Cyber incident communication in adult social care is becoming an increasingly important part of operational resilience as providers adopt digital care records, electronic medication systems, rostering platforms, monitoring technology and other connected infrastructure.
On 16 September 2026, Digital Care Hub launched new cyber-incident communication checklists specifically for home-care and residential-care providers. The resources are designed to sit alongside an organisation's existing Business Continuity Plan and help services establish how they will communicate when their normal digital systems become unavailable or compromised.
Importantly, the checklists represent new practical resources rather than a new legal or regulatory requirement. Their significance lies in giving providers a structured framework for an area of cyber resilience that can easily be overlooked: keeping staff, people drawing on care, families, commissioners and suppliers informed while an incident is unfolding.
For care organisations operating across Birmingham and the West Midlands, Leicester and the East Midlands, London, Bristol and the South West, Milton Keynes and surrounding regions, the publication provides a useful opportunity to assess not only technology, but also whether their leadership teams and wider workforces are ready to maintain safe service delivery during disruption.
What Do the New Cyber Incident Communication Checklists Cover?
A cyber incident does not necessarily mean a sophisticated ransomware attack. Digital Care Hub defines incidents broadly enough to include events affecting the confidentiality, integrity or availability of IT systems or information, including malware, phishing, ransomware, theft and disruption caused by incidents such as power outages, fire or flood.
During an incident, providers could potentially lose access to:
Digital care planning systems
Electronic medication administration records
Staff rostering platforms
Call-monitoring systems
Email and digital communications
Shared drives
Supplier portals
Telephone or Wi-Fi infrastructure
Digital Care Hub's new resources therefore focus heavily on communication continuity.
Providers are prompted to determine who is responsible for communications, maintain printed or offline copies of important contact details, establish alternative methods for reaching stakeholders and prepare holding statements before they are required.
The guidance also recommends that providers practise their response at least once a year, rather than assuming that a written Business Continuity Plan will work effectively when tested by a real incident.
For residential services, the checklist goes further by recognising the operational dependence of care homes on interconnected systems. This can include digital social care records, electronic medication systems, nurse-call technology, falls sensors, Wi-Fi, phones and electronic access control.
Why Cyber Resilience Matters More as Social Care Becomes More Digital
The digitalisation of adult social care has accelerated considerably.
Government statistics published in September 2026 show that, as of June 2026, 91.9% of people cared for by CQC-registered adult social care providers in England were estimated to have a digital social care record, compared with 88.3% in June 2025.
Digital Care Hub also reported that, by the 30 June 2026 deadline, almost 76.5% of CQC-registered adult social care services in England had an up-to-date Data Security and Protection Toolkit (DSPT). This represented 22,429 services, including 12,887 care homes and 9,562 home-care services.
This digital maturity can create significant benefits for care delivery, data accessibility and operational efficiency. However, it also means that business continuity increasingly depends upon organisations understanding what happens when those systems cannot be accessed.
A residential provider may have strong policies for protecting its digital care records, for example, but leaders also need to establish how staff will access critical information if those records become temporarily unavailable.
Similarly, a domiciliary care organisation operating across several locations may need contingency arrangements for communicating with dispersed care workers if email, cloud-based scheduling or usual mobile communication channels are compromised.
Cyber resilience is therefore no longer solely an IT function. It intersects with operations, safeguarding, workforce management, governance, risk, communications and senior leadership.
Cyber Incidents Create a Workforce Challenge as Well as a Technology Challenge
Research commissioned by the Department of Health and Social Care provides further context.
Its 2025 report into cyber security in adult social care found that 33% of surveyed care providers reported experiencing a cyber incident or unsuccessful attack during the previous three years.
Among providers that had experienced an incident or attack, 75% reported phishing, while 35% had experienced people impersonating their organisation through email or online channels. The report also noted concerns that incidents could be underreported because of limited awareness and concerns around reputational damage.
This is important for workforce planning.
Cyber resilience cannot sit exclusively with an IT supplier, Data Protection Officer or senior management team. Frontline employees may be the first people to encounter a suspicious email, lose access to a care system or receive questions from families.
Care organisations therefore need employees at multiple levels who understand:
Cyber security and information governance
Incident escalation procedures
Business continuity processes
Data protection responsibilities
Safeguarding implications
Clear stakeholder communication
Digital care systems and associated contingency processes
For senior appointments, employers may increasingly need to consider candidates' exposure to digital transformation, operational risk, crisis management and service continuity alongside more traditional care-sector leadership experience.
