Spear-Phishing Incident Response Checklist for Protecting Ultrasound Images and Study Files

A spear-phishing incident can expose staff credentials, disrupt ultrasound workflows, or put ultrasound images and study files at risk. Use this checklist to coordinate a fast response across security, IT, clinical, privacy, and medical-device teams. Follow your organization’s incident response plan and escalate immediately if patient care may be affected.

Detect and Contain Spear-Phishing Attacks

Act promptly when a staff member reports a suspicious message, clicks a link, opens an attachment, or enters credentials on an unfamiliar page. A suspected account compromise is enough to start containment; you do not need to prove data was accessed first.

• Notify your security operations or incident response team through an approved channel. Include the recipient, time, subject, sender details, and actions taken.
• Ask staff not to forward the message as a regular attachment or interact with it further. Preserve it through your approved email-reporting process so analysts can inspect the original safely.
• Use endpoint detection and response (EDR) tools to identify affected workstations, suspicious processes, connections, and related activity across the network.
• Block or quarantine confirmed malicious messages and indicators using approved security controls, while checking whether other users received or acted on the same message.
• Isolate affected endpoints from the network when your security team determines it is appropriate. Coordinate first if isolation could interrupt patient care or affect a connected ultrasound system.

Record the incident timeline as it develops, including discovery, containment actions, affected users, and systems. Avoid deleting messages, logs, or files that may help investigators understand the scope.

Secure Exposed Accounts and Healthcare Systems

Stolen credentials may let an attacker impersonate a clinician or staff member and access email, electronic health records, imaging systems, or shared file storage. Coordinate identity and access management actions so you contain access without disrupting urgent care.

• Disable or temporarily restrict confirmed compromised accounts, following your organization’s escalation process.
• From a trusted device, reset passwords and revoke active sessions, refresh tokens, and other access credentials where supported. Require multifactor authentication or reauthentication in line with policy.
• Review sign-in records for unusual locations, devices, times, failed attempts, and access to imaging, archive, or file-sharing systems.
• Check for suspicious mailbox rules, delegated access, newly registered authentication methods, privilege changes, and unexpected application authorizations.
• Confirm whether the account had access to other systems, and restrict permissions that are not needed for the user’s role.
• Coordinate with vendors or service providers if the account or affected system is managed outside your organization.

Do not rely on a password change alone. Check for persistent access and unauthorized changes, and document each account recovery action.

Protect Ultrasound Images and Study Files

Determine which ultrasound images, reports, worklists, and study files could be exposed, altered, deleted, or made unavailable. These may contain protected health information and electronic protected health information, including patient names, identifiers, exam details, dates, and diagnostic images.

• Identify relevant systems and storage locations, such as ultrasound consoles, PACS, DICOM archives, EHR integrations, removable media, network shares, and cloud or vendor-hosted repositories.
• Use audit logs and access records to establish which studies were viewed, exported, shared, changed, or deleted, and by which account or device.
• Restrict access to affected repositories where necessary, while preserving access for authorized clinical care and following downtime procedures.
• Verify the integrity and availability of study files using approved processes. Compare against protected backups or trusted source systems when appropriate.
• Preserve original files and metadata. Avoid renaming, editing, moving, or restoring files until investigators and system owners determine a safe method.
• Check export destinations, shared links, removable media, and transfer logs for unauthorized copies or disclosures.

If a repository may have been altered or encrypted, coordinate recovery with IT and clinical leadership. Validate restored studies before using them for clinical decisions, and follow established procedures for documenting any affected or unavailable images.

Preserve Evidence and Investigate Data Loss

Forensic evidence preservation helps determine how the attack occurred, what information may have been accessed, and whether the attacker still has access. Follow your organization’s evidence-handling procedures and involve qualified incident responders.

• Preserve relevant email, message headers, endpoint alerts, authentication records, audit trails, firewall and network logs, and cloud or vendor records.
• Record system names, account identifiers, timestamps, time zones, actions taken, and the people who handled or transferred evidence.
• Capture system state and logs through approved forensic methods. Avoid powering off or wiping devices unless responders direct you to do so or immediate safety needs require it.
• Ask vendors to preserve relevant records and report their findings through the channels and timelines in applicable agreements and incident procedures.
• Track known and suspected access, acquisition, modification, deletion, or disclosure of ultrasound images and related information.

