Ransomware Incident Response Guide for Perinatal Hospice Services

A ransomware incident can disrupt care coordination, clinical records, scheduling, and communication with families at a time when reliable support matters deeply. A clear response plan helps your team contain the incident while maintaining safe, compassionate perinatal hospice services.

Use this guide alongside your organization’s incident response plan and professional legal, privacy, and cybersecurity advice. HIPAA requirements apply to organizations that are covered entities or business associates; determine your organization’s status and obligations rather than assuming that every service is covered.

How should perinatal hospice services activate their incident response plan?

Activate your incident response plan as soon as ransomware is suspected—not only after an investigation confirms it. Tell staff how to report unusual device behavior, ransom notes, inaccessible records, or unexpected account activity, and provide an alternate way to reach the response team if email or chat may be affected.

Assign clear roles: an incident lead coordinates decisions; IT or your managed service provider handles technical containment; the privacy or compliance lead assesses information and reporting obligations; and a clinical lead coordinates care continuity. Include leadership and communications support as needed. If an outside vendor hosts systems or holds patient data, contact the appropriate vendor using a trusted channel.

Use out-of-band communications, such as known telephone numbers, if normal messaging systems may be compromised. Keep a time-stamped incident log of decisions, actions, affected systems, and the people responsible. CISA’s StopRansomware Guide recommends following an incident response plan and coordinating response communications.

Which systems should be isolated to contain ransomware?

Work with qualified IT responders to identify and isolate affected devices and systems promptly. Depending on the incident, these may include electronic health record (EHR) systems, workstations, shared drives, servers, email, remote-access services, cloud accounts, and connected network storage. Include systems used for scheduling, referrals, billing, and care coordination in your assessment.

Containment may involve disconnecting affected devices from Wi-Fi or wired networks, disabling compromised accounts, or isolating a network segment. Network segmentation can help limit ransomware’s spread between services, but responders should determine which connections to restrict so that containment does not inadvertently disrupt essential care or emergency communications.

Prefer network isolation over powering down a device when feasible: shutting it down may destroy evidence held in temporary memory. If a device cannot be disconnected from the network, powering it down may be necessary to limit further spread. Follow your incident plan and responder guidance. CISA’s ransomware response guidance recommends isolating impacted systems and notes that powering down can result in the loss of volatile evidence.

How can teams maintain patient care during a ransomware disruption?

Activate your downtime procedures and prioritize care activities that cannot wait for systems to return. Establish a reliable way for staff to contact the clinical lead, on-call clinicians, partner hospitals, and other care providers. Confirm which communication channels remain available and appropriate for sensitive information.

Use approved paper forms or other authorized offline methods to record essential care information, referrals, contacts, and follow-up tasks. Limit access to records, store completed forms securely, and keep track of additions, corrections, and handoffs. When systems are restored, reconcile the temporary records with the electronic record under your organization’s procedures to reduce omissions and duplication.

Agree on how the team will route urgent clinical questions and coordinate with families and care partners. Share only the information needed for each task, and avoid putting patient details in personal email, unapproved messaging apps, or other channels that have not been cleared for that use.

HIPAA’s Security Rule requires covered entities and business associates to plan for continuing critical business processes during emergency operations. See HHS’s Ransomware and HIPAA Fact Sheet for guidance on contingency planning and recovery.

What evidence should be preserved for the investigation?

Preserve the ransom note, suspicious messages, affected device details, relevant timestamps, and a record of what staff observed and did. Save available system, security, firewall, email, remote-access, and cloud logs before routine retention processes overwrite them. Record who collected each item, when it was collected, and how it was transferred or stored.

Ask a qualified incident responder or forensic specialist to determine whether forensic system imaging or memory capture is appropriate. Avoid deleting files, reinstalling software, or otherwise altering affected devices before responders assess the evidence-preservation needs. Evidence can help establish how the attack occurred, which systems were affected, and whether data was accessed or transferred.

CISA’s StopRansomware Guide recommends preserving relevant logs and volatile evidence, such as system memory, and taking system images and memory captures when appropriate. Coordinate evidence handling with your responders and follow applicable organizational procedures.

How should teams assess potential access to or exposure of patient data?

