Gamma Knife Radiosurgery Suite Shared Password Breach: Incident Response Checklist

Contain the Credential Breach

When you discover that a password used in the Gamma Knife radiosurgery suite was shared or exposed, treat it as a potential security incident—not proof that someone accessed or changed a clinical system. Notify your cybersecurity incident lead, clinical engineering or biomedical engineering, radiation oncology leadership, privacy or compliance staff, and the system owner. Assign one incident lead to coordinate decisions and maintain a timeline.

• Confirm which account, systems, and locations may be affected, including the treatment console, treatment-planning system, directory services, remote-support tools, and any connected clinical systems.
• Use approved response procedures to limit access. Coordinate any isolation or service interruption with clinical and technical leads so containment does not create an unsafe equipment condition.
• Apply network segmentation or restrict remote access where appropriate, while preserving essential monitoring and patient-care functions.
• Do not power down, reboot, alter device settings, or install unapproved software on treatment equipment unless the manufacturer and responsible clinical and technical leads direct the action.

Containment should reduce unauthorized access while protecting the availability and safe operation of clinical equipment. NIST incident-response guidance emphasizes choosing containment actions suited to the incident, and FDA guidance stresses the patient-safety implications of medical-device cybersecurity.

Revoke or Rotate Compromised Credentials

Once you have captured the minimum information needed to investigate, disable or rotate the exposed password through the approved identity-management process. Coordinate credential revocation with system owners so that changing a password does not interrupt a procedure in progress or prevent authorized staff from responding safely.

• Replace shared accounts with named accounts wherever the system supports them, and grant each user only the access needed for their role.
• Review privileged access management controls, including administrator accounts, remote-support credentials, service accounts, and accounts with access to treatment-planning or delivery systems.
• Reset related credentials if they were reused, stored together, or potentially exposed through the same account or workstation.
• Secure console keys and other physical access items: identify who holds them, restrict access to authorized staff, document checkout and return, and report missing keys.
• Do not write replacement passwords on consoles, in treatment rooms, or in shared documents. Use approved credential-management procedures.

Record the account, systems affected, time of revocation or rotation, approving personnel, and any operational impact. Avoid making undocumented changes to device software or configuration as part of credential remediation.

Review System Access and Network Activity

Determine whether the exposed credential was used, when it was used, and what systems or functions it could reach. Compare account activity with staff schedules, approved maintenance, remote-support sessions, and treatment activity. Investigate activity that cannot be explained without assuming that every unusual event is malicious.

• Review authentication audit logs for successful and failed sign-ins, source devices or addresses, session times, privilege changes, and account lockouts.
• Check endpoint, directory, VPN, firewall, and network-monitoring records for related access, lateral movement, unusual connections, or attempted access to other clinical systems.
• Review application and device records for configuration changes, changes to user roles, file transfers, software installation, or unexpected remote sessions.
• Compare access records with treatment schedules, planning records, equipment logs, and authorized maintenance documentation.
• Extend the investigation to other systems where the password was reused or where the affected account had privileges.

Document the review period, data sources, findings, and unresolved questions. System activity records such as audit logs and access reports can support investigation of possible inappropriate access and security incidents.

Preserve Logs and Audit Trails

Preserve evidence before routine log rotation or troubleshooting overwrites it. Ask the incident lead or forensic team to coordinate collection with system owners and the manufacturer when relevant. Use approved methods that maintain the integrity of the records and avoid disrupting equipment.

• Preserve authentication audit logs, network and endpoint records, remote-support records, application logs, system alerts, and relevant physical-access records.
• Record the source system, collection time, time zone, collector, method, and any gaps in the available data.
• Keep original records protected and restrict access to personnel involved in the investigation; document transfers and copies.
• Capture relevant screenshots, alerts, configuration snapshots, and incident communications when appropriate, while protecting patient information.
• Maintain a clear incident timeline, including discovery, containment, credential changes, system checks, decisions, and approvals.

Preserve records in line with organizational policy and applicable legal, privacy, and regulatory requirements. Maintain cybersecurity incident documentation that distinguishes confirmed facts from assumptions and identifies who made each consequential decision.

