CYBER-RESILIENT HOSPITAL OPERATIONS AFTER THIRD-PARTY CLAIMS FAILURE: A RISK-WORKFLOW FRAMEWORK

Third-party claims failure reveals a hospital vulnerability that conventional cyber-defense models explain only partially. Operational continuity may deteriorate even when local clinical systems remain available because hospital workflows depend on external eligibility, authorization, pharmacy, remittance, and claims intermediaries. Recent healthcare cyber-resilience research has broadened, yet process-level modeling of vendor-to-hospital dependency cascades remains underdeveloped. This article addresses that gap through a conceptual-comparative framework positioned in the discipline of Modeling and Analysis of Information Systems. The study combines graph-based dependency modeling with a resilience-oriented risk-workflow framework and applies it to three disruption configurations: internal hospital core-system failure, single-vendor claims failure, and tightly coupled multi-node dependency disruption. The analytical unit is the hospital service workflow rather than the isolated technical asset. The framework formalizes external dependency nodes, propagation paths, continuity exposure, containment options, and recovery bottlenecks. It also proposes a compact metric system centered on critical node centrality, cascade depth, service-continuity exposure, dependency concentration, and recovery complexity. The main conclusion is that third-party claims failure produces a distinct resilience profile characterized by distributed care-adjacent disruption, delayed degradation, strong concentration effects, and externally constrained recovery, which justifies workflow-centered analysis in Information Systems research.