Executive view
Resilience is not a contingency plan. It is a way of operating.
Healthcare organizations do not experience financial pressure, workforce transition, care redesign, and cyber risk as separate events. The pressures converge on the same leaders, the same capacity, and the same decisions.
An enterprise becomes more resilient when it can absorb pressure without losing strategic clarity. That requires explicit thresholds, visible ownership, tested recovery paths, and a review cadence that turns early signals into decisions. The goal is not to eliminate volatility. The goal is to protect care while preserving the ability to choose.
Resilience is visible when the organization can absorb pressure, protect care, and still make disciplined choices.
Margin and capital discipline
Protect mission by making capital choices explicit.
MedPAC reported that hospital all-payer margins improved in fiscal year 2024 while fee-for-service Medicare margins remained deeply negative. That gap reinforces a familiar executive challenge. Improvement at the enterprise level can coexist with persistent pressure inside individual service lines, payer segments, and sites of care.
Capital discipline should therefore connect strategy, service-line economics, liquidity, clinical need, and operating capacity. Leaders need one portfolio view of proposed investments and clear conditions for when to start, stop, defer, or scale an initiative.
Executive actions
- Govern one capital portfolio across strategic, clinical, digital, and facility investments.
- Run base, pressure, and recovery scenarios against liquidity and capacity thresholds.
- Define stop, scale, and reassessment gates before committing resources.
- Protect the capabilities that preserve access, safety, and long-term market relevance.
Care model redesign
Treat value accountability as operating-model redesign.
CMS began the Transforming Episode Accountability Model in selected markets on January 1, 2026. The model spans five surgical episode categories and places greater emphasis on coordination, quality, and episode performance through recovery. CMS also revised the AHEAD Model for 2026, extending the model and strengthening tools for managing cost growth, quality, and population health.
The leadership implication reaches beyond any single payment model. Episode accountability exposes the handoffs between hospital care, physicians, nursing, finance, post-acute partners, and patients. Those handoffs must be designed and managed as one operating system.
Executive actions
- Map one priority episode from decision for treatment through recovery.
- Bring clinical, financial, operational, and post-acute leaders into one design team.
- Assign a named owner for each high-risk transition and escalation path.
- Review outcomes, cost, experience, and avoidable utilization on the same scorecard.
Leadership succession
Build decision continuity before a role changes.
Succession planning is often treated as a future talent exercise. In practice, it is a present operating control. A sudden leadership gap can slow decisions, weaken relationships, and concentrate knowledge at the exact moment an organization needs clarity.
The board and executive team should maintain a shared view of critical roles, emergency successors, ready-now candidates, ready-later candidates, and development actions. The strongest plans preserve both continuity and the ability to bring in new capability when strategy changes.
Executive actions
- Identify roles whose vacancy would materially disrupt strategy or patient care.
- Name an emergency successor and decision authority for each critical role.
- Separate ready-now coverage from longer-term development candidates.
- Review succession risk with the board as part of enterprise strategy, not only compensation.
Cyber recovery readiness
Make downtime and restoration a clinical operating capability.
NIST finalized updated incident-response guidance in 2025 that integrates preparation, detection, response, and recovery across the Cybersecurity Framework 2.0. HHS healthcare cybersecurity goals likewise emphasize incident planning and safe restoration. In 2026, ASPR added a cybersecurity module to its Risk Identification and Site Criticality toolkit for healthcare facilities.
The executive test is not whether the organization has an incident plan. It is whether teams can sustain safe care, establish decision authority, restore systems in the right order, and communicate clearly under pressure.
Executive actions
- Run a cross-functional recovery exercise that includes clinical incident command.
- Confirm the restoration sequence for systems that support life safety and care continuity.
- Test manual workflows, clean backups, and third-party dependencies under realistic conditions.
- Set clear executive thresholds for declaring an incident, escalating decisions, and returning to normal operations.
The next 90 days
Four moves to make resilience measurable.
- FOUNDATIONSet resilience thresholds.
Define the liquidity, capacity, safety, and recovery signals that require executive action.
- CARE PATHWAYStress-test one care pathway.
Expose dependencies across access, workforce, technology, post-acute care, and episode economics.
- CONTINUITYName emergency successors.
Document immediate decision coverage for every role critical to care and enterprise continuity.
- RECOVERYRun a cyber recovery exercise.
Test clinical downtime, restoration order, executive command, and communication in one scenario.
Closing perspective
Resilience gives leaders room to choose.
Organizations become fragile when every disruption forces a new priority, a new exception, or a new decision path. Operating discipline creates the opposite condition. It makes thresholds visible, ownership clear, and recovery rehearsed. That is how a healthcare enterprise protects its mission without freezing its strategy.
Selected sources
Primary guidance and current operating context.
- MedPAC, March 2026 Report to Congress: Hospital Inpatient and Outpatient Services
- CMS, Transforming Episode Accountability Model
- CMS, 2026 Changes to the AHEAD Model
- American Hospital Association, Leadership Succession as a Strategic Imperative
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations
- HHS, Healthcare and Public Health Cybersecurity Performance Goals
- ASPR, RISC 2.0 Cybersecurity Module