Business Continuity Plan for a Clinic

Build a BCP and ransomware tabletop exercise for a healthcare clinic.

Introduction

30 Second Summary

A ransomware attack hits a healthcare clinic at 7:45 on a Monday morning. Every system locks, patients are arriving, and someone needs to answer: who takes command, who gets notified, and how fast does the clinic need to recover?

In this project, you will build a professional Business Continuity Plan for a fictional 45-person healthcare clinic in New York. You will stress-test it with a ransomware tabletop exercise, fix the gap it exposes, and publish the entire deliverable as a shareable GRC portfolio piece on Notion.

What You'll Build

You open your published Notion page during a job interview and walk the hiring manager through a continuity plan you built, broke with a tabletop exercise, and fixed with a documented corrective action.

By the end of this project, you'll have:

A Business Impact Analysis where you can point to any of the clinic's critical systems and explain its recovery timeline, acceptable data loss, and the downstream impact on patient care.
A tested Business Continuity Plan you can walk through with a hiring manager, showing exactly who does what in the first 60 minutes of a disruption and which vendor gets the first phone call.
A ransomware tabletop exercise that escalated until your plan broke, plus an After-Action Report documenting the gap you discovered and the corrective action you took to close it.
Secret Mission: A HIPAA Security Rule safeguards mapping that proves your plan is audit-ready.

Are there any prerequisites?

None. This project includes setup for all tools you need. You will use Notion's Free plan, which costs $0/month and gives you unlimited pages and blocks.

Before We Start

Before we dive in, let's commit to the scenario you're about to work through. Understanding what you're building and why will anchor every decision across the project.

Set Up Your Notion Workspace

Every deliverable you build in this project needs a professional home. Without a structured workspace, your BIA, BCP, and exercise documents end up scattered across random files with no way to share them as a cohesive portfolio.

In this step, you will create a Notion account and build the page structure that houses your entire portfolio. By the end, you will have a clean workspace ready for content.

In this step, get ready to:

Create a free Notion account.
Build a portfolio page with five subpages for each deliverable.
Verify the workspace is ready for content.

Create your Notion account

Notion is a free workspace tool that lets you create pages, tables, and nested documents. You will use it to write, organise, and eventually publish your portfolio to the web.

Open your browser and navigate to https://www.notion.so/signup.
Sign up using your email, Google, Apple, or Microsoft account.
When prompted about how you will use Notion, choose For myself.

You are now on the Free plan ($0/month), which gives you unlimited pages and blocks for individual use.

What is Notion's Free plan?

The Free plan costs nothing and includes unlimited pages, blocks, and the ability to publish pages to the web. That last feature is what lets you share your finished portfolio via a public link on LinkedIn.

Confirm you can see the Notion workspace in your browser. You should see a sidebar on the left with a blank workspace ready for new pages.

Stuck on the sign-up page?

Make sure you selected For myself during onboarding. If you accidentally chose a team workspace, you can create a new personal workspace from the sidebar dropdown at the top-left corner of Notion.

Help me troubleshoot my Notion sign-up.

Set up your portfolio structure

Your workspace needs a main portfolio page that acts as the landing page, with individual subpages for each deliverable. This mirrors how a hiring manager will browse your work.

In the Notion sidebar, click New page (or press the + icon next to Private in the sidebar).
Title the new page GRC Portfolio - Business Continuity.

You should see the new page open in the main area with a blank body and its title in the sidebar.

Inside this page, type /heading 1 and press Enter to insert a heading block.
Type the heading text: Business Continuity Plan and Tabletop Exercise - Riverside Medical Associates, New York.
Press Enter to move to a new line below the heading.
Type the following intro paragraph: This portfolio demonstrates business continuity planning, regulatory compliance (HIPAA, NY SHIELD Act), and tabletop exercise design for a fictional 45-person healthcare clinic..

Your main page now has a heading and an intro paragraph. Next you will add the five subpages.

Click at the end of your intro paragraph and press Enter to create a new empty line.
Type /page and select Page from the dropdown. Title it Riverside Medical Associates - Clinic Profile and press Enter.
Click the back arrow (or the parent page title at the top) to return to your main page.
Repeat the process to create four more subpages with these exact titles:

Why five separate subpages?

