Ransomware Incident Response Guide for Cancer Therapy and Cardiac Monitoring Clinics

A ransomware incident can disrupt scheduling, clinical records, imaging, treatment planning, cardiac monitoring, and connected medical devices. Your response must protect patients while containing the attack, preserving evidence, and restoring trustworthy systems.

Use this guide alongside your clinic’s emergency plans, clinical downtime procedures, and advice from qualified cybersecurity, legal, privacy, and clinical professionals. Patient-care decisions—including whether to delay or continue a treatment—belong to the responsible clinicians.

Activate Incident Containment and Assess Impact

Activate your incident response plan as soon as you suspect ransomware. Notify the designated incident lead and clinical leadership through a communication channel that is not dependent on potentially compromised systems.

Have qualified IT or security personnel isolate affected devices and network segments to limit the spread. Avoid reconnecting systems, deleting files, or powering down equipment without guidance: those actions may complicate containment or destroy useful evidence. If patient safety requires immediate action, clinicians and technical responders should coordinate it.

Assess the known scope without assuming that encrypted files are the only concern. Identify affected workstations, servers, cloud services, backups, electronic health records, imaging and treatment-planning systems, cardiac monitoring platforms, and medical devices. Determine whether access to electronic protected health information (ePHI) may have been compromised, whether the attack is ongoing, and which services remain safe to use.

Record key events, decisions, affected assets, and the people responsible for each action. Preserve relevant logs and other evidence when feasible. Do not use a possibly compromised account or device to coordinate the response.

Maintain Clinical Continuity During Downtime

Shift to your clinic’s approved clinical downtime procedures. Confirm how staff will identify patients, review essential clinical information, document care, communicate results, and escalate urgent concerns while electronic systems are unavailable. Use only approved, access-controlled downtime forms and workflows.

Prioritize patient safety over routine throughput. Clinical leaders should determine whether appointments, procedures, infusions, monitoring, or treatments can safely continue, need modification, or must be postponed. Give patients clear instructions about changed schedules and how to reach the clinic using a trusted communication method.

For cardiac monitoring, confirm that staff have a safe, clinically approved way to monitor patients who require active observation. If normal monitoring systems are unavailable, clinicians should assess whether validated backup equipment, staffing, and escalation arrangements are adequate for each patient. Do not assume that an unverified device or workaround provides reliable monitoring.

Keep paper or other downtime records legible, attributable, and protected from unauthorized access. Track results and clinical actions that must later be entered into the restored record, and use a reconciliation process to prevent omissions or duplicate entries.

Prioritize Radiation Therapy Recovery

Radiation oncology recovery requires special caution because treatment depends on accurate patient identity, treatment plans, imaging, prescription details, and records of doses and fractions already delivered. Do not resume treatment solely because a scheduling or treatment system appears to be working.

Before restarting, the responsible radiation oncologist, medical physicist, radiation therapists, and technical teams should confirm that the equipment and relevant data are trustworthy. Reconcile each patient’s treatment status, including the approved plan, prescription, setup information, delivered treatments, and any interruptions. Investigate discrepancies rather than filling gaps by assumption.

Protect radiation oncology treatment data integrity by validating restored information against reliable records and documenting the checks. Confirm that treatment machines, associated systems, and interfaces are functioning as intended and are not still exposed to the incident. Resume only after the clinical and technical leaders responsible for treatment safety authorize it.

If the clinic cannot verify a patient’s treatment history or system integrity, escalate the case to the treating team and follow its clinical judgment about timing and next steps. Do not independently estimate missed doses or alter a treatment plan to compensate for downtime.

Coordinate the Incident Response Team

Use an incident command system or another clearly defined leadership structure so staff know who is making decisions and where to report concerns. Assign accountable leads for clinical operations, IT and cybersecurity, privacy, legal review, communications, facilities or biomedical engineering, and vendor coordination.

Set a reliable briefing schedule and maintain a shared incident log in a secure, unaffected location. Briefings should cover patient-care risks, system status, containment actions, decisions requiring approval, and the next operational priorities. Limit access to sensitive incident details to people who need them.

Contact relevant technology, cloud, medical-device, and managed-service vendors through verified channels. Clarify who is responsible for investigation, containment, evidence preservation, restoration, and reporting, and keep a record of the vendor’s findings and actions.

