Ransomware Incident Response Guide for Hemodialysis Machine Management Consoles

How do you protect patient safety and maintain dialysis treatment during an incident?

Put patient safety and continuity of care first. Activate the facility’s incident and emergency procedures, notify the clinical leader on duty, and have the care team assess any treatment in progress. Do not abruptly disconnect or shut down a machine based only on an IT alert; follow clinical protocols and the manufacturer’s instructions for safely managing treatment.

Work with clinical engineering, IT, and the treating clinician to determine whether affected consoles can safely remain in use. If a console’s operation or integrity is uncertain, remove it from clinical use according to facility procedures and use only equipment that has been assessed as safe. Continue treatment on verified, unaffected equipment when clinically appropriate; if capacity is reduced, arrange transfers or other continuity measures using the facility’s emergency plan. The FDA’s medical-device cybersecurity guidance recognizes that cybersecurity threats can affect device safety and effectiveness.

Use downtime procedures if electronic records or management systems are unavailable. Record treatment information on approved paper forms or another authorized backup process, safeguard those records, and reconcile them into the clinical record when systems are restored. Avoid using an affected system to retrieve or share patient information unless the response team has confirmed that doing so is safe.

How do you identify affected consoles and determine ransomware scope?

Start by identifying the suspected ransomware activity and determining which systems, applications, and networks may be involved. Build an inventory of hemodialysis consoles and related management systems, including device identifiers, location, network connections, software versions, and current clinical status. Include supporting workstations, servers, remote-access tools, and interfaces that exchange data with the consoles.

Preserve relevant alerts, logs, timestamps, and other evidence. Ask IT and clinical engineering to compare affected assets with network and endpoint records, while the clinical team checks for abnormal behavior or changes in device availability. Avoid rebooting, wiping, or otherwise altering a suspected device before the response team and manufacturer have considered evidence preservation and patient-safety implications.

Determine whether the incident is ongoing, how it began, whether it spread to other systems, and whether data may have been accessed or exfiltrated. These are core elements of ransomware incident analysis described in the HHS ransomware and HIPAA guidance. Document what is known, what remains uncertain, and the decisions made as the scope changes.

How should teams contain ransomware and prevent it from spreading?

Coordinate containment through the incident lead, IT security, clinical engineering, and clinical operations. Use network segmentation for medical devices to limit unnecessary connections and restrict the suspected infection’s ability to spread. Have authorized IT staff isolate affected network paths or systems in a way that does not unexpectedly interrupt dialysis treatment or disable safety-critical functions.

Do not make unapproved changes to a console’s software, configuration, or connectivity. The appropriate containment method can differ by device and system architecture, so confirm device-specific steps with the manufacturer and clinical engineering. Keep unaffected systems under heightened monitoring, and restrict remote access, removable media, or other pathways when the response team determines they present a risk.

Containment is part of a broader response that should also identify the incident’s scope, eradicate malware, address the cause, and support recovery. The HHS ransomware response guidance describes these steps and emphasizes incident procedures for responding to and reporting security incidents.

How do you eradicate malware and safely restore consoles and connected devices?

Plan medical device cybersecurity remediation with the manufacturer and qualified technical staff. Do not assume that a general-purpose antivirus scan, operating-system reinstallation, or standard IT patch is appropriate for a dialysis console. Follow device-specific instructions and document the approved remediation steps, affected assets, and any known limitations.

Restore systems from backups or manufacturer-provided media only after the response team has addressed the source of compromise and confirmed that the recovery source is appropriate. Restore and reconnect devices in a controlled sequence, keeping them separated from affected systems until authorized staff are ready to test them.

Before a console returns to clinical use, complete medical device safety validation under facility procedures and manufacturer instructions. Confirm that the device and connected systems function as intended, that required configurations and data are intact, and that any cybersecurity changes have been evaluated. The FDA’s medical-device cybersecurity resources recommend working with manufacturers on device changes; they also state that manufacturers are responsible for validating software design changes.

Who should coordinate clinical, IT, and manufacturer response?

Appoint an incident lead with authority to coordinate decisions and maintain a shared record of actions. The response group should include clinical leadership, nursing, nephrology, clinical engineering or biomedical staff, IT and cybersecurity, privacy, legal, compliance, communications, and facility operations. Include emergency management and the organization’s leadership when the scope or effects require them.

