One person wears the emergency management hat
Emergency management is a title someone holds alongside three other jobs. The program is real, but it lives in one person's head, one shared drive, and a binder nobody has opened since the last survey.
Your emergency operations plan has to hold up twice: when a surveyor asks for evidence it was tested, and when the system actually goes down. Most programs are built for the first and discovered wanting on the second.
Emergency management is a title someone holds alongside three other jobs. The program is real, but it lives in one person's head, one shared drive, and a binder nobody has opened since the last survey.
The Joint Commission's Emergency Management chapter doesn't scale its expectations to your bed count. Neither does the Office for Civil Rights (OCR). A 40-bed critical access hospital is asked the same questions as an academic medical center — with a fraction of the staff to answer them.
You've run exercises. But when the surveyor asks what you tested, what failed, and what you changed as a result — the answer is reconstructed from memory and email, not produced from a record.
When Ascension was hit in May 2024, the consequences weren't measured in records — they were measured in diverted ambulances, manual charting, and disrupted care across 136 hospitals in 18 states. The system had fought its way to nearly break-even through ten months of the fiscal year; two months later it closed with a $1.1 billion net loss. Change Healthcare, three months earlier, showed the same thing from the payment side: 192.7 million people affected, because one dependency almost nobody had mapped went down.
Neither organization lacked a plan. Both discovered what a plan is worth when it has never been run.
The Emergency Management standards (effective July 1, 2022) require exercises comprehensive enough to test response capabilities to failure, an evaluation reviewed by senior management, and revision of the plan to correct what was found. That cycle is what Resilis is built around.
Scenario-based tabletops built against your actual dependencies — the core systems, vendors and utilities your operations rest on — not generic drill templates.
Who took part, what was tested, what broke, what was decided — a dated, attributed record produced during the exercise, not reconstructed after.
Findings become suggested updates to the plan — surfaced for your emergency management committee to review and validate. The platform proposes, your people decide.
The full chain — exercise, findings, review, revision — in the form a surveyor asks for.
| What you're accountable for | What a surveyor or investigator expects to see | What Resilis offers |
|---|---|---|
| EM.11.01.01 — hazard vulnerability analysis (HVA) | A facility-based HVA covering natural, human, technological, hazardous-materials and emerging-infectious-disease hazards, prioritized and used to drive mitigation | A living hazard and dependency map — including the third-party systems your operations actually rest on — that updates as your environment changes |
| EM.13.01.01 — continuity of operations plan (COOP) | A written COOP | An AI-drafted COOP tailored to your facility, for your team to validate and own — not a template with your name on it |
| EM.14.01.01 — disaster recovery (DR) | A DR plan informed by the prioritized hazards in your HVA | A DR plan linked to the same dependency map, so the HVA and the plan can't drift apart |
| EM.16.01.01 — exercises | Annual testing, comprehensive enough to test response capabilities to failure and identify deficiencies | The tabletop cycle above — generated scenarios, dated records, and findings your committee validates into the plan |
| EM.17.01.01 — evaluate and revise | An evaluation reviewed by senior management, with the plan updated to correct identified deficiencies | After-action findings tracked to closure, with suggested revisions submitted for human review — in a form you can hand to your EM committee or board |
| HIPAA §164.308(a)(7) — contingency plan | Data backup, disaster recovery and emergency mode operation plans — all three Required, not addressable | Emergency mode operating procedures documented alongside the rest of the program, testable in the same cycle |
| CMS Conditions of Participation — Emergency Preparedness | All-hazards plan, communications plan, training and testing | One program producing all of it, rather than three parallel binders maintained for three different audiences |
Abbreviations: TJC — The Joint Commission; EM — Emergency Management; HVA — hazard vulnerability analysis; COOP — continuity of operations plan; DR — disaster recovery; CMS — Centers for Medicare & Medicaid Services; HIPAA — Health Insurance Portability and Accountability Act; OCR — Office for Civil Rights.
HIPAA is deliberately technology-neutral — it sets no recovery-time numbers. Any vendor quoting you a required recovery time objective is quoting NIST or themselves, not the rule.
Resilis coordinates your response — it does not hold your patients' records. The platform works from system dependencies, recovery objectives, and aggregate impact figures: which services are affected, how many records sit in an affected system, what your clock looks like. Not clinical data, not identifiers. Bringing Resilis in doesn't widen the surface your privacy office has to defend.
Where your contracting requires it, we execute a Business Associate Agreement. Belt and braces — the architecture keeps PHI out, the agreement covers you regardless.
Infrastructure certified to ISO 27001 and PCI-DSS. SOC 2 is underway — the controls are in place today; the report formalizes what US buyers expect to see. Hosting and residency are addressed at onboarding: Resilis deploys US-region hosting for US clients as part of standing up the engagement.
The enterprise resilience platforms are built and priced for thousand-plus-employee institutions. The rigor is the same; the price shouldn't have to be.
Julien Puaux spent a decade on crisis assignments for major institutions and served on the emergency desk at Médecins Sans Frontières (MSF), coordinating field operations where the plan had to work the first time. Hugues Lajoie ran operational risk and business continuity inside a regulated bank, then led Deeplink Medical as Chief Executive Officer — teleradiology technology certified as a medical device and relied on by clinicians in hospitals and cancer centers.
Between them: what a response actually demands when everything is failing, and what it takes to build technology a health system can depend on.
Your first conversation isn't with an SDR — it's with an independent advisor who works alongside Resilis on its US expansion. It's a working session, not a pitch: we map where your program stands, where the evidence may be thin, what wouldn't hold at your next survey, and how your team would actually run the response if it happened tomorrow.
Book a 20-minute review