Spear-Phishing Incident Response Checklist for Cancer Hospital EHR Systems

A spear-phishing email can put electronic protected health information (ePHI), EHR accounts, and time-sensitive cancer care at risk. Use this checklist to coordinate security, privacy, IT, and clinical teams; follow your hospital’s incident-response procedures and applicable law.

How should staff report a suspected spear-phishing email?

• Stop interacting with the message. Do not click links, open attachments, reply, or use an unsubscribe link. CISA recommends reporting suspicious messages through an approved reporting method rather than interacting with them; see its phishing tip sheet.
• Report it promptly through the hospital’s approved channel. Use the email-reporting button, service desk, security hotline, or incident portal specified by hospital policy. Include whether you clicked a link, opened an attachment, entered credentials, approved an MFA prompt, or downloaded a file.
• Preserve the message for investigation. Do not forward it to coworkers or delete it before reporting. If your reporting procedure allows, submit the original message as an attachment so responders can examine its headers and links safely.
• Escalate any interaction immediately. If you clicked, entered a password, approved an unexpected MFA request, or noticed unusual device behavior, call the security team using a known internal number. Report the device and account you used, the approximate time, and what happened.
• Protect patient care while reporting. If the message or suspected compromise affects a workstation used for treatment, tell the clinical supervisor as well as IT so patient-care teams can switch to approved downtime procedures if needed.

How can responders contain compromised EHR accounts and devices?

• Open an incident and assign clear leads. Name an incident commander and involve security, identity and access management, EHR administrators, privacy, legal, and clinical operations. Contact affected vendors or business associates under the hospital’s escalation process and applicable agreements.
• Restrict suspected accounts from a clean administrative device. Disable or limit the account as appropriate, revoke active sessions and tokens, reset credentials, and review MFA methods for unauthorized changes. Check mailbox forwarding rules, delegated access, OAuth grants, and other persistence mechanisms.
• Contain affected endpoints. Use endpoint detection and response (EDR) or other approved controls to isolate a suspected device from the network while preserving evidence. Coordinate isolation with clinical leadership; do not disrupt a care-critical system without considering safe alternatives.
• Limit spread and block known indicators. Based on investigation findings, block malicious domains, URLs, senders, and files through approved email, endpoint, and network controls. Review connected accounts and systems for signs that the attacker reused credentials or moved laterally.
• Prepare for ransomware containment if indicators appear. Activate the hospital’s ransomware and downtime procedures as appropriate, protect backup systems, and coordinate containment and recovery actions. HHS describes containment, eradication, recovery, and post-incident review in its Ransomware and HIPAA fact sheet.
• Keep an incident record. Record decisions, actions, responsible staff, and timestamps. HIPAA requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where possible, and document incidents and their outcomes, as summarized in HHS’s HIPAA Security Rule overview.

How should teams investigate phishing-related access to cancer patient records?

• Preserve evidence before it disappears. Secure the original email, message headers, endpoint alerts, identity-provider records, network data, and relevant EHR audit logs. Restrict access to evidence and document who collected or handled it.
• Build a timeline across systems. Compare email, identity and access management, VPN, EDR, and EHR events. Note the first suspected exposure, logins, MFA events, account changes, record access, downloads, exports, and containment actions, including time zones.
• Determine what the account could access and what it actually did. Review EHR audit logs for patient records viewed, searched, modified, printed, or exported; compare this activity with the user’s normal role and duties. HIPAA’s audit-control standard calls for mechanisms that record and examine activity in systems containing or using ePHI; see the HHS HIPAA audit protocol.
• Scope the investigation to oncology workflows. Check relevant EHR modules and connected systems for exposure or alteration of diagnoses, pathology, genomic or laboratory results, treatment plans, medication and infusion orders, radiation schedules, and appointment information. Determine whether access affected one patient, a specific clinic, or a wider population.
• Assess confidentiality, integrity, and availability separately. Establish whether records may have been viewed or taken, whether data or accounts were altered, and whether clinicians lost access to information needed for care. HHS recommends forensic analysis and evidence collection to determine the extent of an incident and what information was accessed in its cybersecurity guidance.
• Document unresolved questions and findings. Record affected systems, accounts, patients or estimated population, data types, evidence reviewed, mitigation, and any limits in available logs. Share findings with the privacy and legal teams for breach assessment.

What steps restore EHR operations and validate data integrity?

