| Course | IOP 455 Professional Ethics (IOP/455) |
|---|---|
| Week | 4 |
| Paper type | Crisis management paper |
| Length | about 1,022 words, 4 double-spaced pages plus title page and references |
| Format | APA 7 student paper |
| School | University of Phoenix |
| Program | BS in Psychology |
| Updated | October 2026 |
Free sample paper for IOP 455 Week 4
Seventy-Two Hours After the Breach: Ethical Crisis Communication at a Hospital System
[Student Name]
University of Phoenix
IOP/455: Professional Ethics
Week 4 Assignment
[Instructor Name]
[Date]
The hospital system, incident and staff are composites written for a model paper; research findings come from the sources listed.
Crises test an organization's values under pressure. Decisions made in the first hours, what to say, to whom and when, shape trust long afterward. This paper examines a crisis at the Tucson hospital system from the perspectives of crisis theory, ethics and the employees caught in the middle.
The Crisis
On a Monday morning, staff at the three-hospital system find their computers locked by ransomware. Electronic records are unavailable, scheduled surgeries are postponed and clinicians revert to paper charts. By Tuesday, the attackers post a sample of employee files, including names, Social Security numbers and home addresses, on a website and demand payment. Local reporters begin calling. In an emergency meeting, the general counsel recommends a brief statement that the system is "investigating a technology issue," with no mention of stolen data until the investigation is complete.
What a Crisis Is
Pearson and Clair (1998) described organizational crises as low-probability, high-impact events that threaten an organization's viability, characterized by ambiguity about cause, effect and means of resolution and by a belief that decisions must be made quickly. Drawing on psychological, social-political and technological-structural perspectives, they argued that crises shatter people's shared meanings and assumptions as well as disrupt operations, and that successful crisis management restores both. Effective management depends on preparation, executive attention and attention to the people affected.
For the hospital, the crisis is not only technical. Employees whose personal data are exposed feel violated and anxious; patients whose surgeries are delayed feel unsafe; clinicians working on paper feel overwhelmed. Restoring trust requires addressing these experiences.
Matching the Response to Responsibility
Coombs (2007) built situational crisis communication theory around one idea: the public assigns an organization more or less blame depending on what kind of crisis it is. In crises where the organization is seen as a victim, responsibility is low; in accidental crises, moderate; in preventable crises, high. A history of similar problems and a poor prior reputation increase attributed responsibility. As responsibility rises, organizations should move from providing information and expressing concern toward accepting responsibility, apologizing and offering corrective action and compensation.
A ransomware attack might seem to make the hospital a victim, but if reports show that the system delayed security updates despite warnings, stakeholders are likely to see it as at least partly preventable. The theory suggests that a minimal statement would be a mismatch. The hospital needs to acknowledge the breach, express concern, accept responsibility for protecting data and offer concrete help.
"Investigating a technology issue" was technically true on Tuesday; by Wednesday, staff were reading their own Social Security numbers on a news site.
The Timing of Disclosure
Arpan and Roskos-Ewoldsen (2005) tested the effect of disclosing crisis information first, a tactic called stealing thunder. Participants read news stories about an organization's crisis in which the organization either disclosed the problem itself or the information came from a third party. When the organization disclosed first, participants judged it more credible, and credibility helped explain more favorable views of the crisis. The authors concluded that proactive disclosure can limit damage.
For the hospital, the data are already public. Waiting until the investigation concludes means employees and the public will learn about the breach from attackers and reporters, which research suggests will damage credibility further.
Ethical Obligations
Beyond strategy, the hospital has ethical obligations. Employees have a right to know promptly that their personal information has been exposed so they can protect themselves. Patients have a right to accurate information about delays to their care. Legal notification deadlines set minimums, but ethics may require faster and fuller communication. Here, honesty and long-term self-interest point in the same direction.
Naomi's Recommendations
As the internal I-O psychologist, Dr. Naomi Reyes is asked about employee communication. She recommends a message to all staff within hours, signed by the chief executive, stating what is known, what data were exposed, what the system is doing, what employees should do and where to get help. She recommends free credit monitoring and identity protection for all employees, a dedicated phone line staffed by people trained to handle anxious callers and paid time to address identity issues. For clinicians working under paper systems, she recommends added staff, reduced nonurgent workloads and visible leadership presence on units.
She also recommends a public statement acknowledging the breach and the surgery delays, apologizing for the disruption and describing corrective steps, with updates at set times.
A Sample Staff Message
Naomi drafts the opening of the staff message: "This morning we confirmed that criminals who attacked our computer systems on Monday also took personal files belonging to many of you, including names, Social Security numbers and home addresses. We are sorry. Protecting your information was our responsibility. Starting today, every employee can enroll in free identity protection, and a support line staffed around the clock is open now. We will update you every afternoon at four, including when we do not yet have answers." The message is short, specific, accepts responsibility and promises regular contact, even when there is no news.
Rumor and Silence
In the first hours, rumors spread quickly on staff group chats: that payroll would be missed, that patient deaths had occurred, that leaders already knew of the breach weeks earlier. Silence from leadership gives rumors room to grow. Scheduled updates, even brief ones, and a single place to find accurate information reduce speculation and show employees they are being treated as partners rather than an audience to be managed.
