Crisis Management

Why Hospitals Need an Effective Crisis Communication Plan

From Cyberattacks to Netflix – Control the Narrative During a Crisis

Why hospitals need an effective crisis communication plan

Healthcare can’t seem to catch a break. From pre-pandemic when a nurse shortage impacted hospitals across the country through the crippling challenges associated with COVID-19, the crisis never ends. As soon as you began settling into a new normal, a plethora of new worries sets in.

Physician shortages; mental and behavioral health crisis; technology—solution or roadblock—all add to the anxiety. Looming ominously over the industry is the real and present danger of cyberattacks—up 141% from 2022 to 2023— and ransomware. According to the American Hospital Association, ransomware attacks targeting US hospitals have increased by more than 300%.

With ever-present phone cameras, there is also the concern of privacy invasive images showing up on social media or, even worse, streaming online. The possibility of a hospital being the subject of a documentary such as Netflix’s “Take Care of Maya” makes it crucial to have a crisis communication plan in place.

For healthcare marketers, control over many threats is limited, but you can be prepared to quickly control the narrative and avoid a reputation crisis.

Preparing for a crisis.

Predicting a crisis can be difficult given the inherent element of unpredictability in crises. You generally don’t know what and when one is going to happen until it happens. Who could have anticipated a pandemic that brought the world to standstill for nearly two years?

Not that we want to become pessimistic, gloomy Eeyore, but being prepared with a crisis communication plan helps you control the narrative rather than other way around.

Most healthcare systems have crisis and emergency communication plans. If your hospital has one, when was it last updated? Revising a crisis communication plan rarely tops the priority list—unless there’s an active crisis, and it’s already too late. Despite COVID-19 bringing the world to a standstill, the Centers for Disease Control and Prevention (CDC) hasn’t updated its CERC Crisis + Emergency Risk Communication manual since 2018.

Whether a natural disaster, contagion outbreak or ransomware attack, be prepared to quickly disseminate information to your employees, patients, the media and community. Clear, reliable communication is key to keeping people calm, organized and safe and to continuing hospital operations while weathering the crisis. How an organization handles a crisis directly impacts its reputation.

When developing a crisis communication plan:

  1. Identify the core crisis team; list cell phone numbers, email addresses, video conference links and digital channels where team members can access updated information. Provide hard-copy manuals in case of power or Wi-fi outages.
  2. Plan a crisis response strategy. Keep it general to cover various scenarios.
  3. Plan to act quickly and strategically and in lock-step with the emergency plan for your hospital when a crisis occurs.
  4. Plan to conduct a post-crisis communication analysis and immediately update your plan with lessons learned. Conduct mock crisis exercises annually.

Following the 5 Cs of crisis communication.

When building and executing a crisis communication plan, keep these 5 Cs in mind:

  1. Concern. Audiences respond to human language, not corporate speak. Communicate with empathy and concern.
  2. Commitment. Let your audience know what steps the organization is taking to resolve the crisis and changes to prevent the same crisis in the future.
  3. Competency. Ensure internal and external audiences that the organization is doing everything possible to protect their health and safety.
  4. Clarity. Don’t assume; don’t guess; don’t speculate. State the facts, even if those need to be clarified in follow-up responses.
  5. Confidence. Communicate with confidence to inspire confidence and trust in  your audience.

Executing when a crisis occurs.

Being prepared helps you communicate efficiently and quickly when an incident occurs. In doing so, your hospital can concentrate on mitigating or correcting the situation, protecting patients and employees, and continuing operations. While you can’t predict how the crisis may impact your brand reputation, following proactive best practices can help elevate the organization during a crisis.

  1. Assemble the core crisis team and act quickly.
  2. Gather all possible facts and define the severity of the crisis.
  3. Prepare a holding statement if more time is needed to clearly identify the crisis.
  4. Draft three key messages—clear, concise and consistent.
  5. Identify internal and external stakeholders. Communicate to employees first; you don’t want them to find out about a crisis from outside the organization.
  6. Be honest and transparent.
  7. Stay calm, even when facing a storm.
  8. Schedule debriefs with the core team to adjust plans as needed during the crisis and afterward to prepare for the next inevitable crisis.

Advance planning provides you with tools to control the narrative during a crisis, which helps protect your audiences and minimize damage to the organization’s reputation.

TotalCom is a full-service marketing agency helping brands like yours tell their story to the right audiences. Email Lori Moore or call TotalCom Marketing Communications at 205.345.7363 to learn more about how we can help you tell your story.

Contact Us

A Strong Crisis Communication Plan Is Critical During Cyberattacks
Having strong cyber security in healthcare is important in today's digital world. Be prepared for cyber security threats and data breaches with a crisis response plan.

COVID-19 challenged healthcare brands in 2020. Now there is an increased need for a strong crisis response due to a rising number of cyberattacks and data breaches that can hold your hospital hostage. While IT departments typically manage cyber security in healthcare, marketing teams must be able to communicate with patients about cyberattacks and data privacy.

