Three-minute security drills that fit into hospital shift handovers
TL;DR Scrubdrill gives hospital staff a three-minute, game-style security drill on their phones at each shift handover, based on what really happens on wards - shared logins, fake vendor emails and USB sticks in the lab. Hospital groups pay per bed per year. It asks for minutes, not half-day sessions nobody can attend.
In November 2022 a phishing email opened by one employee at AIIMS Delhi led to a ransomware attack. Emergency, outpatient, inpatient and lab services ran on paper, and online appointments took about 19 days to come back[1]. ThePrint reported that AIIMS spent more than two weeks trying to restore lost data[2].
And hospital staff are hard to train. Nurses work rotating shifts, and front-desk and billing staff turn over quickly. When researchers phished 819 staff at a big Norwegian hospital, more than half clicked - 65% of controls and 53% of the untreated group. An extra priming step didn't change that in any significant way[3].
So who's actually sitting in the annual classroom session? Not the people who are never off the ward at the same time.
Scrubdrill is a phone-based drill programme built around the hospital day. At each shift handover, staff open one drill. It's a short scenario with a choice to make. Maybe a lab analyser vendor emails a "firmware update" link, a colleague asks to borrow your login to finish a discharge, or a patient's relative asks the front desk to email reports to a new address. Each drill takes about three minutes and gives points for the right call, with ward-level leaderboards for teams that like them.
Content changes by role. Nurses get shared-workstation and login scenarios, billing gets payment and insurance fraud, and IT gets incident drills timed against the six-hour CERT-In reporting rule[4]. Phishing simulations run monthly by email, and every reported phish earns more points than a correct drill.
What it does in regulatory terms: staff training only. Scrubdrill does not touch patient records or clinical systems.
The seed pitched gamified micro-learning for everyone. I narrowed it to hospitals, because the cost of an attack there is measured in delayed care and because shift work breaks the usual training model.
The users are nurses, ward clerks, front-desk, billing and lab staff. The payer is the hospital's IT head, often with the quality or accreditation team. Global per-seat awareness tools list at about ₹2,300–3,700 per seat per year (US$23.64–38.28)[5]. Pricing per bed and not per seat makes high-turnover staff cheaper to cover, and it makes the budget easy to compare across hospitals in a group.
DPDP penalties apply from 13 May 2027, up to ₹250 Cr for failing reasonable security safeguards[6], and hospitals hold some of the most sensitive data there is. The AIIMS attack made hospital ransomware real for Indian boards[1]. Staff now carry smartphones on shift, so a three-minute drill doesn't need a training room.
I found no figure for spending on cyber training in Indian hospitals. The adjacent evidence is that general awareness tools sell at scale - one Indian awareness platform says it has trained more than 4.8 million employees[7], and the global market leader publishes its seat prices openly[5]. Neither number is specific to healthcare, so treat both as proof the category sells, not as its size.
An Indian awareness platform offers phishing simulation and an AI-personalised learning system[7]. The US market leader sells global awareness training with healthcare content[5]. Both assume staff sit at desks with company email, which nurses mostly don't.
The gap is training designed for rotating ward shifts, shared terminals and high turnover, sold in terms a hospital already budgets in.
| Difficulty | Moderate (35/100) |
| Starting capital | ₹35–70 L |
| Time to launch | 3–5 months |
The app is simple. Two things are hard. Scenarios have to feel true to Indian wards, so you need nurses and hospital IT staff writing them. And hospitals buy slowly, because the decision runs through IT, quality and finance and private groups will want a pilot with results before they roll anything out.
No sector licence. This is staff training software, so medical-device rules don't apply.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Keep AI well away from patient records and clinical systems. Scrubdrill trains staff only, and its scenarios should never use real patient data.
Want to work out the AI layer for Scrubdrill? Talk to Yash →
I'd back this for a founder with hospital operations or nursing experience who can win a pilot at one private hospital group. If you're a generic e-learning team then it's a poor fit. Prove first that drill completion stays above 70% for eight weeks on two wards, and that the phish-reporting rate goes up.
Plan for roughly ₹35–70 L, mostly on building role-based drills and winning the first hospital pilot.
No. It's staff training software, so you need DPDP processor terms with the hospital, company registration and GST once over the threshold.
Yes. Hospitals everywhere face phishing and shared-login risks. Check the local health data and privacy law before you sell.
The free Scrubdrill validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection and incident-reporting checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for hospital IT and nursing heads, and 5 assumptions to test. Download the kit →
Thinking about building Scrubdrill or something close to it? The make-or-break work is getting ward managers to make drills part of every handover, and I can help you figure out how to win them over. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.