FREE TEMPLATE

ADHICS Incident Response Plan

The incident response plan ADHICS V2 expects — severity matrix, DoH notification path, Malaffi incident flow, runbooks and a tabletop exercise pack.

What's in the plan

Severity matrix

P1–P4 severity bands with clinical-impact criteria tuned to Abu Dhabi healthcare context.

Roles and responsibilities

Incident commander, communications lead, technical lead, clinical operations lead, legal/compliance contact.

DoH notification path

Pre-written notification template, timing thresholds and the escalation chain into the Department of Health.

Malaffi incident flow

Separate path for incidents affecting the Malaffi connection — authentication, logging or data-exchange events.

Incident register

Running log capturing severity, discovery date, impact, affected systems, remediation status, lessons captured.

Runbook — containment

Step-by-step actions for the first 60 minutes: isolate, preserve evidence, communicate internally.

Runbook — eradication & recovery

Clinical-system restoration, backup validation, access rotation, patching, re-opening services safely.

Post-incident review

Root-cause template, lessons-captured record, control changes committed for the next quarterly report.

Tabletop exercise pack

Four scenario cards (ransomware, ePHI exposure, Malaffi connection failure, insider misuse) with facilitator notes.

Communications templates

Internal all-staff note, external vendor note, patient communication (reviewed with legal).

Severity matrix at a glance

P1 Critical

Trigger: ePHI exposure, Malaffi connection compromise, clinical-system outage affecting patient safety.

Notification: DoH notified within hours. Executive on-call engaged immediately.

P2 High

Trigger: Material security event without confirmed data exposure. Clinical-system degraded but operational.

Notification: DoH notified within 24 hours. Incident commander appointed, status cadence hourly.

P3 Medium

Trigger: Contained security event with no clinical impact. Internal remediation sufficient.

Notification: Logged in the incident register. Summary in the quarterly compliance report.

P4 Low

Trigger: Policy violation, phishing attempt without compromise, minor misconfiguration.

Notification: Logged. Review in weekly security standup.

Notification thresholds should be confirmed with your DoH contact and legal team at template-adoption time. The plan ships with placeholder values and a review checklist.

How to adopt the plan

Appoint the incident team

Fill the roles and responsibilities section with named people and backups. Confirm the clinical operations lead and the DoH-facing contact.

Confirm notification thresholds with DoH

Walk the P1 / P2 bands with your DoH contact. Capture the agreed timing in the plan and the quarterly report.

Run a tabletop exercise

Pick one scenario from the pack and run a 60-minute tabletop. Capture the actions and gaps in the post-incident review template.

Wire the incident register

Set the register as the single source of truth for all incidents, including P4 low-severity events. The register is the first artefact a TRBA auditor opens.

Review annually or after any P1/P2

The plan is reviewed at least annually and after every P1 or P2 event. Record review dates in the version-history section.

Need the full ADHICS programme managed?

LowerPlane runs the incident register with you, feeds incidents into the quarterly report automatically, and keeps the DoH notification path drilled every quarter.

See the ADHICS Platform