Healthcare systems are increasingly targets of cybercriminals. In 2020, nearly two healthcare data breaches of 500 or more records occurred each day. On average, resolving such a breach costs more than $8.5 million.

The costs of ransomware payments, restoring data and resuming operations are just part of the financial hit. Regaining patient trust comes at a higher cost, especially if names, birth dates, Social Security numbers and medical information are posted online.

According to the Edelman Trust Barometer 2021, nearly 70 percent of survey respondents say they are “concerned” about hackers and cyberattacks, while more than half of those report being “fearful.” A slightly lower number is concerned about contracting COVID-19.

While the same survey indicates a slight decline for healthcare sectors, overall trust remains at 66 percent.

Almost everything about the healthcare journey seems to pose security risks now—drive-by and pop-up testing sites; vaccination clinics in convention centers, churches, and parking lots; and increased risks with remote patient monitoring.

Add in the battle with misinformation about COVID-19 and vaccines. Compounding those worries, a recent World Health Organization warning reveals that counterfeit or compromised vaccines and forged vaccination certificates are readily available on the dark web.

So, how do we protect our patient’s trust in us as guardians of their health and confidential medical information?

Play nice with the IT department.

You’ve been in meetings where the IT team looks at the marketing team like you’re aliens! How can you not understand what they’re saying? Probably because it’s a completely foreign language!

As healthcare moves from controlled environments, the need to strengthen cybersecurity measures within healthcare with clear communication increases. This requires collaborating with IT to develop a strong crisis plan in case of a breach.

While IT prioritizes healthcare cyber security by working to ensure confidentiality and integrity of patient data, the marketing team needs to tell those patients about what you’re doing to protect their privacy.

Ramping up security can also include communication to hospital staff about such cautionary measures as:

  • Protecting patient information on computer screens:
    • Carefully monitoring printers to safeguard patient data;
    • Securing laptops or other remote work devices with patient records;
    • Protecting log-ins and passwords, ie. do not keep on random Post-it notes.

Make a crisis response plan. Test it. Tweak it.

Remember instructions on shampoo bottles to “wash, rinse, repeat?” That rings true when creating a strong crisis response plan. Most healthcare facilities were unprepared for the coronavirus crisis. One director of a hospice care service remarked that shortly before the pandemic, her team drafted crisis plans for every imaginable scenario. The one they turned to when the pandemic hit was created as a joke—what to do in case of a “zombie apocalypse.”

Crisis communication plans are fluid documents to revisit every few months in collaboration with department heads throughout the hospital. Due to the growing number of cyberattacks, several free resources are now available including:

Set expectations for open, transparent crisis communication.

Breaches of patient records increased more than 180 percent in the second half of 2020. Most of those resulted from hacking, not misplaced computers or flash drives.

As any hospital can be a target of cyber threats, you want a strong response in place if it happens. As others work behind the scenes, the marketing department should position the CEO to communicate openly and as transparently as possible.

Keeping responses brief, simple and to the point is critical to maintaining trust. Ransomware attacks are likely to interrupt hospital operations, sometimes prompting closed ERs and cancelled surgeries. Tell the public. Don’t leave them wondering.

Treat bad news as extra media coverage for protecting the public.

The American Hospital Association warns that cyberattacks are not “white collar crimes, but threat-to-life crimes” and advises hospitals to remain vigilant against cybercriminals. A lack of cyber security in healthcare poses a serious threat to your facility and patients.

If a breach occurs, immediately respond to the crisis by sharing with the media the steps you’re taking to protect patients. Regard it as an opportunity to remind people how to safeguard their own data. Update them on phishing schemes or fraud alerts, especially relating to health information.

The entire community is at risk to cyber crimes. Even if you can’t share specifics about the attack, direct responses to reassure your patients that their protecting their health remains your priority.

TotalCom is a full-service marketing agency helping brands like yours tell their story to the right audiences. Email Lori Moore or call TotalCom Marketing Communications at 205.345.7363 to learn more about how we can help you tell your story.

Healthcare Marketing: Real Time Responses Can Lead to Bad Times

Rather than reacting in “real time” in social media, responses should be carefully and strategically planned.

There is a lot of talk these days about “real time” media.  With social media, brands have the ability to respond and react almost immediately.  In “real time” as it’s referred to.  And many pundits claim this as an advantage of social media.  But is that really the smartest thing for our healthcare brands?

Leigh Dow, founder and managing director of Dow Media Group writing for Smart Blog on Social Media questioned the wisdom of real time responses.  She gave two examples of real time responses that were not so good:

  • Micky Arison, owner of the Miami Heat, was fined $500,000 after using Twitter as a sounding board about what he thought about the NBA lockout.
  • Arizona State Senator Russell Pearce created a media firestorm when he implied victims of the Aurora, Colorado shooting held some blame by not being armed.

These are examples, and there are many others, why social media should not be used for random stream of consciousness.  This is true personally but it’s also true for our brands.  Brands invest a tremendous amount of time, effort and money in building brand reputation and equity.  But when discipline and planning is not used in social media, a brand can be decimated as quickly as you can press, “Send.” 