Each subpage maps to a distinct deliverable in the project. Keeping them separate means a hiring manager can jump directly to the piece that interests them, and you can work on each deliverable independently without cluttering a single long page.

Don't see your subpages in the sidebar?

Click the toggle arrow next to your main page title in the sidebar. Subpages nest underneath the parent and may be collapsed by default.

If a subpage ended up at the top level instead of inside your main page, drag it in the sidebar and drop it onto the GRC Portfolio - Business Continuity page to nest it.

Help me fix my Notion page structure.

Verify your workspace is ready

In the sidebar, click the toggle arrow next to GRC Portfolio - Business Continuity to expand it.
Confirm you see all five subpages listed underneath the main page.
Click into each subpage one at a time. Each should open as a blank page with only its title at the top.

Your workspace now shows a main page with its heading, intro paragraph, and five blank subpages ready for content.

Your workspace is built and ready. Next up, you will define the fictional clinic and conduct the Business Impact Analysis that drives every decision in your continuity plan.

Define the Clinic and Conduct the Business Impact Analysis

Your Notion workspace is ready with five blank subpages waiting for content. Now you need to fill the first two pages with the foundation every continuity plan depends on.

A Business Continuity Plan built without understanding which systems matter most is just guesswork. The Business Impact Analysis identifies what the clinic cannot live without, how quickly each function must be restored, and what happens if it stays down.

In this step, get ready to:

Build the Riverside Medical Associates organizational profile.
Conduct a Business Impact Analysis for 6 critical clinic functions.
Document your planning assumptions and limitations.

Build the Riverside Medical Associates profile

Every BCP is built around a specific organization. You need a detailed picture of the clinic before you can assess what would hurt most if systems went down.

In your Notion sidebar, click into the Riverside Medical Associates - Clinic Profile subpage.
Type /heading 2 and add the heading: Organizational Profile.
Below the heading, enter the following details as a bulleted list (type /bulleted list to start):

Name: Riverside Medical Associates
Location: Manhattan, New York
Size: 45 employees (3 physicians, 2 nurse practitioners, 5 RNs, medical assistants, billing staff, front desk, IT contractor)
Services: Primary care, cardiology, dermatology
Patient volume: ~200 patients/day across all providers
Key systems: Electronic Health Records (EHR), patient scheduling system, billing/revenue cycle, pharmacy e-prescribing, patient portal, VoIP phone system
Regulatory context: HIPAA covered entity, subject to NY SHIELD Act, accepts Medicare/Medicaid

Why does the regulatory context matter?

Riverside is a HIPAA covered entity because it provides healthcare services and transmits health information electronically. It is also subject to the NY SHIELD Act because it holds private information of New York residents.

These two overlapping regulations create specific notification obligations if patient data is ever breached. Your BCP will need to account for both.

Review your completed profile page. You should see all seven items listed clearly.

Page looks empty or items aren't showing?

Make sure you are editing the correct subpage. Click Riverside Medical Associates - Clinic Profile in the sidebar, not the parent page.

If your text disappears after pressing Enter, Notion may have created a new block below. Scroll down to check.

Need help? Why aren't my Notion bullet points saving correctly?

Conduct the Business Impact Analysis

The BIA answers a critical question: if each system went down right now, how bad would it get and how fast? You will assign a Recovery Time Objective (how quickly you must restore service) and a Recovery Point Objective (how much data loss is tolerable) to each critical function.

In your Notion sidebar, click into the Business Impact Analysis subpage.
Type /table and select Table - Inline to insert a table directly on the page.
Set up your table with these 7 columns: Critical Function, Criticality (High/Medium/Low), Maximum Tolerable Downtime, RTO, RPO, Key Dependencies, Impact of Outage.

What are RTO and RPO?

RTO (Recovery Time Objective) is the maximum time a system can be down before the business impact becomes unacceptable. If the EHR has a 2-hour RTO, you must restore it within 2 hours.

RPO (Recovery Point Objective) is the maximum amount of data loss measured in time. A 1-hour RPO means you can tolerate losing up to 1 hour of data (because your backups run hourly).

