The first hour of a suspected ransomware incident should produce a clear handoff: a clinical lead protecting patient care, a technical lead containing the problem, and a privacy lead preserving the facts. It does not need to produce a confident answer about every affected record—or a rushed promise that nothing was exposed.
Ransomware is malicious software that can block access to data, often by encrypting it. For a Sarasota medical practice, that can interrupt scheduling, referrals, and access to electronic protected health information (ePHI). The time windows below are our recommended operating sequence, not HIPAA reporting deadlines or a guarantee of recovery within an hour. Use them alongside your approved incident-response and clinical downtime procedures.
What HIPAA requires—and what this plan adds
The HHS summary of the HIPAA Security Rule describes safeguards for the confidentiality, integrity, and availability of ePHI. The HHS ransomware fact sheet explains the role of incident procedures, contingency plans, backups, and recovery testing. Restoring access is one responsibility; evaluating possible disclosure of protected health information (PHI) is another.
A practice manager should be able to find the response contacts without opening the affected computer. Keep an offline copy of the call list and downtime instructions, with named alternates. Tie those responsibilities to your HIPAA compliance program, not just an IT ticket queue.
Minutes 0–15: protect patient care and raise the alarm
- Activate the clinical downtime plan. Tell the clinical lead which functions appear unavailable. Clinicians decide how to handle urgent needs, appointments, and safe alternatives; front-desk staff should not improvise clinical decisions. Protect any paper records created during downtime.
- Report observable facts. Record the discovery time and time zone, workstation or system name, visible message, and affected workflow. Say “the scheduling workstation shows a ransom note,” not “the entire EHR was stolen” unless that has been established.
- Use a known, separate contact channel. Call your designated IT or incident-response contact and practice leadership using an offline number. If email may be compromised, do not use it to coordinate the response. Keep PHI out of personal messaging apps and public support forms.
- Stop using the suspected device. Follow pre-approved isolation instructions for an ordinary workstation, such as disconnecting its network connection when safe and authorized. Do not disconnect patient-care equipment or shared clinical infrastructure without the clinical lead and technical responders assessing the impact.
Do not reboot, wipe, reinstall, run cleanup tools, or connect a backup drive on your own. Those actions can alter evidence or expose recovery copies. Let qualified responders direct containment and any power-state decision. If there is an immediate patient-safety emergency, follow the practice's emergency procedures first.
Minutes 15–30: contain deliberately and preserve evidence
The technical lead should assess affected devices, accounts, remote access, and connected services before deciding how far isolation must extend. An inaccessible cloud EHR is not, by itself, proof that your local network is infected. Contact the EHR vendor through a verified support channel and record its incident reference and confirmed scope.
- Keep one incident log. Record actions, timestamps, authorizing people, and results. Separate confirmed facts from unanswered questions.
- Preserve relevant records. Ask responders to retain endpoint alerts, sign-in and audit logs, ransom messages, and vendor notices in controlled evidence storage. Limit access; screenshots and logs may themselves contain PHI.
- Protect recovery options. Have the backup administrator check protected copies from a trusted environment. Do not reconnect backup media or start restoring into a network that may still be compromised.
- Escalate beyond IT. Bring in the privacy/security official, counsel, and the insurer's designated incident contact where applicable. Have leadership coordinate any law-enforcement contact. Use your policy and agreements to identify notice requirements and approved response resources.
Your medical IT program should identify who can authorize account restrictions, vendor access, and network isolation. Keep those decisions with designated responders rather than asking every staff member to troubleshoot independently.
Minutes 30–60: agree on scope, continuity, and the next update
Use a short briefing to align the clinical, technical, and privacy leads. Ask: Which workflows are unavailable? Which systems are confirmed affected? Where might ePHI be involved? Which safe downtime process is operating? Who owns each unanswered question, and when will the team reconvene?
Prepare a recovery order based on clinical needs and system dependencies, not the loudest request. Before reconnecting a restored system, responders need to address the attack path and check the recovery environment. Our backup and disaster recovery services address those dependencies; a successful backup job alone does not establish that a complete clinical workflow can be restored.
Give staff a factual update and one approved route for questions. Avoid unsupported assurances such as “no patient data was affected.” Do not contact an attacker or authorize payment independently; escalate any demand to leadership, counsel, the insurer, and qualified responders. A public audit-request form is not an emergency incident-response channel.
Recovery does not settle the breach question
HHS treats ransomware as a security incident. Its fact sheet explains that when ransomware encrypts ePHI, unauthorized control of that information constitutes an impermissible disclosure, and a breach is presumed unless the entity can demonstrate a low probability that the PHI was compromised under the applicable assessment. Do not equate “we restored the files” or “we have not seen evidence of theft” with a documented no-breach conclusion.
The fact sheet identifies four factors for that assessment: the nature and extent of PHI involved; the unauthorized person involved; whether PHI was actually acquired or viewed; and the extent to which risk was mitigated. Existing encryption also requires fact-specific analysis—full-disk encryption does not automatically protect a file that malware accesses while it is decrypted for an authenticated user.
Have the privacy official and qualified counsel direct the assessment and applicable notification decisions, including any separate state-law or contractual duties. Preserve discovery dates and supporting evidence from the start. This first-hour plan is not a substitute for notification obligations, and an ongoing investigation is not permission to postpone them indefinitely.
Use the 2026 guidance to improve readiness
In its April 23, 2026 announcement of four ransomware settlements, HHS OCR identified risk-analysis failures in each investigation. Those case-specific findings are a reason to know where your ePHI resides and document risks—not a prediction of the outcome for another practice.
OCR's January 2026 system-hardening newsletter covers patching operating systems, applications, and firmware, removing unneeded software, and configuring security measures. It also directs regulated entities to consult manufacturer labeling for medical-device security information. Plan these changes with appropriate testing and clinical coordination; an active incident is not the time for staff to install unapproved updates themselves.
Three things you can do this week
- Rehearse the offline call list. Walk through an unavailable EHR scenario with the practice manager, clinical lead, and technical contact. Confirm who can authorize containment and who covers an absence.
- Test one recovery workflow safely. Use an approved, isolated test environment to verify a representative restore and its dependencies. Record the result, access controls, and remaining gaps without exposing PHI.
- Review the systems list. Include workstations, cloud services, remote access, backup consoles, and connected clinical devices. Assign patching and exception owners. Include approved AI services using our HIPAA and AI tools checklist.
Make the plan usable before an incident
For practices in Sarasota, Bradenton, and Lakewood Ranch, the useful deliverable is a short plan people can actually follow: names, safe fallback workflows, recovery dependencies, and a record of what has been tested.
Suncoast MIS reviews those systems and responsibilities through our Free Systems Audit, on-site at a Sarasota or Manatee County business. Most visits take 45–60 minutes within a 60-minute calendar slot. Every completed audit includes a full, customized Client Threat & Architecture Report with prioritized practical findings. This readiness review is not emergency incident response, a HIPAA certification, or legal advice.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
The linked HHS ransomware fact sheet supports the incident-response, backup, and breach-assessment discussion; its historical attack statistics are not used here. The HHS Security Rule summary describes the rule currently in effect, not proposed changes. The April 2026 OCR settlements are case-specific enforcement examples, and the January 2026 newsletter addresses system hardening. The minute-by-minute sequence is our practical recommendation, not a mandated federal timetable. Clinical decisions, legal interpretation, notification duties, and insurance coverage remain with the practice and its qualified advisors.
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance, legal, and insurance conclusions remain with each organization and its qualified advisors.