Crisis Leadership in the Aftermath of Healthcare Cyberattacks: Digital Forensics, Organizational Learning, and Patient Safety

Abstract

Healthcare cyberattacks increasingly threaten not only digital infrastructure but also organizational continuity and patient safety. Although existing research has examined crisis leadership, digital forensics, organizational learning, and cyber resilience, these areas are often treated separately. This conceptual paper integrates these perspectives to explain how healthcare organizations can convert cyber incidents into opportunities for learning and resilience development. Drawing on literature from crisis leadership, cybersecurity, digital forensics, organizational learning, healthcare resilience, and patient safety, the paper develops a conceptual framework linking crisis leadership, digital forensic effectiveness, organizational learning, cyber resilience, and patient safety. Five propositions are advanced. The framework argues that effective crisis leadership supports digital forensic investigation, that forensic investigation strengthens organizational learning, and that leadership enhances the translation of forensic findings into organizational change. Organizational learning is subsequently proposed to strengthen cyber resilience, while greater resilience reduces cyber-related risks to patient safety. The paper contributes by repositioning digital forensics as a source of organizational knowledge, extending crisis leadership into the post-cyberattack healthcare context, and linking cyber resilience directly with patient safety. The framework provides a basis for future empirical testing and offers practical guidance for healthcare leaders seeking to improve post-incident learning, recovery, and organizational preparedness.