{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T09:42:43Z","timestamp":1792748563362,"version":"4.5.0"},"reference-count":23,"publisher":"American Health Information Management Association","issue":"2","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Adv Health Inf Sci Pract"],"published-print":{"date-parts":[[2026,8,12]]},"abstract":"<jats:sec>\n                    <jats:title>Background<\/jats:title>\n                    <jats:p>Cybersecurity incidents, particularly ransomware attacks, pose significant threats to health care systems by disrupting operations, compromising protected health information, and undermining patient trust. Health information management and informatics professionals play a central role in responding to these incidents; however, educational preparation often emphasizes theoretical knowledge with limited opportunities for applied, practice-based learning. This study aims to describe the design, implementation, and evaluation of a multistakeholder tabletop simulation to enhance competencies in cybersecurity incident response, regulatory compliance, and interdisciplinary collaboration.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>A simulation-based educational intervention was implemented in 2 settings, namely, a national professional conference workshop and an undergraduate health information management classroom at a large public research university. The simulation was designed as a multistakeholder tabletop exercise set in a 350-bed acute care hospital experiencing a ransomware attack affecting key systems, including the electronic health record and patient portal. Participants assumed interdisciplinary roles representing leadership, clinical, technical, compliance, and vendor perspectives. A postsimulation survey assessed perceptions of realism, clarity of objectives, debriefing effectiveness, and learning outcomes. Descriptive statistics were used to summarize the responses.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>Participants in both groups strongly agreed that the simulation was realistic, well structured, and effective at reinforcing key learning objectives. The simulation enhanced participants\u2019 understanding of cybersecurity response processes, privacy and security principles, and interdisciplinary roles and responsibilities. Although responses were consistently positive, variation between professional and student participants reflected differences in experience and familiarity with health care operations.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Conclusions<\/jats:title>\n                    <jats:p>This study demonstrates that tabletop simulation is an effective, practice-oriented approach to preparing health information management and informatics learners to respond to complex cybersecurity incidents. By integrating technical, regulatory, and leadership perspectives within a realistic health care context, the simulation supports applied learning and workforce readiness. Simulation-based approaches offer a scalable strategy for strengthening cybersecurity preparedness in health information management and informatics education.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.63116\/ah.000000004","type":"journal-article","created":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T14:22:28Z","timestamp":1787062948000},"source":"Crossref","is-referenced-by-count":0,"title":["Beyond the Firewall: A Multistakeholder Simulation for Cybersecurity Response in Health Information and Informatics Practice"],"prefix":"10.63116","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4846-937X","authenticated-orcid":true,"given":"Shannon H.","family":"Houser","sequence":"first","affiliation":[{"name":"Health Services Administration Department, University of Alabama at Birmingham"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cathy A.","family":"Flite","sequence":"additional","affiliation":[{"name":"Health Services Administration and Policy Department, Temple University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Susan L.","family":"Foster","sequence":"additional","affiliation":[{"name":"Health Information Management Department, Florida SouthWestern State College"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"52461","reference":[{"key":"B1","article-title":"The state of ransomware in healthcare 2024: healthcare organizations hit, ransom payments, and recovery obstacles","author":"Mahendru P.","year":"2024","unstructured":"Mahendru P. The state of ransomware in healthcare 2024: healthcare organizations hit, ransom payments, and recovery obstacles. Sophos News. 2024. Accessed April 26, 2026. https:\/\/www.sophos.com\/en-us\/blog\/the-state-of-ransomware-in-healthcare-2024."