What is a healthcare SOAR tabletop exercise and how should a hospital run one in 2026?

What a Healthcare SOAR Tabletop Exercise Actually Is

A SOAR tabletop exercise is a structured, discussion-based simulation in which a hospital's incident-response team walks through a realistic cyber or operational disruption scenario without executing live actions on production systems. SOAR stands for Security Orchestration, Automation, and Response, and in the healthcare context it borrows the same terminology used by Security Operations Centers (SOCs) to describe how alerts are triaged, enriched, and remediated. The tabletop format itself predates SOAR software and traces back to broader emergency preparedness doctrine, including the Johns Hopkins Center for Health Security's Event 201 pandemic simulation hosted with the World Economic Forum and the Bill & Melinda Gates Foundation in New York in October 2019. That exercise modeled a fictional coronavirus outbreak across 15 fictional countries and produced eight recommended actions that have since shaped public-health preparedness thinking. Healthcare organizations now use the same tabletop methodology to rehearse ransomware, EHR outage, medical-device compromise, and supply-chain disruption scenarios.

Also worth reading: How Can Healthcare Hygiene, Compliance & Safety Software Improve Hospital Operations? · How Can Healthcare AI Governance Accelerate B2B SafetyOps? · How Can Clinical AI Governance Programs Make Healthcare Safer and More Compliant?

The defining feature of a tabletop is that participants sit around a table (or in a video conference) and talk through what they would do, who they would call, and which systems they would touch. No packets are dropped, no servers are powered off, and no real patients are affected. The value comes from surfacing gaps in runbooks, decision rights, escalation paths, and tooling before a real crisis exposes them. For a B2B healthcare hygiene, compliance, and safety-ops audience, the tabletop is the cheapest rehearsal format available: it requires only a facilitator, a scenario script, two to four hours of protected time, and a willingness to be wrong in front of colleagues.

Why Tabletops Matter More in 2026 Than They Did in 2020

Three forces have made tabletop exercises non-optional for healthcare delivery organizations in 2026. First, the average cost of a healthcare data breach reached $9.77 million in 2024 according to IBM's annual Cost of a Data Breach report, the highest of any industry for the 14th consecutive year. Second, the HIPAA Security Rule NPRM published in late 2024 proposed explicit requirements for annual incident-response testing, with tabletop exercises named as the minimum acceptable method for most covered entities. Third, the proliferation of connected medical devices, ambient AI scribes, and cloud-hosted EHR integrations has multiplied the number of failure modes that a single IT team must understand.

A tabletop exercise forces cross-functional alignment between groups that rarely share a calendar: clinical informatics, infection prevention, facilities, legal, compliance, supply chain, and external vendors. In a real ransomware event, those groups have minutes, not hours, to coordinate. In a tabletop, they have the luxury of pausing the scenario to debate who owns the decision to divert ambulances, when to notify the Department of Health and Human Services Office for Civil Rights, and how to communicate with patients whose data has been exfiltrated. That rehearsal is what separates organizations that recover in days from those that take months.

Anatomy of a Healthcare SOAR Tabletop Scenario

A well-designed scenario has four components: an inject schedule, a decision log, a metrics sheet, and a debrief template. The inject schedule is a time-stamped list of facilitator prompts that introduce new information every 10 to 15 minutes, such as "At 09:15 the SOC receives an alert that a workstation in the radiology reading room is beaconing to a known malicious IP" or "At 10:30 the lab reports that chemistry analyzers are returning intermittent invalid results." The decision log captures who made which call, what evidence they used, and how long it took. The metrics sheet tracks mean time to detect, mean time to contain, mean time to notify, and the number of runbook deviations. The debrief template converts observations into action items with owners and due dates.

Scenarios should be plausible, specific to the organization's risk profile, and designed to expose at least three failure modes. A community hospital might rehearse a regional power utility failure combined with a ransomware note, while an academic medical center might rehearse a zero-day in a widely deployed medical-device firmware. The scenario should never be a worst-case apocalypse; it should be a Tuesday-morning incident that escalates because of small gaps in process. Event 201 used a similar design philosophy: a plausible coronavirus outbreak, not a civilization-ending pandemic, so that participants could focus on response decisions rather than scenario disbelief.

