Crisis Communications for a HealthTech Startup

This reflects the type of challenge our consultants are built to solve, drawn from real industry experience. A security incident exposed partial records, name, phone number, and appointment history, but not clinical data, of approximately 12,000 patients. A journalist from a tech publication had the story and had given the company a 36-hour window for comment. The founding team's first instinct was to say nothing. Their legal counsel's first instinct was to deny. Neither was viable. The 36 hours had already started.

Our PR consultant was engaged within 6 hours of the journalist's contact. A crisis communications cell was assembled: CEO, General Counsel, Head of Product. A disclosure statement was drafted, reviewed by legal, and finalised in 11 hours, not the 14 hours originally allocated, because legal pushed to add three caveats that softened the statement into something no journalist would accept as transparent. That negotiation took 3 of the 11 hours. Patient communications were drafted for WhatsApp, email, and in-app. CERT-In notification was filed within the statutory 6-hour regulatory window.