• Confirm the threat is contained before reconnecting systems. Remove unauthorized access, address the entry point, and check for remaining malicious activity. Rebuild or clean affected devices using approved, trusted configurations when indicated by the investigation.
• Restore from known-good sources. Verify backup integrity before restoration, prioritize systems and data needed for safe cancer care, and restore in a controlled sequence. HIPAA’s contingency-plan requirements include data backup, disaster recovery, and procedures to continue critical processes in emergency mode; see HHS ransomware guidance.
• Validate records before routine clinical use. Compare restored data with trusted source records and available audit trails. Reconcile medication and infusion orders, treatment plans, pathology and laboratory results, appointments, and changes made during downtime. Escalate discrepancies to the appropriate clinical owner.
• Use clinical verification for high-impact records. Have authorized clinicians confirm patient identity and critical treatment details before acting on records that may have been altered or restored. Document corrections and the person who verified them.
• Restore access in stages and monitor closely. Re-enable accounts and systems only after security and clinical leads approve. Apply least-privilege access, reset affected credentials, strengthen authentication where appropriate, and monitor EHR activity for renewed suspicious access.
• Document recovery results. Record systems restored, backup sources used, data-integrity checks, unresolved exceptions, clinical approvals, and any remaining restrictions. HHS recommends documenting incident response, mitigation, recovery outcomes, and forensic evidence in its security incident guidance.

How should the hospital meet HIPAA breach assessment and notification requirements?

• Refer suspected impermissible access or disclosure to the privacy and legal teams. A security incident is not automatically a reportable breach. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the covered entity demonstrates a low probability that the PHI was compromised through a risk assessment.
• Document the four required risk-assessment factors. Assess the nature and extent of PHI involved, including identifiers and re-identification risk; the unauthorized person who accessed or received it; whether PHI was actually acquired or viewed; and the extent to which risk was mitigated. See the HHS Breach Notification Rule.
• Determine whether affected information was unsecured PHI. Record the data involved and the protections in place. Do not assume that a phishing incident, a ransomware event, or the presence of encryption alone resolves the breach determination.
• Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery when notification is required. The notice must include the information required by the Rule. Coordinate timing and content with privacy and legal leadership, and consider any applicable state-law or contractual requirements separately.
• Meet HHS and media reporting thresholds. For a breach affecting 500 or more individuals, notify the HHS Secretary without unreasonable delay and no later than 60 days after discovery. For fewer than 500 individuals, report to HHS no later than 60 days after the end of the calendar year in which the breach was discovered. A covered entity must also notify prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Confirm details with the HHS reporting requirements.
• Retain the decision record. Keep the risk assessment, supporting evidence, notification decisions, notices, reporting confirmations, and mitigation records in accordance with applicable documentation requirements.

How can the incident response plan be tested and improved?

• Run realistic exercises. Tabletop a spear-phishing scenario that progresses from a staff mailbox to an EHR account, attempted record access, and possible ransomware. Include security, privacy, legal, clinical operations, oncology leadership, communications, and key vendors.
• Test both response and care continuity. Practice reporting, account containment, EDR isolation, EHR audit-log review, patient-care downtime procedures, restoration, and data-integrity verification. Identify who can authorize each action and how teams communicate if normal systems are unavailable.
• Evaluate and update the plan. After an exercise or real incident, document gaps, assign owners and deadlines, and revise contact lists, escalation paths, procedures, and recovery priorities. NIST’s SP 800-61 Rev. 3 offers current incident-response recommendations for integrating response into cybersecurity risk management.
• Train staff on the hospital’s actual reporting process. HIPAA requires workforce security-awareness training, but a course-completion certificate is not proof that the organization is HIPAA compliant. Training frequency and certificate requirements should follow employer policy; federal HIPAA rules do not establish a universal annual certificate-renewal requirement. See HHS’s Security Rule overview.

Effective response depends on rapid reporting, controlled containment, a thorough review of EHR audit logs, careful breach assessment, and verified recovery. Keep clinical leaders involved throughout so security actions protect both patient information and continuity of cancer care.

FAQs

What should staff do after clicking a suspicious link?

Stop interacting with the page, do not enter further information, and report the event immediately through the hospital’s approved security channel. Tell responders whether you entered credentials, approved an MFA prompt, downloaded a file, or saw unusual device behavior. Follow their instructions; do not try to investigate or delete evidence yourself.

How can responders secure an EHR account suspected of compromise?

From a clean administrative device, restrict or disable the account as appropriate, revoke sessions and tokens, reset its credentials, and review MFA methods, mailbox rules, delegated access, and connected applications. Check identity-provider and EHR audit logs for suspicious access, then restore only the access needed for the user’s role after the account is secured.

When must a cancer hospital notify patients after a phishing incident?

Phishing alone does not automatically require patient notification. The hospital must assess whether unsecured PHI was impermissibly accessed or disclosed and document the applicable breach determination. If notification is required, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery. Additional HHS and, in some cases, media reporting requirements depend on the number of people affected.

How should EHR access and data integrity be verified after containment?

Review EHR audit logs and identity records to identify account activity and affected records. Before returning systems to routine use, compare restored information with trusted sources, reconcile changes made during downtime, and have authorized clinicians verify high-impact treatment details such as medication and infusion orders, pathology results, and treatment plans. Document discrepancies and approvals.