Ransomware Incident Response Guide for Ophthalmic Pathology Labs

A ransomware incident can interrupt case accessioning, tissue processing, digital slide review, reporting, and communication with ordering clinicians. Your response must contain the attack while protecting specimens, patient care, records, and evidence.

Use this guide alongside your organization’s incident response plan, laboratory information system downtime procedures, and laboratory director-approved policies. The steps below are operational guidance, not a substitute for incident-specific advice from your security, privacy, legal, and clinical teams.

How should an ophthalmic pathology lab activate its incident response plan and contain ransomware?

Activate the incident response plan as soon as staff see signs such as inaccessible case files, ransom notes, unusual file extensions, disabled workstations, or suspicious account activity. Notify the designated incident lead using an approved channel that is not dependent on potentially compromised systems. Include the laboratory director, IT or security lead, privacy officer, compliance and operations leads, and relevant vendors or service providers.

Ask IT or the incident response team to identify affected devices and connections. Systems to assess may include the laboratory information system (LIS), specimen-tracking and label-printing tools, histology workstations, digital pathology scanners and viewers, image storage, dictation and reporting platforms, interface engines, file servers, email, remote-access tools, and connected instruments. Isolate confirmed or suspected compromised systems from networks and shared drives; if the attack is spreading, the security team may need to isolate a wider network segment. CISA’s StopRansomware Guide recommends identifying affected systems and isolating them promptly.

Coordinate containment with security specialists. If you cannot disconnect an affected device from the network, follow incident-lead direction on powering it down; powering off may prevent further spread but can also destroy volatile evidence. Do not wipe, rebuild, or reboot devices unless the incident response lead or forensic team directs you to do so. Preserve ransom notes, suspicious emails, timestamps, system logs, and other incident response evidence in accordance with the team’s evidence-handling instructions.

Move incident coordination to a known-safe channel, such as approved phone lines or a separate communications system. Tell staff what to stop using, how to report suspicious activity, and where to get operational updates. Do not use personal accounts or unapproved messaging tools to share patient information.

How can the lab maintain specimen processing and urgent testing during downtime?

Have the laboratory director and clinical leaders decide which work can continue safely, which cases need expedited handling, and which tests must pause. Prioritize according to clinical urgency and specimen stability—not simply arrival time. For an ophthalmic pathology service, this may include time-sensitive eye biopsies or other cases for which a treating clinician needs prompt diagnostic guidance. Confirm priorities with the ordering clinician when needed and document the decision.

Use the lab’s approved downtime workflow rather than improvising new accessioning, labeling, or reporting practices. Keep specimens under the storage, preservation, and processing conditions required by the applicable procedure and test method. If normal processing cannot continue safely, contact the ordering clinician and consider an established referral pathway. CLIA rules require laboratories to follow written procedures for specimen handling and referral; specimens sent for testing must go to a CLIA-certified laboratory or a laboratory CMS determines meets equivalent requirements. See 42 CFR § 493.1242.

Use preapproved paper forms or a designated, access-controlled downtime record to capture orders, receipt details, processing steps, interpretations, and communications. Limit access to patient information to staff who need it for their work, and keep paper records in a secure location. For urgent preliminary or final results, use an approved communication method, verify the recipient, and document the time, recipient, result conveyed, and any required read-back.

Notify referring practices and relevant clinical teams how to submit urgent work, obtain status updates, and receive results during the outage. Provide only confirmed service information; do not promise turnaround times the lab cannot support.

How should staff track specimens and results using manual downtime procedures?

Assign each case a unique downtime accession number and mark it clearly as a downtime case. Use the laboratory’s approved process to link that number to the patient and order without creating duplicate identities or losing the connection to the eventual LIS record. CLIA requires written procedures that ensure positive specimen identification and integrity through testing and reporting. See 42 CFR § 493.1232.

For each specimen, record the identifiers required by your policy, ordering clinician, specimen type and source, laterality when applicable, container or part designation, and date and time received. For ophthalmic pathology, take particular care to preserve left-versus-right eye information and the relationship between each container, tissue piece, cassette, block, slide, and case.

Maintain specimen chain-of-custody documentation from receipt through storage, processing, review, and transfer. Record who handled or transferred the specimen, when it happened, where it was stored, and any relevant processing or disposition details. Use a controlled log with sequential entries; correct mistakes with a dated, attributable amendment rather than erasing or obscuring the original entry.

Track results and communications in the same case record. Document whether a result is preliminary, final, or corrected; who authorized it; when and how it was communicated; and the identity of the recipient. CLIA requires laboratories to retain or be able to retrieve original reports, including preliminary and corrected reports, and pathology test reports have a specific retention period. See 42 CFR § 493.1105.

How can systems and laboratory records be safely restored and reconciled?

Restore systems only after the incident response team has contained the attack, addressed the entry point, and determined which systems are safe to bring back. Select verified backup restoration points and test backup integrity before using them. CISA recommends maintaining protected backups and regularly testing their availability and integrity; a backup that reconnects to a compromised environment may itself be at risk. See the CISA StopRansomware Guide.

