🔐 Cyber BCP 📋 Regulatory BCP Compliance 📝 Drills & Documentation

An unprotected healthcare facility
is a clinical shutdown waiting to happen.

EHR down = Outpatient stopped = Revenue stopped
Against inspections, ransomware, and disasters —
facilities without an operational BCP are already at risk.

Ransomware attack

Outpatient halt
Days to weeks

EHR / billing system offline

Revenue loss per day stopped

Millions of yen
in losses

Revenue halt + recovery costs

No drill records

"Non-compliant"
under inspection

No record = not conducted

👉 BCP Risk Assessment (3 min) Schedule a Consultation

Which of these applies to your facility?

Check the following items honestly.

A BCP exists on paper, but no drills have ever been conducted.

No cyber response protocol exists for ransomware or system intrusions.

There is no defined procedure to switch to paper operations if the EHR goes offline.

Staff do not know what the BCP says or what their role is during an incident.

No drill records, training logs, or review documentation have been maintained.

👉 One match = effectively non-compliant

BCP gaps are a business risk — in real numbers

These are not abstract threats. They are documented, measurable losses.

💻

Ransomware attack → Clinical shutdown

Millions to tens
of millions of yen

Ransomware disabling the EHR can halt outpatient and emergency services for weeks. Without a cyber BCP, initial response delays compound the damage significantly.

⏱️

Revenue loss per day of downtime

Millions of yen
per day

Even a mid-size clinic losing one day of operations faces revenue loss in the millions. Extended shutdowns cause direct financial harm to the institution.

🔍

Regulatory inspection finding → Remediation

Remediation costs
+ reputational damage

No drill records = not conducted, under inspection standards. Emergency remediation costs far exceed proactive compliance investment — plus the reputational fallout.

⚠️

Disaster chaos → Medical error risk

Liability exposure
+ regulatory action

Undefined procedures during a disaster create conditions for medication errors and documentation failures. Resulting liability and administrative sanctions can threaten operations.

An unaddressed BCP gap is an unmanaged business risk.

What We Build

We don't write documents. We build systems that keep your facility operational.

TOP PRIORITY — Priority 1

■ Cyber BCP

Incident response procedures from first alert
EHR-offline paper operations protocol
Reference system utilization under outage
Vendor management and liability demarcation
Multi-factor authentication policy design

REGULATORY COMPLIANCE — Priority 2

■ Medical BCP (Regulatory)

MHLW compliance checklist alignment
BCP document creation (guideline-compliant)
Business continuity design: priority triage & alternatives
Infectious disease BCP + disaster BCP integration

OPERATIONAL EMBEDDING — Priority 3

■ Drills, Training & Documentation

Annual staff training program design
Tabletop drills (2× per year)
Drill records and audit-ready documentation
PDCA review cycle implementation

Why Our BCP Actually Works

Three design principles that separate operational BCPs from filed documents.

📘

Regulatory Fidelity

Full alignment with MHLW guidelines, the Medical Care Act, the Act on Protection of Personal Information, and the Cybersecurity Notice. We eliminate the risk of rework from compliance gaps.

🏥

Clinical Operations Design

We design around how your facility actually runs — workflows, staffing configurations, diagnostic dependencies. A BCP that doesn't match your operations won't survive first contact with a real incident.

📂

Audit-Ready Documentation

We build the complete paper trail: training records, drill reports, compliance checklists, review logs. When inspectors arrive, you can answer every question.

We design to the standard that survives an on-site inspection.

Service Plans & Pricing

Designed around your facility's current situation. Multi-location discounts available. Nationwide remote delivery via Zoom; on-site visits also available.

Foundation Plan

For facilities needing baseline BCP compliance

From ¥150,000

(excl. tax — varies by facility size)

BCP document creation (guideline-compliant)
MHLW compliance checklist response
Business continuity design (core items)
Delivery in editable Word format

Standard Plan

Regulatory compliance + cyber coverage in one package

From ¥200,000

(excl. tax — most frequently selected)

BCP document + compliance checklist
Cyber BCP design Added
Incident initial response protocol
Staff training program Added

Full Coverage Plan

Complete inspection and incident readiness

Custom Quote

(based on facility scale and scope)

BCP + integrated cyber BCP design
Training program + tabletop drills (2×/year)
Complete drill records and documentation
On-site inspection support
PDCA review cycle + ongoing support

Multi-location and medical corporation group discounts available.
Start with a free 3-minute BCP risk assessment.

👉 BCP Risk Assessment (3 min)

Track Record & Credentials

The foundation behind every BCP we build.

