Pediatric Emergency Department Backup Encryption Failure: Incident Response Checklist

How should teams contain and assess a backup encryption failure?

Activate the hospital’s cyber incident response plan as soon as backup encryption fails or ransomware is suspected. Assign an incident lead and bring together IT and security, clinical leadership, emergency management, privacy, legal, communications, and backup or cloud vendors. Keep coordination on trusted, out-of-band channels if the normal network may be compromised.

With security and operations leads coordinating the response, isolate affected backup repositories, backup-management servers, and compromised credentials from production systems and other backups. Do not automatically disconnect clinical or medical-device networks: assess the risk and coordinate containment with clinical engineering and care leaders so containment does not create a greater immediate patient-safety risk. CISA advises rapidly isolating affected systems and prioritizing critical assets for restoration. See the CISA StopRansomware Guide.

• Determine which backup jobs, repositories, snapshots, encryption keys, management consoles, and connected environments were affected.
• Identify the last known successful backup and whether the incident may have started before that point.
• Preserve relevant alerts, authentication records, network and endpoint logs, ransom notes, and backup-system audit trails.
• Record affected systems, containment decisions, decision-makers, and timestamps in the incident log.

Assess whether the failure is limited to backups or also affects production systems, clinical applications, or the integrity or availability of patient information. Under the HIPAA Security Rule, covered entities and business associates must have procedures for responding to security incidents and for backup, recovery, and emergency-mode operations; the rule does not prescribe one universal incident playbook. See 45 CFR § 164.308.

How can the department maintain clinical operations during system downtime?

Use the department’s electronic health record downtime procedures and activate its emergency-mode operations plan. Name a clinical lead for the emergency department and a separate technical lead for system recovery. Tell staff what is unavailable, which approved paper or alternate tools to use, how updates will be shared, and where completed forms should go.

Use approved downtime forms and processes to record patient identity, arrival and triage times, allergies, medications, weight, assessments, orders, results, reassessments, and disposition. In pediatric care, follow established medication-safety and patient-identification procedures, including documenting units clearly and using the department’s approved weight-based workflows. Use read-back for verbal orders and results when required by local policy.

• Keep a controlled, legible record of each patient encounter and label documents so they can be matched to the correct patient later.
• Use established procedures for medication reconciliation, prescribing and dispensing, laboratory and imaging requests, and communicating critical results.
• Identify which systems remain safe and available; do not use a device or application if its integrity is uncertain.
• Plan how downtime documentation will be reconciled into the EHR after restoration, including who enters it and how duplicates or conflicting entries will be resolved.

Written EHR downtime and recovery procedures support consistent care during planned or unplanned outages. The ONC 2025 SAFER Guide: Contingency Planning recommends clear responsibilities, staff notification, and a process for transferring downtime information into the EHR.

How should backups be verified and critical services restored?

Do not assume a backup is safe just because it is available. Select candidate copies that are isolated from the affected environment and likely to predate the compromise. Perform offline backup integrity verification before restoring: confirm the catalog and timestamps, check integrity records or hashes where available, scan for signs of compromise, and test restoration in an isolated environment.

Restore in order of clinical and operational criticality, using the hospital’s recovery plan. Dependencies matter: identity and access services, network components, EHR functions, laboratory and imaging workflows, pharmacy systems, and communications may rely on one another. Validate each restored service with technical owners and clinical representatives before relying on it for patient care.

• Test sample files, databases, and application functions against known-good expectations.
• Check that restored data is complete, readable, and consistent with the selected recovery point.
• Document any data gap or possible loss and the process for reconciling it with downtime records.
• Reconnect restored systems in a controlled sequence only after the security lead approves the recovery environment.

HIPAA requires retrievable exact copies of ePHI under the data backup plan and procedures to restore lost data under the disaster recovery plan. HHS also recommends periodic restoration testing to assess backup integrity and recovery capability. See HHS OCR’s Ransomware and HIPAA guidance and 45 CFR § 164.308.

What steps help eradicate ransomware and secure affected systems?

Work with qualified incident responders to determine how the attacker entered, which systems and accounts were accessed, whether malware or persistence mechanisms remain, and whether information may have been copied. Preserve evidence before making changes where feasible; do not delay urgent containment when continuing connectivity poses an immediate risk.

