From a letter of intent to a night shift in the dark. How Healthcare Poland operationalises hospital resilience

The letters of intent with the Polish Air Force Academy in Dęblin set the direction. This analysis shows what comes next: how the Healthcare Poland Foundation, as the operational axis of the partnership with the Polish Hospital Federation and the “School of Eaglets”, turns knowledge of operating under disruption into a pathway a hospital can follow step by step, and into tools a patient will feel at the bedside on the hospital’s worst night.

Michał P. Dybowski — President and Co-Founder of the Healthcare Poland Foundation; coordinator of the CyberC4HE Coalition for Cybersecurity in Healthcare. Based on the Polish essay “Szkoła Orląt i szpital w ciemności” (The School of Eaglets and the hospital in the dark; dybowski.co, Polska Odporna).

The same night, a different question

Tuesday, 02:05. A district hospital of about three hundred beds. The telecoms operator loses connectivity and, at the same time, someone who has been inside the hospital network for days encrypts the servers of the hospital information system, the laboratory and imaging. The generator works, so the lights are on. Yet the nurse does not know what dose of anticoagulant the patient in room four received at midnight. This is an illustrative scenario, described at length in the essay “The School of Eaglets and the hospital in the dark”, built solely from elements of incidents that have already happened in Europe.

That essay asked why no hospital, university or foundation can build hospital resilience alone. This analysis asks the operational question: what exactly must happen beforehand so that at 02:05 everyone in that hospital knows what to do, and who at Healthcare Poland is responsible for each of those steps. The answer is not a single service. It is a pathway along which the Foundation’s departments lead the hospital, with partners who bring what we do not have ourselves.

The transmission: Healthcare Poland’s role in the triangle

On 10 January 2025, two letters of intent were signed on the same day: between the Healthcare Poland Foundation and the Polish Air Force Academy – Dęblin (LAW, Lotnicza Akademia Wojskowa), and between the Polish Hospital Federation (PFSz) and the same academy. The roles were clearly divided. The Academy took the educational and laboratory axis. The Federation took the role of coordinator of pilots, implementations and recommendations for its network of more than 250 member hospitals. Healthcare Poland took the operational axis.

In practice, the operational axis works as a transmission. Dęblin’s knowledge of working under communications disruption, satellite-signal jamming and decisions taken with incomplete information will not reach a hospital by itself. It has to be converted into a project with a schedule, an exercise scenario, audit criteria, a contract and funding. Conversely, a Federation recommendation is only worth something if it rests on a verified result in real hospitals. Healthcare Poland is where one becomes the other.

The Security and Civil Protection Department

At the heart of this work on the Foundation’s side is the Security and Civil Protection Department, headed by Janusz Janiszewski. The Department deals with what happens in a hospital when things taken for granted fail: power, communications, IT systems, supplies and the right people in the right places. It brings together three legal regimes that in 2026 met in a single hospital building.

The first regime is cybersecurity: risk management, business continuity, backups, emergency communications and incident reporting at 24 hours, 72 hours and one month ¹. The second is the physical resilience of critical entities, which Poland transposed late and which is only now being translated into risk assessments and resilience plans ⁴. The third is the civil protection and civil defence system, in which healthcare providers are part of the state’s capacity to protect citizens in a crisis ⁵. A hospital cannot implement these regimes separately, because at 02:05 they do not arrive separately.

The Department has four tasks in the partnership with Dęblin and the Federation. First, a gap analysis that combines digital, physical and civil-protection requirements into one picture instead of three separate reports. Second, business continuity plans and fallback mode: who decides, over which channel, with which data set and in what order. Third, exercise scenarios, designed with the Academy’s faculty so that disruption is a condition of the exercise, not an exception. Fourth, the interface with public administration: the crisis management centre, the founding body, the incident response team, the voivode. The hospital’s backup number must be known on the other side before it is needed.

The hospital’s backup number must be known on the other side before it is needed.

HCPL Security and Civil Protection Department

The hospital pathway: seven steps from request to recommendation

A hospital director preparing for spring 2027 does not need to know which Foundation department does what. They come in through one door and follow seven steps. Each step has an owner, a product and a measure.

