A: It focuses specifically on the healthcare sector's unique constraints, such as patient safety and medical device availability, rather than just IT systems.

A: It forces a fallback to manual procedures, potentially delaying patient care and increasing the risk of medical errors.

A: To validate decision-making authorities regarding system shutdowns that could impact patient health versus data security.

A: By having pre-approved templates for communication that address patient safety concerns first, before technical details.

A: Reports of patient data appearing on the dark web or direct threats to life-safety systems.

A: To capture not just the decisions made, but the *gaps* in information that hindered decision-making during the exercise.

A: By introducing a scenario where the compromise originates from a vendor or connected partner, testing the organization's ability to coordinate response.

A: To capture immediate impressions and emotional responses to the pressure before they fade, identifying cultural or communication breakdowns.

A: By the ability of clinical operations to continue functioning effectively while IT systems are unavailable.

A: The tension between HIPAA privacy requirements (not disclosing patient data) and the need to share threat indicators with law enforcement.