action before you ever need them.
Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!
HIPAA is not about compliance,
it’s about patient care.TM
Special thanks to our sponsors Security First IT and Kardon.