When appropriate and coordinated with the response team, use forensic system imaging and memory capture on selected affected systems, and preserve relevant logs. CISA recommends preserving system images, memory, and other evidence when mitigation actions do not prevent evidence collection. See the CISA ransomware response checklist.

After identifying and addressing the entry point and persistence, use a clean image system rebuild for affected devices and services when indicated. Apply security updates, restore only verified data, and scan or monitor systems before reconnecting them. Coordinate rebuilds with application owners and clinical engineering when systems support patient care or medical devices.

Perform compromised account remediation based on the investigation. This may include disabling affected accounts, revoking active sessions and tokens, resetting passwords and service credentials, reviewing privileged access, and enabling or strengthening multifactor authentication. CISA’s guidance also recommends addressing vulnerabilities and malicious persistence before reconnecting restored systems.

How should incident response teams coordinate and document actions?

Use the hospital’s incident command structure or approved equivalent to coordinate technical recovery, clinical operations, patient safety, privacy, legal review, vendor support, and communications. Give staff clear instructions through trusted channels, and designate one person to maintain the authoritative incident timeline.

Document what was observed, which systems and data were affected, what containment and recovery actions were taken, who approved them, and when. Include patient-care impacts, downtime procedures used, data-reconciliation issues, and the results of backup tests and restoration validation. Restrict incident records to authorized personnel and preserve supporting evidence according to hospital policy.

Privacy and legal teams should assess whether the event involved a breach of unsecured protected health information. HHS explains that ransomware encryption of ePHI may be treated as an impermissible acquisition, but the assessment is fact-specific; an organization must evaluate the circumstances and applicable encryption protections. See HHS OCR’s ransomware guidance.

If the incident is determined to involve a reportable breach of unsecured PHI, HIPAA generally requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Additional HHS and media-notice requirements can apply depending on the number of affected individuals. Document the breach assessment and any notification decisions, including the basis for determining that notice is not required. See the HHS Breach Notification Rule guidance.

When should patient services pause or patients be diverted?

The emergency department’s clinical leadership, hospital incident command, and local emergency medical services partners should assess whether the department can safely screen, assess, monitor, and treat patients with available staff, equipment, communications, and downtime workflows. Consider a partial pause or diversion under hospital and community protocols if critical capabilities are unavailable or safe care cannot be maintained.

Use the least restrictive operational change that protects patients, reassess it as conditions change, and communicate decisions through established channels. Consider the needs of children requiring time-sensitive evaluation, monitoring, medication, imaging, or specialty support. Record the clinical and operational basis for the decision and when it will be reviewed.

Follow applicable emergency-care requirements and hospital policy when managing people who arrive at the facility. CMS explains that EMTALA obligations for participating hospitals include an appropriate medical screening examination and, when an emergency medical condition is found, stabilizing treatment or an appropriate transfer. See CMS’s EMTALA guidance.

In short, prioritize containment without compromising care, maintain safe downtime workflows, verify backups before restoration, and coordinate recovery and any breach assessment through the hospital’s established response structure.

FAQs

Which systems should be isolated first during a backup encryption incident?

Prioritize affected backup repositories, backup-management systems, and compromised accounts or credentials that could let ransomware spread or encrypt additional copies. Coordinate isolation with IT security and clinical operations, and assess any impact on connected clinical systems before changing their network access.

How can pediatric emergency care continue while electronic systems are unavailable?

Activate the department’s downtime procedures, use approved paper or alternate workflows, and assign clear clinical and technical leads. Record patient-care information in a consistent, traceable way, follow existing pediatric medication-safety procedures, and reconcile downtime records into the EHR after recovery.

How should teams verify backups before restoring critical services?

Select isolated copies that are likely to predate the compromise, then check timestamps, integrity records, and signs of compromise. Test restoration in an isolated environment and validate data and application functions before restoring services to clinical use.

When does a backup encryption incident require patient data breach notification?

Not every backup failure automatically requires patient notification. The organization’s privacy and legal teams should determine whether unsecured PHI was impermissibly accessed, acquired, used, or disclosed and document the required risk assessment. If a reportable breach of unsecured PHI is found, HIPAA notification requirements apply; see HHS’s Breach Notification Rule guidance.