Contact the device manufacturer promptly if a console, its management software, or a connected component may be affected; if device behavior or safety is in question; or if recovery, patching, or validation guidance is needed. Provide the manufacturer with relevant device identifiers and observed symptoms through approved channels, and coordinate any vendor access with IT and security staff. FDA guidance advises healthcare delivery organizations to work closely with manufacturers when considering device updates or changes. See the FDA’s postmarket cybersecurity resources.

Maintain one approved channel for operational updates so staff receive consistent instructions about treatment continuity, equipment status, and downtime workflows. Record key decisions, responsible roles, and the evidence supporting return-to-service determinations.

How do you assess protected health information exposure and reporting obligations?

Involve the privacy officer, legal counsel, and security team to determine whether protected health information (PHI) was involved, accessed, acquired, disclosed, altered, or made unavailable. Review evidence of data access and possible exfiltration, identify the types and amount of PHI, and document the systems and individuals potentially affected.

Under HHS guidance, ransomware that encrypts electronic PHI is generally treated as a breach unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised. The assessment must consider at least the nature and extent of PHI, who received or accessed it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. Apply this fact-specific HHS protected health information breach assessment guidance, and retain the supporting analysis.

If a breach of unsecured PHI is established, determine the applicable breach notification duties under HIPAA and any relevant state or contractual requirements. HHS explains that notification to affected individuals is due without unreasonable delay and no later than 60 calendar days after discovery; reporting to the Secretary depends in part on how many individuals are affected. Review the HHS breach-reporting instructions and obtain legal guidance on the facility’s specific obligations.

What should a dialysis facility include in its emergency preparedness plan?

Include ransomware and loss of console management systems in dialysis emergency preparedness. Define how the facility will identify affected equipment, protect treatment in progress, continue care where safe, use downtime records, and arrange transfers if operations are limited or stopped. Document who has authority to make clinical, technical, and operational decisions, and how staff will receive instructions if normal communication systems are unavailable.

Maintain primary and alternate contact methods for staff, patients’ physicians, other dialysis facilities, service providers, and emergency management officials. Plan how patient information and medical documentation can be shared as needed to maintain continuity of care, while protecting confidentiality. Include procedures for tracking patients and staff if the facility relocates or evacuates.

For Medicare-certified dialysis facilities, 42 CFR § 494.62 sets emergency preparedness requirements that include an all-hazards risk assessment, continuity-of-operations planning, communication procedures, arrangements with other providers, and training and testing. CMS identifies cyberattacks as an example of a communications interruption to consider in emergency planning; see its emergency preparedness rule guidance. Review the facility’s plan and exercises against the current requirements that apply to it.

Effective dialysis emergency preparedness connects patient-care decisions, clinical engineering incident response, device cybersecurity remediation, and privacy assessment. Keep the plan specific to your facility, practice it with the relevant teams, and update it after incidents or exercises reveal gaps.

FAQs

Should affected hemodialysis consoles be taken out of service?

Take a console out of service when its operation, integrity, or safety cannot be established, or when the clinical team and clinical engineering determine that continued use is unsafe. Follow clinical procedures and manufacturer guidance; a suspected cyber incident does not by itself justify abruptly interrupting treatment in progress. Document the decision and the criteria required before return to service.

How can dialysis treatments continue during a ransomware incident?

Continue treatment only on equipment and systems the responsible clinical and technical teams have assessed as safe. Use approved downtime documentation, prioritize clinical needs, and follow the facility’s plan for transferring patients to another dialysis facility if safe treatment cannot be maintained locally. Make treatment decisions through the clinical team and the facility’s emergency procedures.

When should the device manufacturer be contacted?

Contact the manufacturer promptly if a console or connected management system may be affected, device behavior has changed, safety is uncertain, or remediation and restoration guidance is needed. Coordinate vendor access and any proposed updates or repairs with clinical engineering and IT security.

What determines whether a ransomware incident requires breach notification?

The determination depends on whether unsecured PHI was involved and whether the organization can demonstrate a low probability that it was compromised, using the applicable HIPAA assessment and evidence. Factors include the nature and extent of the PHI, who accessed or received it, whether it was actually acquired or viewed, and mitigation. If a reportable breach is found, follow applicable HIPAA deadlines and other relevant state or contractual requirements.