Merger Scope and Baseline in a Hospital Group
Groupe Hospitalier Nord (GHN) is merging with Clinique Saint-Roch. GHN operates three hospitals with 4,200 staff, two data centres and a shared EHR; Saint-Roch brings a 25-year-old legacy EHR, a separate PACS and 40 medical devices still on a flat VLAN. The EBIOS Risk Manager pilot has 10 weeks and a steering committee that wants 'one harmonised risk picture' before the 2025 migration. The CISO argues that because GHN has ISO 27001 certification, Workshop 1 can be reduced to a list of compliance gaps; the clinic's CIO wants payroll and research archives included because they sit on the same storage array. A telemedicine provider supplies video consultations for both entities and holds session recordings for 30 days. Patient identifiers are duplicated across the two EHRs, and no one can confirm who owns the interface engine. The project manager asks you to frame the study so that it supports migration decisions rather than producing a catalogue.
1. Which elements should be in the EBIOS RM scope, and which should be explicitly excluded? Justify each boundary decision in terms of business values, supporting assets and dependencies.
Read the worked answer
Scope should be driven by mission and control boundaries, not by storage location. In scope: patient care continuity, clinical record integrity and patient confidentiality for both sites; supporting assets include both EHRs, the interface engine, PACS, identity/AD, backup, and the network segments carrying clinical traffic. The 40 medical devices belong in scope because their flat VLAN creates a credible path to care disruption. The telemedicine recordings are an external dependency: include the interface and retention arrangement, but record the provider as an ecosystem stakeholder rather than pretending GHN controls its internal assets. Out of scope, with rationale: payroll processing detail and research archives are not primary care values; if they share a storage array, treat that as a hosting dependency to document, not as a reason to expand the whole study. Exclude a pure ISO 27001 gap catalogue as a substitute for risk analysis, but reuse it as evidence. This boundary gives the migration a defensible risk picture without turning every shared array into a scope driver.
2. Propose three feared events for the merged entity and link each to a business value and at least two supporting assets. Explain why each is a feared event rather than a generic risk.
Read the worked answer
Unavailability of the EHR during emergency care for more than 30 minutes. Business value: continuity of patient care. Supporting assets: EHR database, interface engine, network, AD and backup. It is a feared event because it states the impact on the mission, not the cause; a ransomware attack or a failed migration could both produce it.
A corrupted laboratory or imaging result displayed as valid in the EHR. Business value: integrity of clinical data. Supporting assets: interface engine, PACS, result-validation service. This is a feared event because it changes a clinical decision; it is not the same as 'interface engine vulnerability'.
Disclosure of patient records, including telemedicine recordings, to an unauthorised party. Business value: patient confidentiality and trust. Supporting assets: EHR access layer, telemedicine recording store, backup media. This is a feared event because it describes the business consequence and legal exposure, leaving the threat path to be modelled later.
3. How should the team use the 'socle' (baseline) for Saint-Roch's legacy estate, and what risk would arise if the pilot skipped it?
Read the worked answer
Use the socle as a rapid hygiene baseline for the legacy estate: patching, backup restoration, privileged accounts, network segmentation and logging. Compare Saint-Roch against it to expose gaps that would otherwise be hidden by the migration timetable. Then run EBIOS scenarios for mission-specific risks that a baseline cannot answer, such as duplicated patient identifiers or interface-engine ownership. If the pilot skipped the socle, the team would likely mistake ISO 27001 scope for assurance: certification at GHN does not cover Saint-Roch's flat VLAN or its 25-year-old EHR. The result would be migration decisions based on an untested assumption, with baseline weaknesses carried into the target environment. The socle is therefore a gap-assessment input and a source of candidate measures, not a replacement for Workshops 2 to 5.