},{"key":"B2","article-title":"Cyberattacks are undermining patient care and their trust","author":"Bazzoli F.","year":"2024","unstructured":"Bazzoli F. Cyberattacks are undermining patient care and their trust. Health Data Management. October 11, 2024. Accessed April 26, 2026. https:\/\/www.healthdatamanagement.com\/articles\/cyberattacks-are-undermining-patient-care-and-their-trust."},{"key":"B3","article-title":"What is a cyberattack? Cisco","year":"2026.","unstructured":"Cisco. What is a cyberattack? Cisco. Accessed April 26, 2026. https:\/\/www.cisco.com\/site\/us\/en\/learn\/topics\/security\/what-is-a-cyberattack.html."},{"issue":"5","key":"B4","series-title":"Int J Adv Comput Sci Appl","first-page":"135","article-title":"Cybersecurity in healthcare: a review of recent attacks and mitigation strategies","volume":"14","year":"2023","unstructured":"Al-Qarni EA. Cybersecurity in healthcare: a review of recent attacks and mitigation strategies. Int J Adv Comput Sci Appl. 2023;14(5):135-140. doi:10.14569\/IJACSA.2023.0140518."},{"issue":"9","key":"B5","series-title":"JAMA Health Forum","first-page":"e242764","article-title":"Lessons from the Change Healthcare ransomware attack","volume":"5","author":"Kanter GP","year":"2024","unstructured":"Kanter GP, Rekowski JR, Kannarkat JT. Lessons from the Change Healthcare ransomware attack. JAMA Health Forum. 2024;5(9):e242764. doi:10.1001\/jamahealthforum.2024.2764."},{"issue":"12","key":"B6","series-title":"JAMA Health Forum","first-page":"e224873","article-title":"Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021","volume":"3","author":"Neprash HT","year":"2022","unstructured":"Neprash HT, McGlave CC, Cross DA, Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum. 2022;3(12):e224873. doi:10.1001\/jamahealthforum.2022.4873."},{"key":"B7","article-title":"Survey explores trust in healthcare organizations\u2019 ability to keep data secure. HIPAA Journal","author":"Alder S.","year":"2017","unstructured":"Alder S. Survey explores trust in healthcare organizations\u2019 ability to keep data secure. HIPAA Journal. May 4, 2017. Accessed April 26, 2026. https:\/\/www.hipaajournal.com\/survey-explores-trust-in-healthcare-organizations-cybersecurity-defenses-8793."},{"key":"B8","article-title":"45 CFR \u00a7\u00a7 164.400\u2013414","unstructured":"Electronic Code of Federal Regulations. 45 CFR \u00a7\u00a7 164.400\u2013414. Accessed April 26, 2026. https:\/\/www.ecfr.gov\/current\/title-45\/subtitle-A\/subchapter-C\/part-164\/subpart-D."},{"key":"B9","article-title":"Breach notification rule","year":"2026.","unstructured":"US Department of Health and Human Services. Breach notification rule. Accessed April 26, 2026. https:\/\/www.hhs.gov\/hipaa\/for-professionals\/breach-notification\/index.html."},{"key":"B10","article-title":"Health Information Technology for Economic and Clinical Health (HITECH) Act, \u00a713402, Pub L No. 111-5, 123 Stat 226","year":"2009","unstructured":"Health Information Technology for Economic and Clinical Health (HITECH) Act, \u00a713402, Pub L No. 111-5, 123 Stat 226 2009."},{"key":"B11","article-title":"NIST cybersecurity framework","unstructured":"National Institute of Standards and Technology. NIST cybersecurity framework. Accessed April 26, 2026. https:\/\/www.nist.gov\/cyberframework."},{"key":"B12","article-title":"Health Sector Cybersecurity Coordination Center (HC3)","unstructured":"US Department of Health and Human Services. Health Sector Cybersecurity Coordination Center (HC3). Accessed April 26, 2026. https:\/\/www.hhs.gov\/about\/agencies\/asa\/ocio\/hc3\/index.html."},{"key":"B13","unstructured":"Cybersecurity and Infrastructure Security Agency. Accessed April 26, 2026. https:\/\/www.cisa.gov."},{"key":"B14","series-title":"Comput Secur","first-page":"103585","article-title":"A systematic review of current cybersecurity training methods","volume":"136","author":"Pr\u00fcmmer J","year":"2024","unstructured":"Pr\u00fcmmer J, van Steen T, van den Berg B. A systematic review of current cybersecurity training methods. Comput Secur. 2024;136:103585. doi:10.1016\/j.cose.2023.103585."},{"key":"B15","series-title":"J Med Internet Res","first-page":"e46904","article-title":"Vulnerability to cyberattacks and sociotechnical solutions for health care systems: systematic review","volume":"26","author":"Ewoh P","year":"2024","unstructured":"Ewoh P, Vartiainen T. Vulnerability to cyberattacks and sociotechnical solutions for health care systems: systematic review. J Med Internet Res. 2024;26:e46904. doi:10.2196\/46904."