Ransomware Incident Response Checklist for an EMG Results Server

How should teams isolate an infected EMG results server?

Contain the infection quickly, but coordinate the response with your incident lead so you do not disrupt patient care or destroy evidence unnecessarily. Use a known-safe communication channel, such as phone calls, if email or messaging systems may be compromised.

• Have IT or incident responders isolate the server from affected networks and shared storage. Use network controls or disconnect its network connection where feasible; consider network segmentation to limit access to unaffected systems.
• Check connected systems and services—including EMG workstations, report storage, interfaces, identity services, and backups—for signs of compromise. Expand isolation if the incident may have spread.
• Do not routinely power off the server as the first step. CISA advises powering down only when network disconnection is not possible, because shutdown can destroy evidence in volatile memory. Follow the incident lead’s direction if patient safety or ongoing spread requires a different action. See the CISA and MS-ISAC Ransomware Guide.
• Record when the incident was detected, the systems affected, containment actions, and who authorized each action.

What evidence should be preserved before recovery?

Preserve evidence before rebuilding or restoring systems whenever doing so can be done safely. Involve qualified incident responders or forensic specialists; evidence collection should not delay containment of an active threat or urgent clinical care.

• Arrange volatile memory acquisition promptly when appropriate. Memory can contain information that may be lost when a system is powered down.
• Preserve forensic disk imaging, relevant security and firewall logs, endpoint alerts, system timestamps, ransom notes, suspicious files, and records of affected accounts and devices.
• Secure copies of evidence, document who collected and handled them, and record when and how they were transferred. Keep original files and systems unchanged where practical.
• Record suspected data access or exfiltration, ransomware indicators, affected EMG reports or waveforms, and the incident timeline.

The CISA and MS-ISAC Ransomware Guide recommends collecting system images, memory captures, relevant logs, and malware samples, and preserving evidence that is volatile or has limited retention.

How can clinicians maintain EMG services during downtime?

Activate the organization’s clinical downtime procedures and follow established emergency workflows. HIPAA’s Security Rule includes contingency planning for data backup, disaster recovery, and continuing critical business processes while protecting electronic protected health information during emergency operations; see HHS’s summary of the HIPAA Security Rule.

• Tell EMG clinicians, scheduling staff, and referring teams which services and systems are unavailable, how long the outage may last if known, and where to direct urgent cases.
• Use only approved, secure downtime systems or forms. Record patient identifiers, study date and time, relevant study details, interpreting clinician, result status, and required follow-up so entries can be reconciled later.
• Prioritize time-sensitive studies with the clinical lead. Use the organization’s approved process to communicate urgent findings and verify the recipient’s identity.
• Keep downtime records protected from unauthorized access. Track them for controlled entry into the restored system, and reconcile them to prevent missing or duplicate reports.
• Do not use personal email, consumer messaging, or unapproved devices to store or transmit patient information.

Who should be involved in the incident response?

Assign a response lead and bring together the people needed to contain the threat, protect patients, preserve evidence, and restore services. The exact team will depend on the organization and the scope of the incident.

• IT and cybersecurity: isolate affected systems, investigate the compromise, preserve evidence, and lead technical recovery.
• Clinical leadership and EMG staff: assess patient-care impact, set service priorities, and run downtime workflows.
• Privacy, security, compliance, and legal personnel: coordinate the protected health information breach assessment, regulatory and contractual obligations, and communications.
• Health information management and operations: safeguard records, coordinate reporting workflows, and reconcile downtime documentation.
• Vendors and external responders: involve the EMG system vendor, managed security provider, cyber insurer, and qualified forensic specialists as appropriate and under organizational policy.
• Leadership and communications: provide coordinated internal updates and approve external communications. Consider contacting law enforcement or government incident-response resources when appropriate.

CISA recommends engaging internal and external stakeholders, including IT, managed security providers, cyber insurers, and leadership, as appropriate to the incident. See the CISA and MS-ISAC Ransomware Guide.

