Share this article on Social Media:
At the Hospital C-Suite Summit 2026, three risks that hospitals have long managed in separate boxes – cyberattacks, climate shocks, and fragile supply chains – kept colliding into a single theme. Across the sessions on cybersecurity, sustainability, and emergency preparedness, leaders made the case that resilience can no longer be compartmentalized. When one system fails, it takes others with it. The modern question isn’t “are we compliant?” It’s “can we keep running?”
Hospitals are used to managing risk in silos: a cyber team here, a facilities team there, a procurement office somewhere else. At HC-S 2026, that separation started to look dangerously outdated. Listen across the cybersecurity, green-hospital, and emergency-preparedness discussions, and they converge on one survival question: can the hospital keep operating when the shock comes — whatever form it takes?
Cyber: The Risk That Became Clinical
The starkest warnings came from the cybersecurity session. Prof. Ronni Gamzu opened by naming healthcare the most-attacked sector on earth, with breaches that are the costliest of any industry and can raise patient mortality.
Then came the case study that made it concrete. Ian Abbs, former CEO of Guy’s and St Thomas’ NHS Foundation Trust, described a ransomware attack on the trust’s pathology provider: servers encrypted, thousands of appointments cancelled, months of disruption, and a national blood emergency that left clinicians reliant on O-negative blood for 26 weeks. Staff reverted to pens, paper, and runners. It was, in every sense, a clinical event caused by a digital failure, and a preview of how a single point of failure in a supply chain can cascade through an entire system.
Mickey Boodaei, CEO and co-founder of Transmit Security, extended the warning to AI itself, which behaves less like software and more like a manipulable “digital employee.” His message: build resilience in from the start, because retrofitting it after a breach is too late.
Climate: A Financial and Resilience Case, Not a Slogan
In the same session, Natalia Allué reframed sustainability as a resilience strategy rather than a values statement. Fundació Sanitària Mollet embedded environmental thinking into governance, infrastructure, processes, and culture – 100% renewable energy since 2021, geothermal and solar systems, waste redesign, and a network of environmental ambassadors, targeting net-zero by 2030 while cutting operating costs.
The connection to resilience is direct: hospitals with climate-hardened infrastructure withstand extreme weather that leaves others in crisis, and a hospital’s supply chain – pharmaceuticals, devices, logistics – is both its largest environmental footprint and one of its most fragile dependencies. Green design, in this framing, is continuity planning by another name.
Physical Shock: When Everything Fails at Once
The emergency-preparedness session, chaired by Michał Dybowski, of the Healthcare Poland Foundation, completed the picture, and made the convergence explicit. The scenarios leaders described were rarely single-threat: combined cyber-and-infrastructure attacks that crippled hospitals and transport systems simultaneously; conflict that knocked out power and networks together; refugee influxes that strained supplies without warning.
The lessons from Ukraine and Poland were about running through compounded failure: securing energy supplies, fuel, and backup generators; dispersing critical supplies so a single strike can’t destroy them; keeping local data and small AI models running offline when the network dies; and drilling evacuation with the seriousness of a fire drill. The through-line with the cyber and climate discussions was unmistakable, resilience is about the system surviving as a whole, not any one part surviving alone.
Three Risks, One Discipline
Put the three sessions side by side, and the argument writes itself. A ransomware attack, a heat wave, and a drug-supply disruption look like different problems to different teams, but to the hospital, they produce the same result: services that can’t run, patients who can’t be treated, trust that erodes. And increasingly they arrive together, each amplifying the others.
That demands a shift in how resilience is governed: not three separate risk registers, but one continuity strategy, owned at board level, that treats cyber, climate, and supply chain as facets of a single question. The hospitals furthest ahead are already mapping how one incident cascades into the next, hardening systems and supplies against multiple failure modes at once, and measuring readiness with shared KPIs.
The Takeaway
The old model, a cyber plan, a sustainability plan, a disaster plan, each in its own binder, assumes shocks arrive one at a time and stay in their lane. HC-S 2026 made clear they don’t. The institutions built to last are collapsing these three conversations into one: a single, board-owned discipline of institutional resilience.
Because in the end, the patient doesn’t care whether the lights went out because of a hacker, a heat wave, or a broken supply chain. They only care whether the hospital is still running.
Want to stay informed about the ideas shaping the future of healthcare leadership? Subscribe to our newsletter and be the first to hear about insights, speaker announcements, and updates from the next Hospital C-Suite Summit.
Share this article on Social Media:
