Industries
Care can't stop. Neither can the systems behind it.
Hospitals, health systems, health insurers, and healthcare technology companies face the same reality: when operations stop, patients and members feel it first, and regulators, boards, and the public ask questions next.
We help healthcare organizations build business continuity, emergency management, crisis management, and IT disaster recovery programs that work on the worst day, satisfy the regulators and auditors who check them, and stay simple enough for your teams to use.
✅ Practitioner-led, not advisory
✅ One program that answers to CMS, the Joint Commission, HIPAA, and HITRUST
✅ Tested in real exercises, not just on paper
What we hear from healthcare leaders
We’ve worked with hospitals, health systems, health insurers, and healthcare technology companies for more than a decade. We hear the same things from the people who run their programs:
“We have two different crisis teams. Nobody is sure who’s in charge.”
“Our severity levels are confusing, and we have two crisis plans that overlap.”
“The HITRUST assessment is coming, and the lifecycle has to be buttoned up before it starts.”
“The board told us which services are critical. Now the program has to protect them.”
“We don’t know what we’d recover first, or what’s tied to what.”
“My biggest concern is whether our people can sustain it for weeks.”
“I don’t have enough time and hands.”
Sound familiar? You don’t need another consultant to tell you what you already know. You need practitioners who will simplify the program, build what’s missing, and help you run it.
The healthcare reality
Healthcare organizations answer to more continuity and emergency requirements than almost any other industry, often all at once:
- The CMS Emergency Preparedness Rule applies to 17 provider and supplier types and requires four core elements: an emergency plan based on an all-hazards risk assessment, policies and procedures, a communication plan, and a training and testing program.
- The Joint Commission’s Emergency Management chapter, revised in 2022, put new weight on continuity of operations, leadership succession, recovery, and evaluating exercises.
- The HIPAA Security Rule requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan.
- HITRUST expects business continuity built into your security program, a continuity risk assessment, and documented, tested plans with evidence they’re maintained.
The threats move faster than the rules. The February 2024 ransomware attack on Change Healthcare disrupted claims processing, pharmacy transactions, and provider payments across the United States for weeks, including at organizations that were never attacked themselves. And AI tools are now spreading through healthcare faster than many organizations can govern them.
The answer isn’t a separate binder for every requirement. It’s one program, with one set of plans, one crisis structure, and one testing calendar, that satisfies all of them.
How we help healthcare organizations
- Resiliency Diagnosis®. A standards-based evaluation of your continuity, crisis, and recovery capabilities, with a maturity score and a prioritized roadmap, in about 12 weeks.
- Operational resilience. One program across business continuity, crisis management, and IT disaster recovery, organized around the services your members and patients depend on, with impact tolerances your executives set.
- Emergency management programs. System emergency management programs aligned to ISO 22361 and Joint Commission requirements, with governance that connects emergency management, business continuity, and crisis management.
- Business continuity and Business Continuity as a Service. BIAs, plans, governance, and exercises, built with you or run for you.
- Resilience as a Service. Business continuity, crisis management, IT disaster recovery, and exercises, run as one program.
- IT disaster recovery. Recovery requirements, plans, and testing that meet HIPAA and HITRUST and match what clinical and business operations actually need.
- Crisis management and cyber incident response planning. One crisis structure, clear severity levels, and a cyber response that connects the technical team to executive decisions.
- Exercises. Mass casualty, ransomware, executive cyber-extortion, AI-accelerated threats, and business continuity exercises, from tabletops to multi-day simulations.
- Crisis communications. Communication plans and reputation strategy for patients, members, providers, regulators, and the media.
- Business continuity software. Selection and implementation, so your BIAs and plans stop living in spreadsheets.
“
I inherited a program nobody had touched in years. Bryghtpath ran a Resiliency Diagnosis, kept what worked, and rebuilt the rest. Six months in, I have a program I can put in front of the board.
Head of Business Continuity · Healthcare
80+
IT disaster recovery plans built and tested for one HITRUST program
100+
business continuity plans run on one health insurer’s lifecycle
< 1 year
from zero to a tested IT disaster recovery program
ISO 22361
and Joint Commission requirements in one health system emergency management program
Health System
A System Emergency Management Program for a Major Healthcare System
A system emergency management program aligned to ISO 22361 and Joint Commission requirements, with governance that unites emergency management, business continuity, and crisis management.
Read the case study →
Health Insurance
Resilience as a Service for a Health Insurance Leader
With no dedicated continuity or crisis staff, a Midwest health insurer runs business continuity, crisis management, and IT disaster recovery as one program with Bryghtpath.
Read the case study →
Healthcare Technology
Achieving HITRUST Certification for a Major Healthcare Technology Provider
Business continuity, crisis management, and IT disaster recovery built to HITRUST requirements, including more than 80 tested DR plans.