1. Request. One point of contact: global@healthcarepoland.pl. Board coordination assigns a hospital lead for the whole pathway.
2. Self-assessment. The CyberC4HE Coalition questionnaire based on NIS2 requirements and ENISA materials. Within hours, the hospital sees its own starting point.
3. Gap analysis. The Security and Civil Protection Department combines the self-assessment with CER and civil-protection requirements. Product: one prioritised gap map, not three reports.
4. Plan and exercise. A business continuity plan, fallback mode and a tabletop or functional exercise scenario designed with the Dęblin faculty. We measure switch-over time, whether the backup channel works and the age of data in the copy.
5. Implementation. Technical and organisational changes. Where a new solution is needed, the Innovation Center runs it through a sandbox; where data and systems are concerned, through the Data Governance component.
6. Certification. The Center for Quality, Audit and Certification (CJAiC HCPL) audits against transparent criteria. Positive certification qualifies the hospital for a Polish Hospital Federation recommendation.
7. Recommendation and return. The Federation turns the hospital’s experience into a recommendation for the network. After six months the hospital returns to step four: a second exercise shows whether the gap has closed.

The patient pathway: what changes at the bedside

The patient in room four does not know that the hospital has completed a gap analysis or holds a certificate. She will feel it only in what happens at her bedside. That is why we design every element of the hospital pathway backwards: from the moment at which a patient could be harmed by improvisation.

The right dose: layer one of patient data

The most important tool for the patient is also the most modest: an emergency copy of a minimum data set, available without the network. It contains the patient’s identity and location, allergies and critical alerts, active medications with the time of the last dose, and pending orders. Every screen and printout shows the time the data comes from. Nothing more, because the data-minimisation principle protects the patient even if a tablet goes missing in the chaos ⁶. The clinicians of the Medical Care Department decide what this layer contains, CJAiC specialists decide how it is protected under Data Governance, and an exercise decides whether it works.

A family that knows what is happening

In a crisis, anxiety grows fastest among those waiting outside the door. The Security and Civil Protection Department is preparing template messages for patients’ relatives for fallback-mode operations, and the HCPL Academy trains staff to deliver them. It is a small thing that decides trust in a hospital for years.

After the event: a report and a conversation, not a dispute

Every event, including an exercise, reveals something. In a just culture, disclosing an error leads to changing the system, not to looking for someone to blame. When a patient or family feels wronged, the HCPL Center for Mediation, Conciliation and Arbitration offers a conversation led by a neutral mediator before the matter becomes a dispute.

A patient does not see the certificate. She sees a nurse who at 02:30 knows which drug she received at midnight.

Healthcare Poland

Department map: who does what

The Security and Civil Protection Department is the hub of this cooperation, but it does not work alone. Every step of the hospital pathway and every moment of the patient pathway relies on the competence of another Foundation team. This is how the work is divided.

Tools: what is available today and what is being built

State resilience does not need more announcements, so we present the tool catalogue with an honest status. Some tools are available today, some are being piloted, and some are in preparation as part of the operational phase of cooperation with Dęblin and the Federation.

Six partnership tracks in the hands of departments

“The School of Eaglets and the hospital in the dark” proposed six tracks for the operational phase. On Healthcare Poland’s side, each has a specific team accountable for the result.

How we measure whether it works

An exercise after which nothing changes is just an event. That is why every track ends with a repeat measurement, and the result feeds three indicators of the State Health Shield programme: the business continuity and disaster recovery standard, system recovery time, and the overarching indicator — closing the loop.

In practice we measure simple, verifiable things: how many minutes the switch to fallback mode takes, whether the backup channel actually connects to the recipient, how old the data in the copy is, how long it takes to restore one system, and what share of gaps revealed in an exercise is closed by a procedure change within six months. A measurement in one hospital is a curiosity. In three hospitals it is a comparison. Across the Federation’s network it is knowledge about the state of the country.

Operating principles

How to start

Fewer than six months remain until 3 April 2027 ³. That is enough to complete a first measurement and a first exercise, and far too little to start with a strategy. We invite hospitals, founding bodies and technology partners to talk.

The shield is not built on the day an agreement is signed. It is built on the day of the first exercise that reveals something.

Michał P. Dybowski, “The School of Eaglets and the hospital in the dark”

Notes and sources