If there is one thing social care is good at, it is adapting. We plan for staffing gaps, severe weather, fuel shortages and everything in between, and we are used to thinking on our feet. However, many providers still feel less confident about what happens when the digital side of the business stops working, even though digital systems are now fundamental to how care is delivered.
Care plans, medication records, rotas, communication with families, payroll and training all rely on technology. When those systems go down, the impact is immediate. That is why we are increasingly talking about the need for a digital business continuity plan, as an essential extension of the continuity planning providers already do so well.
This is not just about IT
One of the biggest shifts we need to make is how we think about cyber security. It is not simply a technical issue to hand over to an IT provider. It is a business continuity issue that affects the whole organisation. At Digital Care Hub, we often say cyber incidents should be treated like a fire or flood, because the consequences can be similar in practice. Systems become unavailable, staff cannot access the information they need and routines are disrupted, sometimes for months.
Importantly, not all cyber incidents are caused by criminal attacks. Many are the result of accidental data loss, human error, system failures or supplier outages, but the impact on care delivery can be just as significant. A business continuity plan is about what a provider would do if its service was disrupted by something outside its control, including digital disruption as much as physical disruption.
What does ‘digital business continuity’ actually mean?
When we talk about digital business continuity, we mean practical issues that affect how a service operates day to day. What would you do if you could not access your care planning system, whether due to a cyber attack, a system outage or an accidental lockout? How would staff find shifts if your rota system stopped working? How would you contact families if phones or email were unavailable, or if you lost access to data entirely? These are not hypothetical scenarios.
Providers have experienced all of these scenarios, from cyber attacks to accidental data loss and supplier outages, and the difference between a manageable disruption and a serious incident often comes down to whether there was a plan in place. The encouraging part is that putting a plan together is often more straightforward than people expect – think ahead, document practical steps and make sure everyone understands their role.
When planning pays off
One of the most powerful ways to understand the value of digital business continuity is to look at what happens when things go wrong. We worked with a provider who experienced a cyber attack that affected their systems and, because they had already put thought into their continuity planning, they were able to respond quickly and keep services running.
As their manager told us, ‘Luckily we had a business continuity plan in place… when the attack happened, we were able to check our downloaded rosters and move these over to a spreadsheet.’ That one relatively simple step, regularly downloading and backing up staff rotas, meant they could continue co-ordinating care without major disruption.
Another reflection from the same case study captures the reality many providers are now recognising, ‘It isn’t a question of if you’re going to get hit… it’s a question of when.’ It may sound stark but it reflects the growing risk across all sectors. What matters most is not whether incidents happen but how prepared providers are when they do.
What happens when there is no plan?
When organisations do not have a digital business continuity plan, incidents can escalate very quickly because staff are left trying to work out what to do in real time, often under pressure. Whether the cause is a cyber attack, a power cut, a system failure or simple human error, without access to systems, teams may struggle to view up-to-date care information, check medication details, contact colleagues or families, co-ordinate visits and shifts, or pay staff. In those moments, the absence of a plan becomes a direct risk to wellbeing and safety.
This is exactly why business continuity planning is a key requirement in the Data Security and Protection Toolkit (DSPT). With the 30th June re-assessment deadline approaching, it is worth seeing this not just as a compliance exercise but as an opportunity to strengthen how providers respond to disruption. Providers can also access free support through the Better Security, Better Care programme, including help from 32 local support organisations across the country.
What good looks like in practice
Digital Care Hub has developed guidance and a practical template to help providers build digital continuity into their planning in a way that feels manageable and relevant. It starts with identifying critical systems, which for most providers will include care planning systems, medication records, staff rotas and communication tools. From there, the focus is on understanding what would happen if those systems were unavailable and what realistic alternatives are in place.
For example, providers could temporarily switch to paper-based processes, with secure digital backups that staff are confident in using. From there, the plan sets out clear actions so that everyone knows what to do, who is responsible and how communication will be maintained. This might include steps for dealing with broadband failure, lost devices, accidental deletion of data or supplier outages, all of which are common scenarios that can disrupt services.
Do not just have a plan, check it too
One of the most common challenges we see is that organisations have a business continuity plan but it has not been reviewed or tested in a meaningful way for some time. Testing is important but so is auditing the plan to make sure it is still fit for purpose. Systems change, staff roles evolve and new risks emerge, so a plan that worked a year ago may no longer reflect reality.
To support this, we have published a business continuity plan audit tool that helps providers review their plans in a structured way. It allows providers to check whether key areas are covered, identify gaps and take practical steps to strengthen their approach. This is not just useful for providers themselves. It can also be used by commissioners and partners, such as local authorities and the NHS, to understand how resilient services are and where additional support may be needed.
Alongside auditing, regular testing remains essential. Simple exercises, such as switching off WiFi, simulating a lost device or talking through a cyber attack scenario with staff, can quickly highlight what works well and what needs improving.
Small steps can make a big difference
It is easy to feel that this is a big piece of work but, in reality, small, practical steps often have the greatest impact. Regularly backing up data, keeping offline copies of key information, making sure staff know how to access alternative systems and checking suppliers’ own continuity arrangements can all significantly reduce risk. These actions do not require major investment but can make the difference between a short disruption and a prolonged incident, regardless of whether the cause is malicious or accidental.
Digital transformation needs digital resilience
There is a lot of focus in the sector on digitisation, and rightly so. Digital tools can improve care, reduce administrative burden and support better outcomes for people drawing on care. However, as we become more reliant on these systems, we also need to ensure we are resilient when things go wrong.
As the provider in our case study reflected, ‘The experience hasn’t put us off from going digital… we need to develop our protections.’ That balance is exactly what we should be aiming for. Digital transformation should go hand in hand with strong cyber security and business continuity planning.
Next steps
If there is one takeaway from this, it is that most providers already have a strong foundation in their existing business continuity planning. The next step is to build on that foundation so that it reflects the digital reality of modern care services. By including the systems staff rely on every day, and by making sure plans are practical, tested and regularly reviewed, organisations can be confident that they are prepared for a wide range of disruptions.
With the DSPT re-assessment deadline of 30th June approaching, this is a timely opportunity for providers to take stock and strengthen their approach. Ultimately, this is not just about meeting a requirement. It is about making sure that, whatever happens, providers can continue to deliver safe, high-quality care.
For more information and resources concerning digital business continuity, visit Digital Care Hub’s website.
Katie Thorn is Director of Innovation at Digital Care Hub.
Email: [email protected] LinkedIn: @Digital-Care-Hub