How should teams validate backups and restore the server safely?

Do not assume a backup is clean or complete simply because it is available. Plan validated backup restoration with the incident lead and clinical owners, using a recovery environment separated from compromised systems.

• Identify backups from before the compromise, and confirm they have not been altered, encrypted, or exposed to the attacker.
• Restore to a clean, isolated environment. Rebuild the server from trusted software or standard images where feasible, rather than placing an infected system directly back into service.
• Before clinical use, verify the restored EMG application, report database, interfaces, user access, and relevant study records. Check that reports and associated data are complete and usable.
• Address the cause of the compromise, remove attacker access, review affected accounts, reset credentials as appropriate, and apply needed security fixes before expanding access.
• Have IT/security and clinical representatives document the restoration tests and approve the service for the next recovery stage.

CISA recommends rebuilding systems, addressing affected accounts and vulnerabilities, and restoring from offline, encrypted backups while taking care not to re-infect clean systems. See the CISA and MS-ISAC Ransomware Guide.

What security and privacy checks are required before reconnecting?

Reconnect the server only after the designated IT or security authority determines that the environment is sufficiently cleaned and ready for controlled recovery. Use a staged return to service, with monitoring and a rollback plan.

• Confirm that the suspected entry point, malicious software, unauthorized access, and persistence mechanisms have been addressed, and that relevant systems have been reviewed for spread.
• Verify that patches, access controls, credential resets, and any other incident-specific safeguards are in place. Limit access to authorized users and monitor logs and alerts closely.
• Check the integrity and completeness of restored EMG data, and confirm that downtime records have been entered and reconciled through the approved workflow.
• Complete and document a protected health information breach assessment with privacy and legal personnel. HHS explains that ransomware affecting electronic protected health information can constitute a breach; whether notification is required depends on the facts, including whether the organization can demonstrate a low probability that the information was compromised. See HHS’s Ransomware and HIPAA guidance.
• If the incident involves a breach of unsecured protected health information, follow applicable HIPAA breach notification requirements. Individual notices are generally due without unreasonable delay and no later than 60 days after discovery; requirements for reporting to HHS and notifying the media depend on the circumstances. See the HHS Breach Notification Rule.

In short, isolate the threat, preserve evidence, maintain clinical operations through approved downtime procedures, and restore from validated backups in a controlled environment. Reconnect only after security, clinical, and privacy checks are complete.

FAQs

Should an infected EMG results server be powered off?

Not automatically. First coordinate with the incident lead and isolate the server from the network if possible. Powering it off can destroy volatile evidence; CISA advises doing so to prevent further spread only when disconnecting the device from the network is not possible. See the CISA and MS-ISAC Ransomware Guide.

How can clinicians access or record EMG results during ransomware downtime?

Use the organization’s approved clinical downtime procedures, secure alternative systems, or controlled downtime forms. Record enough information to identify each patient, study, result, author, and follow-up, protect the records from unauthorized access, and reconcile them with the restored system. Do not use personal accounts or unapproved devices to handle patient information.

When is it safe to reconnect a restored EMG results server?

Reconnect only when the designated IT or security authority has confirmed that the environment has been cleaned and rebuilt as needed, attacker access and relevant vulnerabilities have been addressed, and restored data and application functions have been validated. Use a staged reconnection, monitor the server, and ensure it is not exposed to systems that remain compromised. CISA recommends restoring from offline, encrypted backups and avoiding re-infection of clean systems; see the CISA and MS-ISAC Ransomware Guide.

Does ransomware affecting an EMG server require patient notification?

Not in every case, and the answer should not be assumed either way. The organization must assess whether unsecured protected health information was compromised and apply the HIPAA Breach Notification Rule to the facts. HHS states that ransomware-encrypted ePHI may constitute a breach, subject to the applicable assessment and exceptions; if notification is required, affected individuals must generally be notified without unreasonable delay and no later than 60 days after discovery. See HHS’s Ransomware and HIPAA guidance and the HHS Breach Notification Rule.