},{"issue":"2","key":"B16","series-title":"Adv Health Inf Sci Pract","first-page":"RBQG5825","article-title":"Shaping the future of health information management: the impact of emerging technologies on the workforce","volume":"1","author":"Houser SH","year":"2025","unstructured":"Houser SH, Crew D, Flite CA, Goethals C. Shaping the future of health information management: the impact of emerging technologies on the workforce. Adv Health Inf Sci Pract. 2025;1(2):RBQG5825. doi:10.63116\/RBQG5825."},{"issue":"1","key":"B17","series-title":"Perspect Health Inf Manag","first-page":"1f","article-title":"Privacy and security risk factors related to telehealth services: a systematic review","volume":"20","author":"Houser SH","year":"2023","unstructured":"Houser SH, Flite CA, Foster SL. Privacy and security risk factors related to telehealth services: a systematic review. Perspect Health Inf Manag. 2023;20(1):1f."},{"key":"B18","series-title":"Experiential Learning: Experience as the Source of Learning and Development","author":"Kolb DA.","year":"1984","unstructured":"Kolb DA. Experiential Learning: Experience as the Source of Learning and Development. Prentice-Hall; 1984."},{"issue":"3","key":"B19","series-title":"J Health Adm Educ","first-page":"213","article-title":"Creating a tabletop escape room activity to enrich student\u2019s change management education","volume":"37","author":"Allgood A","year":"2020","unstructured":"Allgood A, Brown M, Meese K, Borkowski N. Creating a tabletop escape room activity to enrich student\u2019s change management education. J Health Adm Educ. 2020;37(3):213-222."},{"issue":"27","key":"B20","series-title":"Medicine (Baltimore)","first-page":"e38813","article-title":"The impact of simulation-based training in medical education: a review","volume":"103","author":"Elendu C","year":"2024","unstructured":"Elendu C, Amaechi DC, Okatta AU, The impact of simulation-based training in medical education: a review. Medicine (Baltimore). 2024;103(27):e38813. doi:10.1097\/MD.0000000000038813."},{"issue":"1","key":"B21","series-title":"Adv Health Inf Sci Pract","first-page":"YRUD1773","article-title":"Incorporating experiential learning into health information education: enhancing curriculum with real-world applications","volume":"1","author":"Houser SH","year":"2024","unstructured":"Houser SH, Flite CA, Foster SL, Incorporating experiential learning into health information education: enhancing curriculum with real-world applications. Adv Health Inf Sci Pract. 2024;1(1):YRUD1773. doi:10.63116\/YRUD1773."},{"key":"B22","series-title":"Res Sq (Preprint)","article-title":"Design and pilot study of a high-fidelity medical simulation of a hospital-wide cybersecurity attack","author":"Marsh-Armstrong B","year":"2024","unstructured":"Marsh-Armstrong B, Pacheco F, Dameff C, Tully J. Design and pilot study of a high-fidelity medical simulation of a hospital-wide cybersecurity attack. Res Sq (Preprint). 2024. doi:10.21203\/rs.3.rs-3959502\/v1."},{"issue":"5","key":"B23","series-title":"Appl Clin Inform","first-page":"921","article-title":"Design and implementation of tabletop cybersecurity simulation for health informatics graduate students","volume":"15","author":"Blanchard EE","year":"2024","unstructured":"Blanchard EE, Feldman SS, White ML, Allen R, Phillips T, Brown MR. Design and implementation of tabletop cybersecurity simulation for health informatics graduate students. Appl Clin Inform. 2024;15(5):921-927. doi:10.1055\/s-0044-1790551."}],"container-title":["Advances in Health Information Science and Practice"],"original-title":[],"link":[{"URL":"https:\/\/ahisp.kglmeridian.com\/view\/journals\/3995\/2\/2\/article-eah.000000004.xml","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ahisp.kglmeridian.com\/downloadpdf\/journals\/3995\/2\/2\/article-eah.000000004.xml","content-type":"text\/html","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/ahisp.kglmeridian.com\/downloadpdf\/journals\/3995\/2\/2\/article-eah.000000004.xml","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T09:14:26Z","timestamp":1792746866000},"score":1,"resource":{"primary":{"URL":"https:\/\/ahisp.kglmeridian.com\/view\/journals\/3995\/2\/2\/article-eah.000000004.xml"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":23,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.63116\/ah.000000004","relation":{},"ISSN":["3066-5825"],"issn-type":[{"value":"3066-5825","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}