Fill in the first row of your table with the EHR System:

Critical Function: EHR System
Criticality: High
Maximum Tolerable Downtime: 4 hours
RTO: 2 hours
RPO: 1 hour
Key Dependencies: Cloud vendor, internet connectivity
Impact of Outage: Cannot access patient records or document visits

Confirm your first row displays correctly in the table before continuing.
Fill in row 2 with the Patient Scheduling system:

Critical Function: Patient Scheduling
Criticality: High
Maximum Tolerable Downtime: 8 hours
RTO: 4 hours
RPO: 4 hours
Key Dependencies: EHR integration
Impact of Outage: Patient flow stops, revenue loss

Fill in row 3 with the Billing/Revenue Cycle:

Critical Function: Billing/Revenue Cycle
Criticality: Medium
Maximum Tolerable Downtime: 24 hours
RTO: 12 hours
RPO: 24 hours
Key Dependencies: Clearinghouse, EHR
Impact of Outage: Delayed reimbursement

Fill in row 4 with Pharmacy E-Prescribing:

Critical Function: Pharmacy E-Prescribing
Criticality: High
Maximum Tolerable Downtime: 4 hours
RTO: 2 hours
RPO: 0
Key Dependencies: Surescripts network
Impact of Outage: Patients cannot receive prescriptions

Fill in row 5 with the Patient Portal:

Critical Function: Patient Portal
Criticality: Medium
Maximum Tolerable Downtime: 48 hours
RTO: 24 hours
RPO: 24 hours
Key Dependencies: EHR vendor
Impact of Outage: Patients cannot access results or message providers

Fill in row 6 with the VoIP Phone System:

Critical Function: VoIP Phone System
Criticality: High
Maximum Tolerable Downtime: 2 hours
RTO: 1 hour
RPO: N/A
Key Dependencies: Internet, VoIP provider
Impact of Outage: Patients cannot call, no appointment confirmations

Your table should now show all 6 critical functions. Scroll through each row to confirm the data is complete.

Below the table, add a paragraph explaining your prioritization methodology. Type something like: "Critical functions were prioritized by patient safety impact first, revenue impact second, and regulatory compliance third. Systems that directly affect patient care (EHR, e-prescribing, phones) received the shortest recovery targets."

Why document a methodology?

A BIA table alone shows what you decided. The methodology narrative shows how you made those decisions. GRC hiring managers want to see your reasoning process, not just the output.

Document your assumptions

Every analysis relies on assumptions. Documenting them shows you understand the boundaries of your own work and gives future reviewers context for updating the BIA.

Below the methodology paragraph on your Business Impact Analysis page, type /heading 2 and add the heading: Assumptions and Limitations.
Add a bulleted list with 3-4 assumptions. Use these:

The EHR vendor maintains their own disaster recovery. This BCP addresses loss of access, not loss of the vendor's infrastructure.
The clinic does not have a secondary physical site.
IT support is a part-time contractor, not full-time staff.
Internet connectivity is provided by a single ISP with no redundant connection.

Review your completed Business Impact Analysis page from top to bottom. You should see the table with 6 rows, the methodology narrative, and the assumptions section.

Make your assumptions work harder

Notice that each assumption reveals a potential weakness. A single ISP means one point of failure. A part-time IT contractor means slower incident response. These constraints directly shaped your RTO values.

Before moving on, take a moment. Look at your BIA table and ask yourself: which row has the shortest RTO, and why does that make sense for a clinic seeing 200 patients a day?

The VoIP system has the tightest recovery window at 1 hour. If phones are down, patients cannot reach the clinic and appointment confirmations stop. That is an immediate disruption to 200 scheduled patients.

Your BIA now gives you a clear picture of what matters most to Riverside Medical Associates. Next up, you will turn these findings into an actionable recovery plan with specific people assigned to specific tasks.

Write the Business Continuity Plan

Your Business Impact Analysis identified the six critical functions Riverside Medical Associates depends on and ranked them by patient safety, revenue, and compliance impact.

Now you need a plan that tells specific people exactly what to do when those functions go down. A Business Continuity Plan turns your BIA findings into assigned roles, recovery procedures, and a communication tree that anyone on the team can follow under pressure.

In this step, get ready to:

Write the BCP header, purpose, roles, and recovery strategies (Sections 1-3).
Build a communication plan with a minute-by-minute notification tree (Section 4).
Document vendor dependencies and a testing schedule (Sections 5-6).

Write the BCP framework (Sections 1-3)

The first half of a professional BCP establishes who owns the plan, what it covers, and how each critical function gets restored. This structure follows NIST SP 800-34 guidance: purpose, roles, then recovery strategies.