How to Run One in Six Practical Steps

Step one is to charter the exercise with executive sponsorship, ideally the CIO, CISO, or Chief Quality Officer. Without a named sponsor, mid-level participants will not prioritize the session over clinical duties. Step two is to assemble a planning team of four to six people representing IT, clinical operations, compliance, legal, and facilities. Step three is to select a scenario from a published library or to write a custom one; the HHS 405(d) Program and the Health Sector Coordinating Council publish free scenario templates that map to the NIST Cybersecurity Framework. Step four is to schedule a two-to-four-hour block during a low-census period, ideally mid-morning on a Tuesday or Wednesday, and to protect that time from being cancelled.

Step five is to facilitate the session using a neutral facilitator who is not the CISO. The facilitator's job is to inject information, pause for decisions, and resist the temptation to solve problems on behalf of the team. Step six is to produce a written after-action report within ten business days, assign action items, and track them in the same governance system used for audit findings. Organizations that skip the after-action report treat the tabletop as a one-off event rather than a continuous improvement loop, which is the most common failure mode observed in maturity assessments.

Comparing Tabletop Formats and Adjacent Methods

The discussion-based tabletop is the right starting point for most healthcare organizations in 2026 because it is cheap, repeatable, and accepted by every major regulator. Functional drills and full-scale exercises are appropriate once the organization has demonstrated baseline competence. Red team engagements test the SOC's tooling and detection engineering rather than the broader incident-response program, so they answer a different question.

Common Mistakes That Undermine Tabletop Value

The most frequent mistake is treating the tabletop as a test of individual knowledge rather than of organizational process. Participants arrive having memorized the incident response plan, recite the steps, and the facilitator marks the exercise a success. Nothing is learned because the plan was never stress-tested against a scenario that forced deviation. A second mistake is inviting only IT and security staff; clinical, legal, and communications leaders must be in the room or the exercise will not surface the decisions that actually delay response. A third mistake is using a scenario that is too exotic, such as a coordinated nation-state attack on the electrical grid, which produces interesting conversation but no actionable findings.

A fourth mistake is failing to pre-position the SOAR platform. If the organization has invested in a Security Orchestration, Automation, and Response tool such as Splunk SOAR, Palo Alto XSOAR, or Tines, the tabletop should walk through actual playbooks rather than describing them abstractly. A fifth mistake is closing the exercise without a written after-action report and tracked action items. A sixth mistake is running the same scenario every year; participants memorize the script and the exercise becomes theater. Rotating between ransomware, third-party SaaS outage, insider threat, and medical-device compromise scenarios keeps the program honest.

When to Run a Tabletop and How Often

The HIPAA Security Rule NPRM proposes annual tabletop exercises for covered entities, with more frequent testing for business associates that handle large volumes of protected health information. The Joint Commission expects hospitals to test their emergency operations plans twice per year, with one test being a tabletop and the other being either a functional drill or a full-scale exercise. The CMS Conditions of Participation require hospitals to have disaster plans that are rehearsed, though CMS does not prescribe a specific frequency. From a risk-management perspective, a reasonable cadence is one baseline tabletop in Q1, one scenario-specific tabletop in Q3 timed to a known risk window (for example, respiratory virus season or hurricane season), and one no-notice inject drill embedded in a routine operations meeting.

Organizations that have experienced a real incident in the prior 12 months should run a retrospective tabletop within 90 days of recovery to test the updated runbooks. Organizations that have undergone a major change such as an EHR go-live, a merger, or a migration to a managed detection and response provider should run a tabletop within 60 days of cutover. The cost of a tabletop is small enough that the question is rarely whether to run one but whether to run it well.

Cost, Tooling, and What Hygiea Readers Should Do Next

A baseline internal tabletop costs between $2,000 and $15,000 when fully loaded, including facilitator time, participant salaries for four hours, and the opportunity cost of cancelled meetings. External facilitators from firms such as Mandiant, CrowdStrike Services, or Booz Allen typically charge $5,000 to $25,000 per session. Scenario libraries from the HHS 405(d) Program, the Health Sector Coordinating Council, and the Cyber Threat Alliance are free. SOAR platforms add licensing cost but reduce the per-incident labor cost of triage and enrichment; published benchmarks suggest a 60 to 80 percent reduction in analyst hours per alert when playbooks are mature.

For a B2B healthcare hygiene, compliance, and safety-ops audience, the practical next step is to map the current incident response plan to a published scenario, identify the three to five decisions that the plan does not actually specify, and schedule a tabletop within the next 90 days. The exercise will surface gaps that no amount of policy review can find, and it will produce an after-action report that auditors, boards, and cyber-insurance carriers will accept as evidence of operational maturity. Event 201 demonstrated in 2019 that a well-designed tabletop can shape preparedness thinking for years; a well-run internal tabletop in 2026 can shape the resilience of a single organization for the next decade.