Learning Afterward
After the crisis, the system should review what happened, including why security warnings were not acted on, and share findings with staff. Pearson and Clair noted that organizations often fail to learn from crises; a candid review and visible changes help rebuild trust.
Conclusion
The ransomware attack threatened operations, patients' care and employees' personal security. Crisis research shows that crises disrupt meaning as well as systems, that responses should match the responsibility stakeholders attribute and that disclosing bad news first builds credibility. Early, honest communication, concrete help for employees and a candid review afterward serve both ethics and the hospital's long-term reputation.
References
Arpan, L. M., & Roskos-Ewoldsen, D. R. (2005). Stealing thunder: Analysis of the effects of proactive disclosure of crisis information. Public Relations Review, 31(3), 425-433. https://doi.org/10.1016/j.pubrev.2005.05.003
Coombs, W. T. (2007). Protecting organization reputations during a crisis: The development and application of situational crisis communication theory. Corporate Reputation Review, 10(3), 163-176. https://doi.org/10.1057/palgrave.crr.1550049
Pearson, C. M., & Clair, J. A. (1998). Reframing crisis management. Academy of Management Review, 23(1), 59-76. https://doi.org/10.5465/amr.1998.192960
What the IOP 455 Week 4 instructions ask
Week 4 assignments in IOP 455 generally cover crisis and public relations management from an ethical and psychological standpoint. Students commonly define organizational crises and their phases, describe crisis communication strategies and the theories behind them, discuss obligations to employees, customers and the public and evaluate an organization's actual or proposed response. Some versions ask students to write a crisis plan or a sample statement. Connect strategy choices to research, consider the psychological effects of a crisis on employees as well as reputational effects and identify where honesty and self-interest align or conflict. Ground the analysis in the textbook and published crisis research, cited in APA style, and draft at least one message the organization could actually send.
How this IOP 455 Week 4 example is built
Our worked paper follows the hours after attackers encrypt the hospital system's records and post a sample of employee Social Security numbers online. Executives debate saying little until the investigation ends. A multidisciplinary view of crisis management explains that crises affect people's beliefs and emotions, not only operations. Situational crisis communication theory suggests that because the hospital will be seen as partly responsible for its security, it needs to accept responsibility and offer concrete help, not just information. An experiment shows that disclosing bad news before others do improves credibility. Dr. Naomi Reyes argues for early, honest communication with staff, identity protection and support for overwhelmed employees.
IOP 455 Week 4 grading rubric: where the points go
Instructors grading crisis papers weigh accurate use of crisis theory, ethical reasoning and attention to all stakeholders. Instructors look for the crisis to be classified, for response strategies to be matched to perceived responsibility and for the timing and honesty of communication to be addressed. Credit goes to recognizing employees as stakeholders, to distinguishing legal notification duties from ethical obligations and to practical recommendations with sample messages. APA formatting, organized sections and a realistic sample message are expected. Strong papers also evaluate the response after the fact, noting what the organization should learn and change, and how it will show employees that the lessons were taken seriously.
IOP 455 Week 4 help: mistakes to avoid
A common weakness is treating crisis communication as image repair alone, overlooking duties to the people harmed. Another is recommending silence or minimal statements until all facts are known, without weighing evidence that early disclosure builds trust and that delay invites others to tell the story. Students also ignore employees, who are often both victims and the organization's front line. Some papers describe theory without classifying the specific crisis, so the recommended strategy does not follow. Classify the crisis, identify every stakeholder, match strategies to evidence and write messages that are honest and specific. Read each sentence as the most anxious employee would. A tutor can help you draft a crisis statement that balances honesty and caution.
Related IOP 455 sample papers
Other IOP 455 week samples
- IOP 455 Week 1: Ethical Frameworks and Codes
- IOP 455 Week 2: Law and Personnel Management
- IOP 455 Week 3: Ethics in Assessment and Selection
- IOP 455 Week 5: Ethical Decision-Making Case
More BS in Psychology sample papers
- PSY 110 Week 4: Problem-Solving Worksheet
- PSY 203 Week 4: Motivation, Emotion and Stress
- PSY 205 Week 4: Early and Middle Adulthood
- PSY 250 Week 4: Humanistic and Existential Views
IOP 455 Week 4 questions, answered
What does IOP 455 Week 4 usually cover?
It usually covers organizational crises, crisis communication strategies, stakeholder obligations and the ethics of disclosure.
Where can I find a free IOP 455 Week 4 sample paper?
The IOP 455 Week 4 paper on a hospital's response to a ransomware data breach is above, free.
What is situational crisis communication theory?
A theory that recommends response strategies based on how much responsibility stakeholders attribute to the organization.
What is stealing thunder?
Disclosing negative information about one's organization before others do, which research links to greater credibility.
Why are employees key stakeholders in a crisis?
They are often directly harmed, they keep operations running and they shape how the public views the organization.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official University of Phoenix document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
Request this one custom, free · All IOP 455 week samples · All courses