Ransomware Incident Response Guide for Post-Surgical Recovery Care Centers

What should a recovery care center do immediately after detecting ransomware?

Activate the center’s incident response plan as soon as ransomware is suspected. Notify the designated incident lead, IT or security staff, facility administrator, clinical leadership, and privacy officer through a communication channel that does not rely on potentially affected systems. The HIPAA Security Rule requires covered entities and business associates to respond to and document security incidents; HHS ransomware guidance recommends promptly activating the response plan and containing the attack.

At the same time, assess whether the disruption affects patient care. Identify patients who need time-sensitive post-surgical monitoring, medication, wound or drain care, or escalation to a higher level of care. The clinical lead should decide whether the center can safely continue admissions and services, or whether to pause admissions or arrange transfers using established procedures.

• Tell staff how to report affected devices, suspicious messages, and unusual system behavior.
• Use approved downtime communication methods and keep them available for clinical coordination.
• Do not connect backup drives or use affected devices to access patient information.
• Record key actions and times, including when the incident was discovered and who was notified.

Do not assume every outage is a confirmed data breach—or that encryption alone proves information was not accessed. Preserve the facts for the security and privacy teams to investigate while clinical leaders manage immediate patient-safety needs.

How can staff maintain patient care and protect patient safety during an incident?

Use the center’s electronic health record downtime procedures and emergency operations plan rather than improvising new workflows. Staff should know where approved paper forms, patient-identification materials, current contact lists, and escalation instructions are stored, and how completed records will be secured and entered into the EHR later.

For each patient, maintain a reliable way to verify identity and communicate essential clinical information, including allergies, medications, orders, recent procedures, observations, and follow-up needs. Limit access to protected health information to staff who need it for care, and store paper records securely when they are not in use.

Assign someone to track time-sensitive tasks, such as medication administration, scheduled assessments, and handoffs. Document care on the approved downtime forms as it occurs. When systems are available again, reconcile the records carefully to prevent missing, duplicated, or conflicting entries.

If staff cannot obtain the information or resources needed to provide safe care, escalate the issue to the clinical lead immediately. Follow facility procedures for contacting the surgeon or other responsible clinician, arranging additional support, or transferring a patient when the center cannot safely meet the patient’s needs. The HIPAA Security Rule’s contingency planning requirements include continuing critical business processes while operating in emergency mode, as described in HHS’s HIPAA Security Rule summary.

How should the center contain affected systems and preserve evidence?

Work with qualified IT or incident-response personnel to isolate confirmed or suspected infected devices from wired and wireless networks. Disconnect affected shared drives and other connections that could spread the ransomware, and protect unaffected systems and backups from access by compromised devices. CISA’s ransomware guide recommends isolating infected systems and protecting relevant evidence during response.

Do not shut down the entire network automatically: the appropriate scope of containment depends on the incident and the center’s clinical needs. Coordinate any action involving medical or monitoring equipment with clinical leadership and qualified technical staff so containment does not create a patient-safety risk. Before powering off a device, consult the incident-response team when feasible; shutting it down may remove volatile evidence, though preventing further harm may require immediate action.

Preserve forensic evidence by keeping ransom notes, suspicious emails, relevant system and security logs, and a timeline of events. Avoid deleting files, reinstalling software, or making unnecessary changes to affected equipment before qualified responders advise you. Where feasible, have specialists collect system images or memory and document what they collect and when. CISA’s guide describes preserving system images, memory captures, and logs for investigation.

Secure unaffected backups so they cannot be altered or encrypted through the compromised network. Notify relevant vendors and business associates through established contacts, and follow the center’s incident plan for coordinating with law enforcement or government cybersecurity responders when appropriate.

When must a healthcare facility report a ransomware incident?

A ransomware event is a security incident under the HIPAA Security Rule, but it does not automatically mean that every event requires breach notification. The center should promptly investigate whether protected health information was accessed, acquired, used, disclosed, or otherwise compromised, and document its findings. For ransomware affecting unsecured electronic PHI, HHS says a breach is presumed unless the covered entity or business associate can demonstrate a low probability that the information was compromised through a documented risk assessment. See HHS guidance on ransomware and HIPAA.

The assessment should consider the nature and extent of the PHI, who may have accessed it, whether it was actually acquired or viewed, and how the risk was mitigated. Properly secured PHI may be treated differently under the Breach Notification Rule, but the center should confirm that the applicable encryption and key-protection conditions were met. Document the assessment and the basis for any decision not to notify.