Open the Business Continuity Plan subpage in your Notion workspace.
At the top of the page, type the heading: Business Continuity Plan - Riverside Medical Associates.
Below the heading, add a line: Version 1.0 | July 2026 | Plan Owner: Practice Manager.

Why include a version line?

Professional BCPs are living documents. The version line tells auditors and staff which revision they are reading and who approved it. ISO 22301 requires documented evidence of plan reviews and updates.

Add a heading called Section 1 - Purpose and Scope.
Write 2-3 sentences stating what the plan covers, what triggers activation (disruption to any High-criticality function from your BIA), and that all critical functions identified in the BIA are in scope.
Add a heading called Section 2 - Roles and Responsibilities.
Type /table to create a simple table with these columns: Role, Name/Title, Responsibilities, Contact Method.
Fill in five rows:

BCP Coordinator: Practice Manager. Activates the plan, coordinates recovery, reports to leadership.
Clinical Lead: Lead Physician. Decides whether patient care continues, authorizes paper-based workflows.
IT Lead: IT Contractor. Contacts vendors, troubleshoots systems, manages data restoration.
Communications Lead: Office Manager. Notifies staff, communicates with patients, handles media inquiries.
Alternate BCP Coordinator: Lead Physician (acts if Practice Manager is unavailable).

Confirm your table has all five roles filled in with specific responsibilities before moving on.

Add a heading called Section 3 - Recovery Strategies.
For each High-criticality function from your BIA (EHR System, Patient Scheduling, Pharmacy E-Prescribing, VoIP Phone System), write a 2-3 sentence recovery strategy describing what staff do if that function goes down.

Here is an example for the EHR System recovery strategy:

"If EHR is unavailable, clinicians revert to paper documentation using pre-printed encounter forms stored in the supply room. The IT contractor contacts the EHR vendor within 15 minutes. Paper records are transcribed into the EHR within 24 hours of system restoration."

Write similar recovery strategies for Patient Scheduling, Pharmacy E-Prescribing, and VoIP Phone System using the same pattern: immediate workaround, who contacts the vendor, and how you catch up once restored.

Your page should now show Sections 1-3 complete. Scroll up and confirm you see the version header, purpose and scope, the roles table, and four recovery strategies.

Table not showing columns?

If your table only has one column, click the + icon at the right edge of the table to add more columns. You need four columns total: Role, Name/Title, Responsibilities, Contact Method.

Ask for help: How do I add columns to a simple table in Notion?

Write the Communication Plan (Section 4)

In a real disruption, confusion about who to call first burns critical minutes. A communication tree removes that confusion by assigning exact notification sequences to specific time windows.

Add a heading called Section 4 - Communication Plan.
Write a notification tree structured by time windows. Use three time blocks:

0-15 minutes: Person discovering the incident notifies IT Contractor and Practice Manager.
15-30 minutes: Practice Manager activates BCP, notifies Lead Physician and Office Manager.
30-60 minutes: Office Manager notifies all staff via group text. If patient data is involved, Practice Manager contacts legal counsel.

Below the notification tree, add a subheading called External Communications.
List who is responsible for contacting: the EHR vendor, patients (if appointments must be cancelled), and regulatory authorities as required.

What should External Communications include?

For now, keep the regulatory notification language general. Write something like: "Practice Manager notifies regulatory authorities as required by applicable law." You will revisit this section later in the project when a more specific scenario forces you to evaluate exactly which agencies, which timelines, and which thresholds apply.

Read through your Communication Plan from top to bottom. You should be able to answer: who is the first person notified within 15 minutes of an incident, and who activates the plan between 15-30 minutes.

Complete the plan (Sections 5-6)

A healthcare clinic depends on external vendors for almost every critical system. Documenting those dependencies makes sure the team knows who to call and what backup exists when a vendor goes down.

Add a heading called Section 5 - Vendor Dependencies.
Type /table to create a table with columns: Vendor, Service, SLA/Contract Terms, Emergency Contact, Backup Option.
Fill in at least five rows covering your critical vendors:

EHR vendor (electronic health records).
VoIP provider (phone system).
Internet ISP (connectivity).
Surescripts (pharmacy e-prescribing network).
Medical billing clearinghouse (revenue cycle).