“If you are doing social media right, little of your communication is in real time,” states Dow.  “Your communication should be the culmination of careful strategy and planning.  If you are doing it right, you have completed an extensive exercise in developing a social media strategy, channel mapping, implementation plans, an editorial calendar, roles and responsibilities, policies and guidelines, and a scorecard for tracking results.  That doesn’t fell very real time to me.”

Some had lauded social media as a great tool when your brand has a crisis.  And yes it can be very useful but it shouldn’t negate the need for a very careful and measured response.  That means making sure you have all the facts and you understand the situation and then deliberately considering how your brand should respond.

Dow gives JetBlue as an example of a brand that did it well.   When one of its flight attendants had a mental breakdown and, as a result cursed a passenger and quit his job very dramatically, social media networks were a buzz.  Instead of feeling the need to respond in “real time”, JetBlue had a more measured and calculated response.  Shortly after the incident the airline updated Twitter and it’s blog by stating that it was aware of what had happened and was working to verify details and would report only what it knew was accurate.  The company continued frequent updates as they learned the facts and carefully planned a response.  As brand protectors our requirement is not to give an immediate responses but to be accurate and responsible.

She gives examples when it’s appropriate to use social media in real time:

  • Monitoring what people are saying about your brand
  • Racking what people are saying about your competition
  • Helping a customer with a customer service question

We have all written emails, letters, notes or memos as an immediate response to a situation but after letting it sit for a bit, returned to it and decided that was not the way we wanted to communicate.  After having a chance to reflect a bit, we decided the words or tone were not what we wanted.  Social media is the same.  Sometimes in an effort to be in “real time” we can create situations that are not so good for our brand.  Because every post, response, or tweet has legs and can never be retrieved.  Careful thought and preparation should go into every social media response.

Healthcare Marketing: Eight Rules for Crisis Management

Healthcare Marketers Can Learn Valuable Lessons from the Penn State Scandal.

Every organization fears it. A crisis of public confidence and perception.   Hopefully as a healthcare marketer, you won’t be faced with a major one.  But most likely, sometime in your career you will.  Maybe more than once.  And during a crisis is no time to be learning on the fly.  It’s much better to first learn from others and then you will be prepared if and when your crisis comes.

Anne Hancock Toomey and Joe Tye wrote an article for Hospital and Health Networks titled “Cardinal Rules for Crisis Response” and examined how Penn State handled their recent crisis.  Though I’m hesitant to criticize how anyone handles a crisis, because it’s so much easier to do so from a rear view mirror than in the middle of the crisis.  Afterwards you can examine results and reactions, which are not available when the crisis is occurring.   But one can certainly look at what happened and why it happened so the same mistakes aren’t repeated.  Based on that hindsight Toomey and Tye offer eight extremely important rules to follow when a crisis occurs.  Here are those rules with abbreviated comments for each:

  • Develop a crisis communication plan. Any organization can fall victim to a public relations crisis, often without warning. Those who have prepared for the possibility and have developed a communication plan beforehand can emerge with an enhanced reputation for integrity.
  • Know when to apologize. The practice of apologizing for medical errors was pioneered by the Lexington VA Medical Center in Kentucky 20 years ago and since has been demonstrated to prevent PR problems and, actually, to reduce malpractice costs. Sincerely apologizing to and, when appropriate, compensating an aggrieved party can save a world of unwanted trouble, expense and exposure.
  • Stay true to your values. Every organization should have a set of values that guide behavior and decision-making. The commitment to integrity should be a guiding beacon at all times — never more so than in a time of crisis.
  • Tell it first. A wait-and-see approach will almost always keep you in a reactive mode. Reluctance to speak first can destroy trust you’ve worked hard to build with the stakeholders who matter to you.
  • Tell it all. Convincing yourself that you can keep a problem secret is dangerous and naive.
  • Tell it yourself. People trust other people, not a faceless institution. Your doctors, employees and patients want to hear from you. Not from a lawyer. Not from a PR person. Not from a nameless statement. In times of crisis, they want to hear from the leaders responsible for addressing the issue
  • Get others to tell it. Internal stakeholders — physicians, employees and even patients — can be strong advocates for an organization if they are informed, inspired and asked to help.
  • Communication doesn’t stop when the crisis has passed. A reputation can be destroyed in one day, but it takes years to rebuild, if it can be salvaged at all. Communication — internally and externally — should be ongoing following a crisis.

A crisis is never good.  But the future of an organization is often not determined by the crisis but by how it’s managed.  If handled properly, a crisis can even enhance a brand.  But for that to be possible, healthcare marketers must learn from the mistakes and successes of others and be prepared.  To do so would be very wise indeed.

Anne Hancock Toomey is a partner with Jarrard Phillips Cate & Hancock Inc., a health care public affairs firm with offices in Nashville and Chicago. Joe Tye, M.H.A., M.B.A., is the CEO of Values Coach Inc., a health care consulting and training firm in Solon, Iowa. He is also a member of Speakers Express.