Work with your incident responders and privacy lead to determine what information was stored on affected systems, which accounts and systems were accessed, how long the attacker may have had access, and whether there is evidence of data being viewed, copied, or transferred. Review logs, system findings, vendor reports, and the scope of any affected backups or cloud services.

For organizations subject to HIPAA, ransomware is a security incident, but whether it results in a reportable breach depends on the facts and circumstances. HHS guidance explains that ransomware-encrypted electronic protected health information (ePHI) may be treated as acquired by an unauthorized person, and an impermissible use or disclosure is generally presumed to be a breach unless the organization demonstrates a low probability that the PHI was compromised through a documented risk assessment. The assessment should consider the nature of the information, who received or used it, whether it was actually acquired or viewed, and how risks were mitigated. HHS’s Ransomware and HIPAA Fact Sheet describes these factors.

Document the evidence reviewed, uncertainties, conclusions, and rationale. Do not assume that encrypted files mean no data was exposed: assess whether the information was protected by encryption before the incident and whether that encryption meets HHS guidance for rendering PHI unusable, unreadable, or indecipherable to unauthorized people.

What reporting and notification steps may apply?

Notify your organization’s privacy or compliance lead and follow the incident response plan. If a business associate or technology vendor is involved, follow the applicable contract and business associate agreement, and coordinate with the covered entity responsible for the affected information. Determine whether state law, contractual commitments, law enforcement considerations, or other requirements also apply.

For a breach of unsecured PHI subject to HIPAA, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals must also be reported to the HHS Secretary without unreasonable delay and within that 60-day period; smaller breaches are reported to the Secretary within 60 days after the end of the calendar year in which they were discovered. A covered entity must notify prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Business associates must notify the covered entity as required by HIPAA and their agreement. Confirm the applicable details with counsel and the relevant privacy lead.

These are federal HIPAA rules for covered entities and business associates, not a substitute for evaluating other obligations or determining whether a particular incident is a breach. See HHS’s Breach Notification Rule guidance and HHS instructions for reporting breaches to the Secretary.

How can services prepare backups and test recovery procedures?

Identify the systems and information needed to support care, then maintain backups that can be retrieved if production systems are unavailable. Keep appropriate copies offline or otherwise protected from access by compromised systems, and ensure backup access is controlled. Include dependencies such as identity services, network equipment, scheduling tools, and contact information in recovery planning.

Test backup restoration in a controlled environment, verify that recovered records are usable and sufficiently current, and confirm that restored systems can operate safely before reconnecting them to the network. Define who authorizes restoration and what checks must be completed. CISA recommends maintaining offline, encrypted backups and regularly testing backup procedures; HHS identifies backup and recovery planning as part of HIPAA contingency planning.

For HIPAA-regulated organizations, the Security Rule includes requirements for contingency planning, including data backup and disaster recovery. HHS identifies periodic testing and revision of contingency plans as an addressable implementation specification—not a universal federal requirement to renew an annual certificate. Use test results and lessons learned to update both technical recovery steps and staff downtime procedures.

In short, prepare to contain ransomware, preserve evidence, assess potential exposure, and keep essential care coordination functioning through practiced downtime procedures. Reliable backups, tested restoration, and clear responsibilities give your team a stronger path to recovery.

FAQs

Should infected systems be shut down or isolated?

When feasible, isolate infected systems from the network rather than shutting them down, since shutdown may erase volatile evidence. If a device cannot be disconnected, powering it down may help prevent further spread. Follow your incident plan and the guidance of qualified responders.

How can perinatal hospice teams coordinate patient care during an outage?

Use your downtime procedures, approved alternate communication channels, and secure paper forms or other authorized offline records. Assign a clinical point of contact, prioritize urgent coordination, protect temporary records, and reconcile them with electronic records after recovery.

What evidence should be preserved after a ransomware incident?

Preserve ransom notes, relevant logs, suspicious messages, affected device details, timestamps, and a record of response actions. Consult a qualified responder about forensic imaging and memory capture, and avoid altering affected devices before evidence needs are assessed.

Who should be notified if patient information may have been exposed?

Notify your organization’s incident lead and privacy or compliance lead promptly, then follow the response plan. Contact affected vendors or business associates and coordinate with the covered entity where applicable. The organization’s privacy lead and legal counsel should determine whether HHS, affected individuals, media, state authorities, or other parties must be notified under the applicable rules.