For each vendor, write realistic SLA terms (e.g., "99.9% uptime, 4-hour response for critical issues"), a fictional emergency phone number, and a backup option (e.g., "manual fax prescriptions" for Surescripts).

Confirm the table has five vendor rows before moving to the final section.

Add a heading called Section 6 - Testing and Maintenance.
Write a short paragraph stating: the plan will be tested semi-annually via tabletop exercise, reviewed after any real incident, and updated annually or after any significant change (new vendor, system migration, staff change).
Below that paragraph, type /table to add a Plan Maintenance Log table with columns: Date, Change Description, Changed By, Approved By.
Leave the maintenance log empty for now. You will add your first entry after the tabletop exercise later in this project.

Before you move on, take a moment to predict: does your BCP tell someone exactly what to do if they discover a data breach at 8 AM on a Monday? Scroll through Section 4 and see if you can answer that question clearly.

You should be able to trace the notification path from discovery through the first 60 minutes. If the answer to "who notifies which regulatory agency, and by when?" feels vague, that is expected. You will stress-test this exact gap in the next step.

Sections look out of order?

Notion blocks can be dragged and dropped. Hover over the ⋮⋮ icon to the left of any block and drag it to reorder. Make sure Sections 1-6 appear in numerical order on the page.

Ask for help: My BCP sections appear out of order in Notion. How do I reorder them?

Your Business Continuity Plan is complete. You have roles assigned, recovery strategies documented, a communication tree built, and vendor dependencies mapped. Next up, you will design a ransomware tabletop exercise that puts this plan under real pressure and reveals whether it holds up when lives and data are on the line.

Design the Ransomware Tabletop Exercise

Your Business Continuity Plan documents exactly what to do when critical systems go down. But how do you know it actually works? A plan that has never been tested is just a document, not a strategy.

In this step, you will design a ransomware tabletop exercise that stress-tests your BCP with a realistic attack scenario. The exercise escalates pressure across four phases until participants are forced to confront a real gap in the communication plan you wrote.

In this step, get ready to:

Set up the exercise framework with objectives, participants, and ground rules.
Write a 4-phase ransomware scenario with escalating injects and discussion questions.
Write a debrief framework for post-exercise analysis.

Set up the exercise framework

Before writing the scenario itself, you need to define who participates, what the exercise is meant to test, and how it will be run. This framing keeps the exercise focused on outcomes rather than just storytelling.

In the Notion sidebar, click into your Ransomware Tabletop Exercise page.
Add a heading at the top of the page: Operation Locked Files.
Below the heading, type the following exercise details as a bulleted list:

Add a subheading called Objectives and list these three items:
Add another subheading called Ground Rules and list:

What is a tabletop exercise?

A tabletop exercise is a discussion-based simulation where key personnel walk through a hypothetical scenario without touching real systems. Participants talk through their decisions, reference their plans, and discover gaps in real time.

The structure you are using follows CISA's Tabletop Exercise Package methodology: objectives, a phased scenario with injects, discussion questions at each phase, and a structured debrief.

Your exercise header section should now show the title, type, duration, participants, three objectives, and four ground rules.

Write the phased scenario with injects

A good tabletop scenario escalates pressure over time. Each phase introduces new information (called an "inject") that forces harder decisions. Your scenario starts with a system outage and ends with a confirmed data breach and media attention.

Add a subheading: Phase 1 - Discovery (T+0 to T+15 min).
Type the following scenario inject:
"Monday 7:45 AM. Staff arriving for morning clinic find they cannot log into the EHR. A message on the login screen reads: 'Your files have been encrypted. Contact us for decryption key. You have 72 hours.' The IT contractor is unreachable (phone goes to voicemail)."
Below the inject, add a Discussion Questions list:

Add a subheading: Phase 2 - Escalation (T+15 to T+30 min).
Type the following scenario inject:
"IT contractor calls back. Confirms ransomware has encrypted the EHR database and the local backup server. The cloud backup is 18 hours old. 45 patients are scheduled this morning. The patient portal is also down. A patient calls asking why they cannot access their lab results."
Add these discussion questions:

Why does the scenario escalate gradually?

Real incidents do not dump all their complexity on you at once. Information trickles in. By escalating gradually, the exercise forces participants to make decisions with incomplete information, just like they would during a real event.

Notice how Phase 1 tests your immediate response procedures and Phase 2 tests your recovery priorities from the BIA. The next two phases will push into regulatory territory.

