Activate your incident-response and downtime plans, protect safe patient care, and bring qualified security, privacy, legal, clinical, and communications leads together. Contain the attack without compromising clinical workflows or evidence, determine what systems and information were affected, and assess promptly whether unsecured protected health information (PHI) was breached. A cyberattack does not automatically mean a reportable HIPAA breach, but notification deadlines can be strict if one occurred.
What to do first: protect care and organize the response
U.S. Department of Health and Human Services (HHS) Office for Civil Rights guidance calls for executing incident-response and mitigation procedures and contingency plans. Start with the people and processes that keep care safe, then coordinate technical actions through the incident team rather than relying on improvised fixes.
As an Amazon Associate I earn from qualifying purchases.
- Activate incident leadership. Use your incident-response plan to contact designated IT and security, privacy, legal, clinical operations, communications, and executive leads. Name an incident lead who can coordinate decisions and keep a record of them.
- Switch to safe downtime workflows. Follow the organization’s contingency procedures for affected systems and services. Clinical leaders should coordinate any changes to care processes so staff have a safe, consistent way to work while systems are unavailable or unreliable.
- Contain the attack through authorized responders. Have qualified security personnel isolate affected systems as appropriate, stop propagation, and address the conditions sustaining the incident. HHS specifically advises isolating infected systems in a ransomware response. Avoid ad hoc actions that could destroy evidence or make clinical workflows less reliable.
- Open an incident record. Record when the event was detected, who was notified, decisions made, and the known effects on care and operations. Keep relevant logs and other evidence available to responders.
Establish the scope and preserve evidence
Initial analysis should establish what happened and whether it is continuing; deeper analysis helps determine whether PHI was compromised and what notifications may be required. Work with qualified technical responders to document:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Which systems, services, facilities, and vendors are affected, and how that affects care or operations.
- When the incident began or was detected, its likely origin and method, and whether it has propagated.
- Relevant malware indicators, logs, and other evidence of access, acquisition, disclosure, or attempted exfiltration.
- Whether data integrity or system availability may have been affected, and what information could be involved.
Preserve evidence as responders investigate. Do not treat a lack of obvious data theft as proof that PHI was not accessed; the assessment depends on the incident facts and available evidence.
Coordinate vendors and outside responders
Contact affected EHR, cloud, billing, managed-service, and other providers through verified channels. Ask them to preserve relevant evidence, explain the impact on their systems and your services, and coordinate containment and recovery. Review business associate agreements (BAAs) and incident clauses for reporting requirements and contact procedures.
Under HIPAA, a business associate must report security incidents to the covered entity, and breach reporting has additional requirements. A BAA may set a faster reporting deadline than HIPAA’s outside limit. Establish who will investigate, who will assess the breach, and who will notify individuals or regulators; the covered entity remains responsible for ensuring required notifications are made, even if it delegates delivery to a business associate.
Rank #2
Decide whether the incident is a reportable HIPAA breach
A HIPAA security incident involves attempted or successful unauthorized access, use, disclosure, modification, destruction, or interference with system operations. That definition is not the same as a final determination that a reportable breach occurred.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11HHS treats ransomware breach analysis as fact-specific. When ransomware encrypts ePHI, the information may be considered acquired and a breach presumed unless the entity can demonstrate a low probability that PHI was compromised. Document the assessment, including at least these factors:
Rank #3
- Nature and extent of the PHI: What information was involved, including identifiers and the likelihood that people could be re-identified?
- Who was involved: Who obtained or could have obtained unauthorized access, and what is known about that person or group?
- Whether information was acquired or viewed: What evidence indicates access, viewing, copying, exfiltration, or attempted exfiltration?
- Mitigation: What steps were taken to reduce the risk of further use or disclosure?
Malware behavior, propagation, signs of data removal, and effects on data integrity can inform the analysis. Involve privacy and legal leadership, retain the supporting evidence and reasoning in the incident record, and assess applicable state, contractual, and other obligations alongside HIPAA. Those additional requirements depend on the provider’s location, services, agreements, and incident facts.
Meet HIPAA breach-notification deadlines
The following federal time limits apply to a reportable breach of unsecured PHI. Notices must be made without unreasonable delay; the stated day limits are outside limits, not a reason to wait. Coordinate with counsel and privacy leadership on how the discovery date, affected population, and applicable obligations apply to the incident.
| People affected | Individual notice | HHS notice | Media notice |
|---|---|---|---|
| 500 or more individuals | Without unreasonable delay and no later than 60 days after discovery. | Without unreasonable delay and no later than 60 days after discovery. | Required if more than 500 residents of a state or jurisdiction are affected; notify prominent media serving that state or jurisdiction without unreasonable delay and no later than 60 days after discovery. |
| Fewer than 500 individuals | Without unreasonable delay and no later than 60 days after discovery. | The covered entity may report annually; the report is due no later than 60 days after the end of the calendar year in which the breach was discovered. | The threshold for this media notice is not met. |
A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery of a breach, though its BAA may require faster reporting. Coordinate notification roles and verify that assigned notices were completed.
Individual notices should explain what happened and what information was involved, steps people can take to protect themselves, what the entity is doing to investigate and mitigate the incident, and how to contact the entity. Keep records showing that required notices were made or documenting why notice was not required.
Best Value
Report the crime and coordinate public communications
HHS OCR’s response checklist recommends reporting the crime to appropriate law enforcement, which may include local or state police, the FBI, or the Secret Service. It also recommends sharing cyber threat indicators with appropriate federal and information-sharing organizations. Do not include PHI in such reports unless HIPAA permits it.
If law enforcement asks to delay breach reporting because notice would impede an investigation or harm national security, follow the delay rule in OCR’s checklist; obtain the request in writing where possible. Route statements to patients, staff, media, and other external audiences through the incident communications lead and counsel so they are accurate and consistent.
Recover systems in a controlled sequence
Do not treat restored access as proof that systems are safe. Coordinate the return of services with clinical operations and qualified technical responders. HHS describes a robust ransomware response as including containment, eradication, vulnerability remediation, recovery, and lessons learned.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
- Remove malware and remediate the vulnerabilities or other conditions that enabled the incident.
- Validate backups and restored systems before relying on them for patient care or business operations.
- Return services in a planned sequence, with clinical leaders checking that workflows are safe and workable.
- After recovery, review what happened and update response, downtime, and recovery plans based on the incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