Building Cyber Incident Responsibilities Into Care Leadership
For senior leaders within supported living, residential care and domiciliary services, one of the most useful elements of the Digital Care Hub guidance is its emphasis on clearly allocated responsibility.
A Business Continuity Plan can lose effectiveness if nobody knows who has authority to activate it.
Providers should consider who would:
Lead the operational response
Liaise with IT or technology suppliers
Communicate with employees
Contact commissioners and relevant partners
Update people drawing on care and their families
Manage external or media enquiries
Escalate potential data breaches
Coordinate service recovery
Conduct the subsequent incident review
These responsibilities also need deputies. A contingency plan that depends entirely on one Registered Manager, IT lead or Director being available creates an avoidable single point of failure.
For organisations recruiting senior care professionals in London, Birmingham, Bristol, Leicester and across other parts of England, experience of business continuity planning, risk management and cross-functional incident response could consequently become increasingly valuable.
Keep Critical Information Available Offline
One of the simplest recommendations in the new guidance may also be one of the most important: organisations should ensure essential information is accessible when their digital infrastructure is not.
Digital Care Hub recommends keeping the checklist, Business Continuity Plan, contact details and relevant supporting information somewhere accessible if normal systems fail, such as in printed form or on an appropriate standalone device.
Providers should consider whether they could still quickly access contact information for:
Employees and managers
Emergency contacts
People drawing on care and their representatives
Commissioners
Local authorities
Technology suppliers
Payroll or workforce suppliers
Utilities and facilities providers
Cyber-security support
Insurance providers
Relevant regulatory or reporting bodies
The objective is not to replicate every digital system on paper. It is to identify the information required to keep essential services and communication functioning while systems are restored.
Testing the Plan Is as Important as Writing It
A business continuity document that has never been tested can provide a false sense of security.
Digital Care Hub recommends practising the communications response at least annually.
Scenario exercises can help providers identify weaknesses before a genuine cyber incident occurs. For example:
What happens if the electronic medication system becomes inaccessible during a night shift?
How are home-care employees contacted if the rostering platform and company email are unavailable simultaneously?
Who communicates with families if the organisation's normal telephone system is disrupted?
Who has authority to issue an initial holding statement when the full cause of an incident remains unknown?
Exercises such as these test not only infrastructure but decision-making, escalation pathways and workforce capability.
The Department of Health and Social Care's wider digital guidance already states that care providers should develop and test business continuity plans for data and cyber security as part of wider business planning.
.png)
What Does This Mean for Recruitment in Adult Social Care?
For recruitment teams and employers, increasing digitalisation means the definition of effective care-sector leadership is evolving.
Clinical, operational and commercial experience remain critical, but organisations may also need leaders capable of operating within increasingly technology-dependent environments.
When recruiting Registered Managers, Heads of Operations, Regional Managers, Quality and Compliance professionals, Directors or other senior appointments, employers could assess experience in areas such as:
Business continuity and disaster recovery
Digital transformation
Data protection and information governance
Cyber-risk awareness
Operational resilience
Crisis communications
Technology implementation
Regulatory reporting
Multi-site incident management
Workforce training and change management
This does not mean every care leader needs to become a cyber-security specialist.
It does mean providers need sufficient organisational capability to translate technical disruption into an operational response that protects service continuity and the people relying on care.
For providers growing across the West Midlands, East Midlands, London, South West and South East, this is particularly important where senior teams oversee multiple services and large, geographically dispersed workforces.
Final Thoughts
Digital Care Hub's new cyber incident communication checklists do not introduce a new legal obligation for home-care or residential-care organisations.
Instead, they provide something arguably more immediately practical: a framework that providers can use to test whether their organisation could still communicate effectively when normal technology is unavailable.
As digital care records and connected care technologies become embedded across the sector, cyber resilience increasingly becomes a question of people, process and leadership, not simply software.
Providers that define responsibilities in advance, maintain offline contact information, establish alternative communication routes and regularly test their response will be better positioned to maintain organised decision-making during an incident.
Strengthening Your Adult Social Care Team?
Cyber resilience, digital transformation and operational continuity are placing new demands on leaders throughout the adult social care sector.
At James Andrews Recruitment Solutions, we support organisations recruiting across Support & Care, connecting employers with professionals capable of navigating the operational, regulatory and workforce challenges facing modern care services.
Whether you are strengthening an established leadership structure or recruiting to support organisational growth, contact our team to discuss your recruitment requirements.
.jpg)
.png)
.png)
.jpg)