Add a subheading: Phase 3 - Breach Confirmation (T+30 to T+50 min).
Type the following scenario inject:
"Forensic analysis from the EHR vendor reveals that the attacker exfiltrated a database containing patient names, dates of birth, Social Security numbers, and insurance IDs for approximately 2,300 patients before encrypting. This is now a confirmed breach of unsecured PHI."
Add these discussion questions:

This is where the BCP gap surfaces

Look at your BCP Section 4, External Communications. It says "notify regulatory authorities as required" without specifying any timelines. During this phase, participants would be scrambling for answers that the plan does not provide.

The correct answers they would need are: HIPAA requires individual notification within 60 days of discovery. For 500+ individuals, HHS must also be notified within 60 days. The NY SHIELD Act requires notifying the NY Attorney General within 5 business days of notifying HHS. None of this is in your plan right now.

That is the designed gap. You will document this finding and fix it in the next step.

Add a subheading: Phase 4 - Recovery and Media (T+50 to T+70 min).
Type the following scenario inject:
"The EHR vendor confirms they can restore from the 18-hour-old cloud backup. However, a local news outlet has published a story: 'Manhattan Clinic Hit by Ransomware, Patient Data Potentially Exposed.' Two patients have called demanding to know if their data was stolen."
Add these discussion questions:

Your page should now show all four phases, each with a scenario inject and discussion questions. Scroll through and confirm each phase flows logically into the next.

Write the debrief framework

The debrief is where participants step out of the scenario and reflect on what they learned. These questions guide the conversation toward actionable improvements.

Add a subheading at the bottom of your page: Debrief Questions.
Add these four questions as a numbered list:

Debrief questions target action

Notice how question 3 directly asks what was missing. In a real exercise, this is the moment someone would say "we had no idea about the HIPAA 60-day clock or the NY AG notification." Question 4 turns that discovery into a deadline for fixing it.

Your "Ransomware Tabletop Exercise" page is now complete. Take a moment to scroll through the entire page from top to bottom.

Confirm you see the header section with title, type, duration, participants, objectives, and ground rules.
Confirm all four phases are present, each with a scenario inject and at least 3 discussion questions.
Confirm the Debrief Questions section appears at the bottom with all four questions.
Read Phase 3 and confirm you can identify the exact moment the exercise forces participants to confront HIPAA breach notification timelines.

Phase 3 does not feel like it exposes the gap?

Go back to your BCP page, Section 4, and read the External Communications subsection. If it says anything more specific than "notify regulatory authorities as required," you may have accidentally added timeline details in Step 3. Remove specific HIPAA or NY SHIELD Act timelines from Section 4 for now. The gap is intentional and you will close it properly in the next step.

help me make sure my BCP has the intentional gap in Section 4 that the tabletop exercise is designed to expose

You have now designed a complete tabletop exercise that follows professional methodology. Next up, you will "run" the exercise, write the After-Action Report documenting the gap you found, and fix your BCP to close it.

Write the After-Action Report and Publish Your Portfolio

Your tabletop exercise just exposed a critical gap in the BCP. The communication plan says "notify regulatory authorities as required" but never specifies the HIPAA 60-day clock or the NY SHIELD Act 5-business-day obligation. That gap is the point.

In this step, you will document that finding in an After-Action Report, update the BCP to close the gap, and publish your entire portfolio to the web. This final loop from planning through testing to improvement is exactly what GRC hiring managers look for.

In this step, get ready to:

Document the After-Action Report with the gap finding and corrective action.
Update BCP Section 4 with specific breach notification timelines.
Publish your portfolio to the web and share it on LinkedIn.

Document the After-Action Report

An After-Action Report transforms a tabletop exercise from a discussion into an auditable improvement record. It documents what worked, what failed, and what changes you will make.

Open the "After-Action Report" page in your Notion workspace.
Add a heading at the top: "After-Action Report - Operation Locked Files Tabletop Exercise".

Below the heading, add the following sections with the content described.

Add a subheading: "Exercise Summary".
Write a brief summary including: the exercise date (use today's date), participants (BCP Coordinator, Clinical Lead, IT Lead, Communications Lead, Legal Counsel simulated), the ransomware scenario overview, and the three exercise objectives from your tabletop page.

