Daniel O’Shaughnessy, Head of Programme Delivery at Digital Care Hub, discusses how cyber resilience is about preparation, not perfection.
How high is cyber security on your care home’s risk register? A cyber incident can block access to care records, rotas, medication plans, and payroll and the disruption can last for weeks. That puts cyber risk firmly in the high-impact category. The good news is that it can be managed by focusing on what would cause the biggest disruption and what would keep care running.
For most care homes, that means looking at everyday systems: care plans, rotas, medication, payroll, finance, email, Wi-Fi and nurse call. If one went down, who would need to know, how would staff keep records safely, and how would the service recover?
This is where a simple, tested business continuity plan earns its place. It does not need to be long; it just needs to be clear enough to use under pressure, with emergency contacts, supplier support, backups, communication routes and decision-making roles easy to find.
Small gaps can create big problems
Many incidents begin with something ordinary: a reused password, a shared login, an unpatched device, or a message that looks genuine. None sound dramatic, but each can open the door to serious disruption.
That is why the basics matter. Strong passwords, multi-factor authentication, software updates, backups, short staff training and quick reporting are often what stop a small mistake from becoming a crisis.
Risk does not stop at your front door
Care is increasingly connected, bringing real benefits for residents and staff. It also means a problem elsewhere can quickly become your problem. Care homes depend on software providers, pharmacies, GP systems, payroll companies, agency platforms and equipment suppliers, so it is worth knowing how suppliers protect data, manage outages, report incidents and support recovery.
AI needs a conversation, not a ban
AI is not simply a yes-or-no issue. It can help with admin, communication and analysis, but staff need clear boundaries. Personal information should not be pasted into public tools, outputs need checking, and everyone should understand how AI can make scams more convincing.
Prepared, not perfect
Cyber resilience is not about being perfect; it is about being prepared, responding calmly and learning from what happens. Care homes recover faster when they have discussed risks, practised their response, and made cyber security part of everyday management, rather than leaving it to “IT”.
Support is available
There is good progress to build on. By 30 June 2026, a record 88% of CQC-registered care homes had an up-to-date Data Security and Protection Toolkit in place. That is a strong foundation, but the real test is whether good practice shows up in everyday decisions and habits.
Digital Care Hub’s free Digital Health Checks, delivered by local care provider trade associations on its behalf, can help providers test risks and agree practical next steps.