Restore in a controlled sequence, based on system dependencies and patient-care priorities. Before production use, confirm that case data, patient and provider records, accession numbering, report templates, user permissions, audit logs, and instrument or image connections are intact. Coordinate with vendors when they host or support the LIS, digital pathology, interfaces, or backups, and confirm that their environment and access paths have also been assessed.

Reconcile downtime records against restored electronic records case by case. Match each downtime accession to the correct patient, order, specimen parts, blocks, slides, interpretation, and report. Check for missing cases, duplicate entries, unentered results, conflicting versions, and reports that were communicated during the outage but not saved in the LIS. Preserve the original downtime documentation and record who performed and verified each reconciliation.

Before resuming electronic result routing, complete laboratory result interface validation with the receiving systems and responsible teams. Confirm that test messages map to the correct patient, case, ordering clinician, laterality, result status, and destination; check acknowledgments and error queues; and verify that preliminary, corrected, or duplicate messages will not be misrepresented as final results. Use the organization’s approved test and sign-off process before releasing live results through restored interfaces.

How should the lab assess potential exposure of protected health information and meet breach-notification duties?

Involve the privacy officer, security team, and legal or compliance counsel to determine what protected health information (PHI) the attacker could access, acquire, alter, encrypt, or exfiltrate. Assess affected systems, accounts, data types, dates, access logs, vendor environments, and evidence of data transfer. Preserve the evidence and the reasoning behind the assessment.

Under HHS guidance, ransomware is a security incident under the HIPAA Security Rule and may also constitute a breach. For unsecured PHI, an impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented risk assessment. The assessment must consider the nature and extent of the PHI, who accessed or received it, whether it was actually acquired or viewed, and the extent of mitigation. Proper encryption under HHS guidance may affect whether PHI is considered unsecured. See the HHS Fact Sheet: Ransomware and HIPAA and the HIPAA breach definition at 45 CFR § 164.402.

Determine whether the lab is acting as a HIPAA covered entity, a business associate, or both for the affected data. A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery; the business associate agreement may require earlier notice. Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Additional reporting duties depend on the number of affected individuals and other circumstances. Review the applicable Breach Notification Rule, the HHS HIPAA Breach Notification Rule guidance, and the applicable requirements in 45 CFR § 164.404 and 45 CFR § 164.410.

Document the risk assessment, the notification decision, the supporting facts, and any notices sent. Coordinate with affected provider organizations and vendors so responsibilities and timelines are clear. Do not treat restoration of data or the absence of a ransom payment as proof that PHI was not compromised.

What should the lab review and test after a ransomware incident?

After operations stabilize, conduct a documented review with laboratory, clinical, IT, security, privacy, and operations representatives. Establish a timeline, identify how the incident began and spread, assess effects on specimens and reports, and note where planned controls or downtime workflows were unavailable or unclear.

Review whether staff could identify and report the incident, use safe communications, maintain specimen identity and integrity, prioritize urgent cases, and document results during downtime. Check whether manual logs and specimen chain-of-custody documentation were complete enough to reconcile every case.

Test the response plan with practical exercises, including loss of the LIS, unavailable interfaces, compromised workstations, and failure of a primary vendor or backup path. Test verified backup restoration and laboratory result interface validation before a future emergency. NIST’s SP 800-61 Revision 3 recommends incorporating incident response and recovery lessons into ongoing cybersecurity risk management.

Assign owners and due dates to corrective actions, update contact lists and downtime forms, and revise procedures where the incident exposed gaps. Make sure staff receive instructions on the lab’s updated, employer-specific policies and know how to report a suspected future incident.

Conclusion

A safe ransomware response combines rapid, coordinated containment with patient-care prioritization, reliable manual specimen tracking, verified system restoration, and a documented PHI assessment. Protect specimen identity and report accuracy throughout downtime, then reconcile every case and test the restored systems before returning to routine operations.

FAQs

Which systems should an ophthalmic pathology lab isolate during a ransomware attack?

Isolate systems confirmed or reasonably suspected to be compromised, including affected LIS or specimen-tracking workstations, digital pathology tools, servers, interfaces, and connected devices as directed by the incident response team. If evidence suggests the attack is spreading, the team may isolate a wider network segment. Preserve evidence and follow security-lead direction before powering off, rebooting, or wiping devices.

How should the lab prioritize urgent testing while its information systems are unavailable?

The laboratory director and clinical leaders should prioritize cases by clinical urgency, specimen stability, and the treating clinician’s needs. Use approved downtime procedures, communicate delays or referral options to ordering clinicians, and document each decision and result communication. Do not bypass validated methods or specimen-handling requirements.

What must be verified before restored laboratory systems resume electronic result routing?

Verify that the system and its data are safe and complete, then test patient and case identity, laterality, provider and destination mappings, result status, message acknowledgments, and error handling. Confirm that preliminary and corrected reports are routed and labeled correctly. Resume live routing only after the lab, IT, and interface owners complete the organization’s approved validation and sign-off process.

When may ransomware-related exposure require breach notification?

Notification may be required when unsecured PHI is involved in a reportable breach. Under HIPAA, an impermissible use or disclosure is generally presumed to be a breach unless a documented risk assessment demonstrates a low probability of compromise, or an applicable exception applies. The lab’s role as a covered entity or business associate affects who must notify whom and when; involve the privacy officer and legal or compliance counsel promptly.