Add a subheading: "Strengths Identified".
Write 2-3 bullet points describing what went well. Include: "Clinical staff knew to revert to paper documentation immediately" and "Communication tree activated within 15 minutes."

Why document strengths first?

Professional after-action reports always lead with what worked before identifying gaps. This is not just politeness. It establishes which parts of the plan to preserve when you start making changes.

Now for the critical finding. This is the section that proves the exercise had value.

Add a subheading: "Gap Identified - HIPAA/NY SHIELD Act Breach Notification".
Write the finding as follows: "The BCP Communication Plan (Section 4) states 'notify regulatory authorities as required' but does not specify:"
Add a bulleted list with these four items:

Why does the clock start at discovery?

Many organizations mistakenly believe the 60-day window begins once their forensic investigation confirms a breach. The HHS Office for Civil Rights has clarified that the time period begins when the incident is first known, not when the investigation is complete. This distinction catches organizations off guard in real incidents.

Add a subheading: "Corrective Action".
Write: "Update BCP Section 4 to include a Breach Notification Procedures subsection with specific timelines, responsible parties, and a decision tree for determining notification thresholds (500+ vs. fewer than 500 individuals)."
Add a subheading: "Status".
Write: "Corrective action planned, target completion within 30 days."

Review your completed After-Action Report. You should see a clear narrative arc: exercise summary, strengths, the specific gap exposed in Phase 3, and a corrective action with a deadline.

Not sure what to write for strengths?

Look back at your tabletop exercise Phase 1 discussion questions. The fact that clinical staff knew to use paper documentation and that the communication tree had a clear activation sequence are both strengths your BCP already addressed.

Help me write the strengths section of my After-Action Report based on the tabletop exercise.

Update the BCP with the corrective action

Your After-Action Report identified the gap. Now you close it. This demonstrates that your BCP is a living document, not a one-time deliverable.

Switch back to your "Business Continuity Plan" page in Notion.
Scroll down to Section 4 (Communication Plan). Find the "External Communications" subsection where you previously wrote "regulatory authorities as required."
Below the External Communications subsection, add a new subheading: "4a - Breach Notification Procedures (HIPAA / NY SHIELD Act)".

Under this new subheading, add the following items as a structured list or table. Each item needs to be specific and actionable.

Write Trigger: Discovery of unauthorized access to unsecured PHI.
Write Clock starts: Date of discovery (not confirmation of breach).
Write Individual notification: Within 60 calendar days of discovery (written notice by first-class mail).
Write HHS notification: Within 60 calendar days if 500+ individuals affected (via OCR breach portal).
Write Media notification: Within 60 calendar days if 500+ residents of a state are affected.
Write NY Attorney General notification: Within 5 business days of notifying HHS.
Write Responsible party: Practice Manager (with legal counsel).

Below the notification procedures, add a note: "Added post-exercise" followed by today's date.

Why mark it as added post-exercise?

Timestamping changes with their origin shows auditors and hiring managers that the plan evolves based on testing. This is the plan-test-improve cycle that separates a mature GRC program from a stack of static documents.

Review Section 4 of your BCP. You should now see the original "External Communications" text (with the intentionally vague "regulatory authorities as required" language still visible) and directly below it, your new Section 4a with all seven specific notification requirements.

Not sure where to place Section 4a?

Section 4a goes immediately after the External Communications subsection within Section 4. It does not replace the original text. Keeping the original vague language visible alongside the corrective addition shows the before-and-after improvement.

Help me structure the breach notification procedures in my BCP.

Publish your portfolio and share on LinkedIn

Your BCP, tabletop exercise, and After-Action Report are complete. The final step is making them visible to hiring managers by publishing your Notion portfolio to the web.

Return to your main "GRC Portfolio - Business Continuity" page in Notion.
Click Share in the top-right corner of the page.
Toggle Publish to web to on.
Copy the public link that Notion generates.

Open the public link in a new browser tab. You should see your full portfolio page with all five subpages accessible. Click through each one to confirm the content appears correctly to a public viewer.

What does publishing do?

Publishing creates a public URL that anyone can view without a Notion account. All subpages nested under the published page are also accessible. This is included in Notion's Free plan at no cost.

Now share your work on LinkedIn so hiring managers can find it.