If a breach of unsecured PHI is reportable, HIPAA generally requires notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more individuals must also be reported to the HHS Secretary without unreasonable delay and within that 60-day period. For a breach affecting fewer than 500 individuals, the center may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. Details are available in the HHS Breach Notification Rule guidance.

Business associates must notify the covered entity as required by HIPAA and their business associate agreement; the agreement may set a faster reporting deadline. Other contractual, state, or sector-specific obligations may also apply. A security incident does not by itself mean that an OCR breach notification is required, so the center should involve its privacy officer and legal counsel to assess applicable reporting duties and deadlines.

How should the center restore systems and validate data integrity?

Restore systems only after incident responders have contained the threat and identified a recovery approach. Use backups that are protected from the incident and verified as suitable for recovery; restoring from an infected or compromised source can reintroduce the threat. HHS recommends testing restoration to verify backup integrity and recovery capabilities.

Before reconnecting restored systems to the production network, have qualified technical staff confirm that the systems are clean, security weaknesses have been addressed, and access credentials and permissions are appropriate. Restore services in an order that supports critical care and operations, following the center’s disaster recovery plan and incident-response guidance.

Validate that restored records are complete and usable, including medication and allergy information, orders, observations, and relevant surgical and follow-up documentation. Compare the restored information with trusted sources where possible, and reconcile care documented on downtime forms with the EHR. Keep a record of discrepancies and how they were resolved.

Return systems to service in a controlled way, with the necessary clinical, technical, and privacy approvals. Monitor them for signs of renewed compromise, and retain the incident records and recovery decisions according to the center’s policies and applicable requirements.

What incident response plan and recovery procedures should centers test?

The center’s plan should assign clear responsibilities for clinical operations, IT and security, privacy, administration, communications, and vendor coordination. It should explain how staff report suspected incidents, how the facility activates downtime procedures, how patient-safety decisions are escalated, and how evidence and incident records are preserved.

Include tested procedures for EHR downtime, secure access to essential patient information, protected paper documentation, backup protection and restoration, system recovery, and reconciliation of records created during the outage. Identify which applications and information are most critical to patient care so teams can prioritize response and recovery.

Exercise the plan with realistic scenarios, such as an unavailable EHR during a busy recovery period, compromised shared drives, or an outage affecting a vendor service. Test whether staff can find the downtime materials, reach decision-makers, maintain safe care workflows, and restore data from verified backups. Record gaps, assign owners, and revise the plan based on test results and lessons from actual incidents.

HHS describes data backup, disaster recovery, emergency operations, and periodic testing and revision as elements of HIPAA contingency planning in its ransomware and HIPAA guidance. Centers should follow current requirements and their risk-based policies; the guidance does not create a universal annual certificate or renewal requirement.

A well-tested response connects rapid containment with safe patient care, careful evidence preservation, accurate breach assessment, and a verified recovery. Keep the disaster recovery plan practical, assign responsibilities clearly, and make sure staff can use the procedures when systems are unavailable.

FAQs.

Should a post-surgical recovery care center shut down its network after detecting ransomware?

Not automatically. Promptly isolate affected systems and protect unaffected systems, but have qualified IT or incident-response staff determine the appropriate scope of containment. Coordinate any steps that could affect patient care or connected medical equipment with clinical leadership.

How can staff access patient records during an EHR outage?

Follow the center’s electronic health record downtime procedures. Use approved paper records or another authorized access method, verify patient identity, secure any protected health information, and document care as it occurs. Reconcile downtime records with the EHR after restoration.

When does ransomware trigger HIPAA breach notification requirements?

Ransomware involving unsecured PHI is generally presumed to be a breach unless the covered entity or business associate documents a risk assessment demonstrating a low probability that the PHI was compromised, or establishes that an applicable exception applies. A reportable breach requires notifications under the HIPAA Breach Notification Rule; the specific recipients and deadlines depend on the number of people affected and other applicable details.

How should a recovery care center verify backups before restoring systems?

Have qualified staff confirm that backups are protected from the attack, select a recovery point appropriate to the incident, and test restoration in a controlled environment before reconnecting systems. Check that restored records are complete and usable, and reconcile them with trusted sources and downtime documentation.