Read the case study →
Programs aligned to
CMS · The Joint Commission · HIPAA · HITRUST · ISO 22301 · ISO 22361 · ISO/IEC 27031
Our healthcare work
All of our case studies are anonymized.
Hospitals and health systems
- A system emergency management program for a major healthcare system in the southwestern United States, aligned to ISO 22361 and Joint Commission requirements. Read the case study.
- A systemwide mass casualty tabletop exercise for one of the largest healthcare systems in the United States. Read the case study.
- Business continuity software for a leading healthcare system in the southwestern United States, replacing spreadsheets and documents for BIAs and plans. Read the case study.
Health insurers
- Resilience as a Service for a leading Midwest health insurer: business continuity, crisis management, and IT disaster recovery run as one program. Read the case study.
- An executive cyber-extortion exercise for a major U.S. health insurer, testing the decisions on payment, member and regulator notification, and board engagement. Read the case study.
- Maturing IT disaster recovery for a leading Midwest health insurer, from an ISO 27031 baseline to a tested program with ransomware scenario planning. Read the case study.
- A first external crisis management exercise for a leading Midwest health insurer. Read the case study.
- Business Continuity as a Service that rebuilt a major health insurance provider’s program, which had lost organizational credibility. Read the case study.
Healthcare technology
- HITRUST certification for a major healthcare technology provider: business continuity, crisis management, and IT disaster recovery built to HITRUST requirements. Read the case study.
- An AI-accelerated threat tabletop, a first-of-its-kind exercise for a leading healthcare technology company. Read the case study.
- A complex cybersecurity simulation for a major U.S.-based healthcare technology organization. Read the case study.
- Business Continuity as a Service for a major healthcare technology company, run day to day for several years. Read the case study.
- Business continuity software for a global healthcare technology firm. Read the case study.
- Ransomware technical tabletop exercises for a leading healthcare technology provider’s IT and product teams. Read the case study.
- A multi-day ransomware exercise for a major U.S. healthcare organization. Read the case study.
- A data breach incident response plan for a major healthcare technology company. Read the case study.
- A business continuity exercise for a major U.S. healthcare organization. Read the case study.
- Crisis communications and reputation strategy for a leading provider of software and services to the healthcare industry. Read the case study.
Global health and life sciences
- A complete resilience program in less than four months for the global health division of one of the world’s largest corporations, during its spinoff. Read the case study.
- A crisis management tabletop exercise for a global healthcare organization recently spun off from its parent company. Read the case study.
More of our healthcare work
- A wholesale reinvention of the enterprise global security program for the top hospital in the United States, as recognized by U.S. News & World Report, including a benchmarking study of other top hospitals and health systems, an internal communications strategy, and the strategy for a new Global Security Operations Center (GSOC).
- An exercise series for a Midwest integrated health system of clinics, hospitals, and emergency medical services that reshaped its IT incident management and tied it to the organization’s emergency management framework.
- A physical security assessment for a Twin Cities integrated health system’s corporate headquarters, which executive leadership used to fund additional resources, equipment, and staff.
Frequently asked questions
Will this help us meet the CMS Emergency Preparedness Rule?
Yes. The rule’s four core elements (an all-hazards emergency plan, policies and procedures, a communication plan, and training and testing) are the foundation of every healthcare program we build, and our exercises are designed to meet its testing requirements.
Do you work to the Joint Commission's emergency management standards?
Yes. We build emergency management programs aligned to the Joint Commission’s revised Emergency Management chapter and to ISO 22361, including continuity of operations, leadership succession, recovery, and exercise evaluation.
What does HIPAA require for disaster recovery?
The HIPAA Security Rule requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan. Testing and an applications and data criticality analysis are addressable. We build IT disaster recovery programs that cover all of them.
We're preparing for HITRUST. Can you help with business continuity?
Yes. We’ve built business continuity, crisis management, and IT disaster recovery programs to HITRUST requirements, including documented, tested plans and the evidence assessors look for.
We have two crisis teams and confusing severity levels. Where do we start?
With a Resiliency Diagnosis®. It shows what you have, what overlaps, and what to simplify first, then gives you a prioritized roadmap toward one crisis structure and one set of severity levels.
Do you work with health insurers and healthcare technology companies, or only hospitals?
All three. Our healthcare work spans hospitals and health systems, health insurers, healthcare technology and software companies, and global health organizations.
Can you run the program for us?
Yes. Through Business Continuity as a Service or Resilience as a Service, our team runs your program day to day, with your people owning the decisions.
We can help.
Let Bryghtpath put its healthcare experience to work for your organization
From the CMS rule to HITRUST to your next ransomware exercise, we’ll help you build a program that holds up when it matters.