Open LinkedIn in a new browser tab.
Click Start a post at the top of your feed.
Write a post describing what you built. Suggested framing: "I just completed a Business Continuity Plan and tabletop exercise for a fictional healthcare clinic in New York. The project covers BIA, recovery strategies, HIPAA/NY SHIELD Act compliance, and a ransomware scenario that exposed a real gap in the plan. Built it in Notion as a portfolio piece for GRC roles. Link in comments."
Paste your Notion public link in the first comment on your post.

Link in comments gets more reach

Placing the link in the first comment rather than in the post body avoids LinkedIn's algorithm reducing visibility of posts with external links. The post text draws attention, and the comment delivers the portfolio URL.

Before you check your final result, take a moment to think. What would a GRC hiring manager notice first when they open your portfolio link?

Open your published Notion link one more time. Confirm that you can navigate from the main page into the After-Action Report, see the gap finding with specific regulatory citations (45 CFR 164.404, 45 CFR 164.408), then navigate to the BCP and see Section 4a with its "Added post-exercise" note. That complete loop from gap discovery to corrective action is what makes this portfolio piece compelling.

Subpages not visible on the published link?

Make sure each subpage is nested under the main "GRC Portfolio - Business Continuity" page in Notion's sidebar. Only pages nested inside the published parent page are included in the public view. Drag any stray pages into the correct parent.

Help me troubleshoot why my Notion subpages are not appearing on my published portfolio page.

You now have a complete, publicly accessible GRC portfolio piece that demonstrates the full plan-test-improve cycle. Next up, you will decide what to keep, pause, or clean up.

Secret mission

HIPAA Security Rule Safeguards Mapping

Your BCP is tested and your After-Action Report is done. But can you prove your plan actually aligns with specific HIPAA Security Rule requirements? In this mission, you will map your BCP directly to regulatory safeguards from 45 CFR Part 164, elevating your portfolio from practical to audit-ready.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on Notion's Free plan, so there are no ongoing costs.

Resources you used:

Notion workspace with 6 portfolio pages (GRC Portfolio - Business Continuity, Clinic Profile, BIA, BCP, Tabletop Exercise, After-Action Report, HIPAA Security Rule - BCP Alignment).
Published Notion page (public web link).
LinkedIn post linking to your portfolio.

Keep everything running

No action needed. Choose this if you are still actively building on your portfolio or want to keep it visible to hiring managers.

Your Notion pages remain published and accessible via the public link.
Your LinkedIn post stays live, linking anyone who clicks through to your portfolio.
Notion's Free plan has no time limit or expiration. Your pages stay online indefinitely at no cost.

Pause - I'll come back to this later

Take your portfolio offline but keep all your content intact so you can republish later.

In Notion, open your main "GRC Portfolio - Business Continuity" page.
Click Share in the top-right corner.
Toggle Publish to web to off. Your public link stops working immediately, but all content remains in your workspace.
Optionally delete your LinkedIn post if you do not want it visible while the link is inactive.

Delete - I don't want to use this again

Remove all project content from Notion and LinkedIn.

In Notion, open your main "GRC Portfolio - Business Continuity" page.
Click the ... menu at the top-right of the page, then select Move to Trash. This deletes the parent page and all its subpages (Clinic Profile, BIA, BCP, Tabletop Exercise, After-Action Report, HIPAA Security Rule - BCP Alignment).
In Notion's sidebar, click Trash at the bottom. Find your deleted pages and click Delete permanently to remove them for good.
On LinkedIn, find your portfolio post. Click the ... menu on the post and select Delete post.

Nice Work!

You just built a professional GRC portfolio piece from scratch. You now have a tested, improved Business Continuity Plan for a fictional healthcare clinic that demonstrates real-world skills hiring managers look for in GRC candidates.

You've learned how to:

Conduct a Business Impact Analysis identifying critical systems with RTOs, RPOs, and dependencies for a healthcare organization operating under HIPAA and the NY SHIELD Act.
Write a professional Business Continuity Plan and stress-test it with a ransomware tabletop exercise that exposed a real gap in your communication plan.
Close the plan-test-improve loop by documenting findings in an After-Action Report, updating the BCP with corrective actions, and publishing the finished portfolio to Notion as a shareable link for LinkedIn.
Secret Mission: Map your BCP to HIPAA Security Rule safeguards, demonstrating regulatory alignment and audit-ready thinking.

Ready to quiz yourself?