When Staff Cannot Access the Roster: Keeping Aged Care Running
Cybersecurity preparedness includes knowing how essential care will continue when the systems staff rely on become unavailable. For care and operational managers, that starts with the realities of the next shift.
It is 7 am, and staff cannot access the roster. In a residential care home, the manager needs to confirm shift coverage and staff allocations. In home care, a coordinator needs to confirm visits and worker assignments. Both teams need to identify time-critical care and communicate overnight changes. Calls are starting to come in.
This illustrative scenario could follow a cyber incident, a supplier outage or a precautionary shutdown while suspicious activity is investigated. Technology teams may still be establishing what happened. Meanwhile, care managers need a reliable way to coordinate services and protect the people depending on them.
Cybersecurity preparedness starts with care delivery
Digital systems connect rostering, care plans, communications and clinical information. Their availability helps staff deliver the right support at the right time. In residential care, similar disruption could affect staff allocations, handover information or access to care records.
The Aged Care Quality and Safety Commission’s information management guidance explicitly addresses managing cybersecurity risks and maintaining access to critical information when digital systems are offline. For managers, the practical question is whether the team can use those arrangements when needed. Three questions provide a useful starting point.
1. What must our team know to deliver essential care?
Start with the services and people most affected by disruption. In home care, this could include scheduled visits, worker assignments, contact details and information needed to deliver agreed support safely. Identify time-critical needs through the organisation’s clinical and operational processes, so staff understand which situations require immediate escalation.
A roster provides only part of that picture. A worker may know where to go but still need current instructions, relevant risks or confirmation that a visit has changed. Map the minimum information needed to continue essential services, where it is held and who is responsible for keeping it current. This makes the care consequences of a system failure visible to technology and service leaders.
2. Can we reach and use that information?
An alternative arrangement needs to remain accessible when the usual application, login service or communication channel is unavailable. A continuity plan stored inside the affected platform will be difficult to use. Secure offline information or controlled paper records may support continuity, depending on the service and the organisation’s approved arrangements.
Check how those records are updated, who can access them and how staff recognise the most recent version. Privacy protections must continue during disruption, including limiting information to authorised people. Agree how staff will record care delivered, changes and concerns while systems are unavailable, and how these records will be reconciled after restoration. The team also needs an agreed way to communicate if normal email or messaging is affected.
3. Have we practised the response together?
The Australian Signals Directorate’s incident response guidance recommends aligning cyber response with business continuity arrangements and regularly testing and reviewing plans. A tabletop exercise can reveal whether those arrangements work for the people coordinating and delivering care.
Use the roster scenario at a team meeting, with the relevant operational, clinical and technology representatives. Assume the platform and normal email are unavailable at the start of a shift. Ask participants to explain how they would confirm priority visits, reach workers, escalate concerns and record completed care. Include an after-hours variation, when the usual manager or support contact is unavailable.
Record where people hesitate, which information they cannot obtain and which decisions lack an owner. Check how long essential coordination tasks take using the alternative arrangements. Assign actions, then repeat the exercise after improvements. The result should be evidence that staff can perform the work under disruption.
Turn operational gaps into leadership decisions
Care managers bring knowledge that technology teams and suppliers need: how services operate, where delays create risk and what staff require to work safely. Technical specialists assess and manage the security response; clinical and operational leaders define the care requirements that response must support. Executives resolve gaps involving funding, supplier commitments or responsibilities across teams.
Make escalation specific. For example, finding that staff cannot obtain current priority-visit information outside business hours gives leaders a clear problem to address. Record the care consequence, the accountable owner and the action required, then check that the solution works in practice.
Strengthen the arrangements that keep care running
Bring one essential service to your next operational review and work through the three questions. That discussion can establish whether digital dependencies are governed well enough to protect people and sustain essential care.
eHomeCare’s Digital Governance advisory helps providers clarify responsibilities, decision rights and oversight across care, operations and technology. Start a conversation about the dependencies and decisions that matter to your services.
Hubert van Dalen is the founder of eHomeCare, providing independent digital strategy, governance, technology and transformation advisory services to Australian aged care and disability providers.
Comments