Assess Patient Data and Clinical System Exposure

Assess separately whether the account could access patient information, whether patient information was actually viewed or acquired, and whether clinical systems or treatment-related records could have been changed. Involve privacy, compliance, clinical, and security leaders in determining the scope and any required follow-up.

• Identify the types of patient data available to the account and the systems where that data resides.
• Look for evidence of viewing, exporting, printing, copying, or transferring patient information, and document any uncertainty or unavailable logs.
• Review whether treatment plans, patient identifiers, imaging, scheduling records, or clinical documentation were accessed or altered.
• Check for changes to user privileges, system configuration, software, or data that could affect clinical system integrity.
• Escalate potential privacy exposure for a formal assessment under organizational policy and applicable requirements; do not decide notification obligations based on the password exposure alone.

Base conclusions on the account’s permissions, verified activity, available evidence, and documented risk assessment. If the evidence is incomplete, state what remains unknown and what steps are underway to resolve it.

Verify Treatment Equipment Before Resuming Care

Do not resume treatment solely because the password has been changed or the suspected access has stopped. The responsible clinical and technical leaders should determine whether the equipment, treatment-planning system, and supporting records remain trustworthy and safe to use. Consult the manufacturer or authorized service provider when needed, and follow approved device procedures.

• Confirm that the equipment’s status, configuration, software, user accounts, and relevant security alerts have been reviewed by authorized personnel.
• Complete required equipment checks and treatment-planning system validation under established clinical and technical procedures.
• Verify that patient-specific treatment plans, records, and approvals are intact and match the expected clinical documentation.
• Document test results, outstanding risks, required approvals, and the person authorizing return to service.
• If system integrity or safe operation cannot be confirmed, keep the equipment out of service and follow the organization’s downtime and escalation procedures.

Only the organization’s designated clinical and technical authorities, with manufacturer input where appropriate, should approve return to service. FDA guidance cautions against applying unapproved fixes to medical devices because they may worsen a problem.

Maintain Patient Safety and Treatment Continuity

Coordinate incident response with the care team so patients receive clear, timely guidance and clinically appropriate care. The treating clinicians should assess whether a delay, rescheduling, or alternative care arrangement is appropriate for each patient; cybersecurity staff should not make clinical prioritization decisions.

• Identify scheduled patients who may be affected and have the clinical team assess treatment timing and next steps.
• Use established downtime, escalation, and rescheduling procedures if the suite is unavailable or its integrity is still being assessed.
• Communicate with patients through approved channels, sharing only confirmed information and avoiding speculation about exposure or safety.
• Keep a record of service interruptions, patient-care decisions, communications, and approvals.
• After recovery, review the incident with clinical, technical, privacy, and security teams and address the cause of password sharing with practical access controls and staff training.

In summary, contain access carefully, investigate and preserve evidence, assess patient and system exposure, validate equipment before return to service, and coordinate continuity decisions through the clinical team.

FAQs

What should the team do first after discovering a shared password breach?

Notify the incident lead and the relevant clinical, technical, privacy, and security contacts. Identify the affected account and systems, protect ongoing patient care, and contain access through approved procedures. Coordinate credential changes and any isolation with the people responsible for safe equipment operation.

How can the team determine whether patient data or treatment systems were accessed?

Review authentication audit logs alongside network, endpoint, application, remote-support, and physical-access records. Compare findings with staff schedules, treatment activity, and approved maintenance. Assess patient-data access separately from possible changes to treatment plans, equipment configuration, or other clinical systems, and document any evidence gaps.

When is it safe to resume Gamma Knife treatments after containment?

Resume only after the designated clinical and technical authorities have reviewed the incident, verified relevant equipment and treatment-planning system integrity, completed required checks and validation, and documented approval. Consult the manufacturer or authorized service provider when necessary. If safe operation or data integrity remains uncertain, follow downtime procedures rather than returning the system to service.

How should console keys and user access be secured after the incident?

Inventory physical keys, restrict them to authorized personnel, and document issuance, custody, checkout, and return. Revoke or rotate exposed passwords, review privileged access, and replace shared accounts with named accounts where supported. Store credentials only through approved management processes and avoid posting passwords near consoles.