Make sure clinical staff have a clear way to report unsafe conditions, missing records, device anomalies, and patient-care concerns. If a cybersecurity action could affect a medical device or clinical workflow, coordinate it with the people responsible for that equipment and care.

Restore Systems and Validate Clinical Data

Do not restore systems until responders have addressed the threat and determined that the proposed recovery environment is safe. Identify clean backups and verify that they are usable before relying on them. Restoring compromised systems or reconnecting infected devices too early can allow the attack to continue.

Restore services in an order based on clinical risk and operational need. Before a system returns to patient care, confirm its security status, access controls, connections, and essential functions. Test interfaces and dependencies—not just the individual application.

Validate clinical data before staff rely on it. Check that patient identities, records, medication and treatment information, imaging, monitoring results, and audit trails are complete and consistent. Reconcile downtime documentation and identify unresolved discrepancies for clinical review.

Use medical device network segmentation to limit unnecessary connections between devices and general-purpose networks. After restoration, monitor systems for unusual activity and keep a process in place for staff to report suspected recurrence or incorrect data.

Assess Breach Reporting and Notification Obligations

Involve your privacy officer and legal counsel promptly in a protected health information breach assessment. A ransomware incident is a security incident, but whether it creates notification obligations depends on the facts, the information involved, and the applicable rules. Do not assume that files were not accessed or disclosed simply because they were encrypted.

Under the HIPAA Security Rule and Breach Notification Rule, covered entities and business associates must assess the incident and determine what obligations apply to unsecured protected health information. The assessment should consider the nature and extent of the information, who may have received or accessed it, whether it was actually acquired or viewed, and what mitigation occurred. Document the basis for the decision.

For a reportable breach of unsecured protected health information, HIPAA generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals generally must also be reported to the U.S. Department of Health and Human Services within that timeframe; breaches affecting fewer than 500 individuals are generally reported to HHS within 60 days after the end of the calendar year in which they were discovered. Additional media notice may apply when a breach affects more than 500 residents of a state or jurisdiction.

State laws, contracts, and other rules may impose additional or faster requirements. Business associates should promptly notify the covered entity as required by their agreements and applicable rules. Coordinate any patient or public communication with privacy, legal, and communications leads, and provide accurate information without delaying care-related instructions.

Document Lessons Learned and Strengthen Resilience

After immediate operations stabilize, review how the incident began, how it spread, what was affected, and which safeguards or response steps worked or failed. Include clinical staff, technical responders, privacy and legal personnel, and relevant vendors in the review.

Use the findings to improve incident response plan, backup and recovery testing, access controls, staff training, vendor coordination, and medical device network segmentation. Update downtime procedures based on real workflow challenges, and make sure staff can access current instructions and contact information when electronic systems are unavailable.

Keep a record of the incident timeline, key decisions, restoration checks, data reconciliation, and required follow-up. The central lessons are to contain the threat, keep care decisions clinically led, verify treatment and monitoring data before relying on restored systems, and assess reporting duties with qualified privacy and legal support.

FAQs

What should a clinic do first after detecting ransomware?

Activate the incident response plan, alert the designated incident and clinical leads, and have qualified responders isolate affected systems to limit spread. Use a trusted communication channel, assess immediate patient-care risks, preserve evidence when feasible, and avoid reconnecting or changing affected systems without guidance.

How can cancer therapy and cardiac monitoring continue during system downtime?

Follow approved clinical downtime procedures and have responsible clinicians decide which services can safely continue, need modification, or must be postponed. Use validated backup monitoring and treatment workflows only when clinical leaders confirm they are appropriate, and keep secure, complete records for later reconciliation.

When should radiation therapy resume after a ransomware incident?

Resume only after the responsible clinical and technical leaders confirm that the equipment is functioning safely and that each patient’s identity, treatment plan, prescription, and delivered-treatment history have been validated. If treatment data or system integrity cannot be confirmed, escalate the case to the treating team rather than estimating or improvising.

When must a clinic notify patients or regulators about a potential breach?

Have the privacy officer and legal counsel promptly assess whether unsecured protected health information was breached and which rules apply. Under HIPAA, notice to affected individuals is generally due without unreasonable delay and no later than 60 days after discovery of a reportable breach; HHS and, in some cases, media notification may also be required. State laws or other obligations may set different requirements.