300+

Healthcare & Care Facility BCPs Delivered

Over 300 BCP engagements across hospitals, clinics, and care facilities nationwide — giving us practical pattern recognition no template can replicate.

30 yrs

Regulatory Inspection Experience

Michihiro Kohama has spent three decades navigating healthcare regulatory frameworks. He builds BCPs to survive the inspection questions — because he knows exactly what inspectors ask.

Multi-
domain

Medical Law, Privacy, and Cyber Expertise

Deep fluency across the Medical Care Act, Act on Protection of Personal Information, and MHLW Cybersecurity Notice — all integrated into a single, coherent BCP structure.

National

Remote Delivery — Every Prefecture

Full-service delivery via Zoom from Hokkaido to Kyushu. On-site visits available for facilities that prefer in-person engagement.

Frequently Asked Questions

Q1. We already have a BCP from a template. What's the problem?

Template-based BCPs almost never reflect your facility's actual layout, staffing structure, or clinical workflow. During a regulatory inspection, the question is not "does a document exist?" — it is "can your staff actually execute this?" Without drill records, the inspection will treat it as unconducted regardless.

Q2. Is a Cyber BCP really necessary?

Yes. The Ministry of Health, Labour and Welfare has explicitly required healthcare BCP to address cybersecurity threats in its revised guidelines. More practically: if your EHR goes offline and you have no defined paper operation protocol, your outpatient department stops. The question is not whether this risk exists — it is whether you have a tested response when it occurs.

Q3. Can you support the actual drills, not just the design?

Yes. The Full Coverage Plan includes tabletop drill design and facilitation (2× per year) plus complete documentation of outcomes. Drill support is also available as a standalone engagement if you already have a BCP but need to operationalize it.

Q4. Can everything be done remotely?

Yes. We use a structured pre-engagement interview form followed by Zoom working sessions. Facilities from every prefecture have completed full BCP engagements this way. On-site delivery is also available upon request.

Q5. Will this hold up under an on-site regulatory inspection?

That is the design target. We follow MHLW guideline structure and compliance checklists, and we build the complete supporting documentation — training records, drill reports, review logs — that inspectors require. The Full Coverage Plan includes explicit inspection support.

Q6. We have no existing disaster manual. Can you start from zero?

Yes. Starting from zero is the standard case for most engagements. If existing materials are available, we incorporate and improve them. If nothing exists, we build from the ground up.

Q7. We have multiple locations. How does pricing work?

Each location with a distinct address requires its own BCP under regulatory requirements. Multi-location discounts apply for second locations and beyond. Medical corporation groups with three or more locations should contact us for a group engagement proposal.

Q8. What happens when the regulations change after delivery?

All BCP documents are delivered in editable Word format, allowing your facility to update them directly. Ongoing compliance monitoring and annual revision support are available through our continued support arrangement.

A Note from Our Principal

M.
Kohama

Michihiro Kohama

Representative Director, Care Diversity Lab (CDL)
Principal, Kohama Care Management Office
Healthcare management consultant | 300+ lectures annually | 30+ books published

"The purpose of a BCP is not to produce pages. It is to ensure your staff know exactly what to do when everything is going wrong — and to save as many lives as possible in the process."

Over the course of more than 300 BCP engagements across Japan, the pattern I see most often is this: facilities spend months producing a document, then file it away — and the document is never tested, never explained to staff, and never updated. When the incident arrives, the BCP is useless.

Ransomware attacks on Japanese healthcare facilities are no longer theoretical. Facilities have lost access to their electronic health records for weeks. Outpatient services have been halted. Revenue has stopped. The question is not whether this could happen to you — it is whether you will be ready when it does.

The regulatory environment has also hardened. Inspectors are no longer satisfied with a document in a folder. They want to see drill records. They want to know that staff can answer for the BCP. They want evidence that the system has been reviewed and improved.

What we build at CDL is not paperwork. It is an operational system — designed to work in your facility, understood by your staff, tested through drills, and documented to the standard that survives inspection. That is what a BCP is supposed to be.

Selected Works by Michihiro Kohama

BCP Creation Guide for Care and Disability Welfare Facilities

BCP Creation Guide
for Care & Disability Welfare Facilities

Business Continuity Planning
for Long-Term Care

▶ Waiting until before an inspection is too late. A compliant BCP takes weeks to months to build properly.

▶ Attackers do not wait for you to be ready. Ransomware incidents arrive without warning — the first 24 hours determine the outcome.

▶ Can your facility respond right now? If you have to think about it, the answer is probably no.

Stop filing a BCP. Build one that works.

Regulatory compliance, cyber resilience, and drill documentation — integrated.
Nationwide remote delivery. On-site visits available.
Start with a free 3-minute BCP risk assessment.