Maintain a clear chain of custody for collected evidence. Keep investigative working copies separate from originals, and document how each copy was obtained and stored.

Assess PHI Breach and Notification Obligations

Refer suspected exposure of patient information to your privacy officer or breach response team promptly. A spear-phishing event does not automatically establish that a reportable breach occurred, but the organization should assess whether protected health information was impermissibly accessed, acquired, used, or disclosed.

For a HIPAA breach risk assessment, consider the nature and extent of the information, who received or accessed it, whether it was actually acquired or viewed, and what steps reduced the risk. Document the analysis, supporting evidence, and decision. HHS states that notification for a breach of unsecured PHI must be made without unreasonable delay and no later than 60 days after discovery; other applicable requirements or agreements may also affect the response.

• Determine whether affected files contained identifiable PHI, whether the information was secured under applicable guidance, and which individuals may be involved.
• Consider relevant federal and state requirements, organizational policies, contracts, and business associate agreements.
• Coordinate with legal counsel, privacy leadership, compliance, and communications before making notification decisions or statements.
• Keep records supporting whether notification was required, who was notified, and when required actions were completed.

Review Medical Device Safety Risks

Assess whether the incident reached an ultrasound console, workstation, network-connected device, or system that supports clinical interpretation. A cybersecurity response should protect patient safety as well as confidentiality and availability.

• Ask clinical engineering, biomedical engineering, and clinical leadership to determine whether device operation, image integrity, availability, or patient-care workflows may be affected.
• Do not power down, disconnect, patch, or reconfigure a medical device without coordinating with the responsible clinical and technical teams, unless an immediate safety procedure requires action.
• Use medical device network segmentation to limit unnecessary communication between devices, user workstations, and enterprise systems, following approved architecture and clinical requirements.
• Consult the manufacturer or authorized service provider about device-specific investigation, recovery, and safe operating steps.
• Use established downtime and alternative imaging procedures if a device or study repository cannot be trusted or safely used.

FDA guidance emphasizes that healthcare organizations and medical device manufacturers should address cybersecurity risks and appropriate mitigations while considering device performance and patient safety.

Incorporate Lessons Learned and Phishing Prevention

After containment and recovery, review how the message reached staff, how access was obtained, and which controls worked or failed. Use findings to improve defenses without blaming individuals who report suspicious activity.

• Update email filtering, authentication policies, account monitoring, and access controls based on the incident findings.
• Review whether staff can report suspected phishing easily and receive timely guidance after clicking a link or submitting credentials.
• Test incident procedures for compromised accounts, imaging-system access, affected study files, evidence preservation, and patient-care continuity.
• Confirm that backups, recovery plans, and vendor escalation contacts are current and usable.
• Document corrective actions, assign owners and deadlines, and verify completion.

In summary, protect ultrasound study files by containing the attack, securing accounts, verifying affected data, preserving evidence, assessing PHI obligations, and coordinating any device-related actions with clinical teams. Clear roles and tested recovery procedures help you reduce harm while maintaining safe care.

FAQs

What should healthcare staff do after identifying a spear-phishing email?

Report it immediately through your organization’s approved channel, stop interacting with it, and follow security-team instructions. If you clicked a link, opened an attachment, or entered credentials, say so promptly so responders can secure the account and device. Do not delete potential evidence or forward the message outside approved procedures.

How can exposed credentials affect access to ultrasound study files?

An attacker using exposed credentials may access systems or shared storage available to that account, depending on its permissions and any additional safeguards. They may view, export, alter, or delete ultrasound images and related files, or use the account to seek broader access. Review account activity and relevant imaging-system audit logs to determine what happened.

How should ultrasound images stored on a compromised device be protected?

Coordinate with security, IT, clinical engineering, and clinical leadership before isolating or changing the device. Limit unauthorized access using approved controls, preserve evidence and original files, and verify study integrity against trusted records or backups. Do not use potentially altered images for clinical decisions until the responsible team validates them.

When must a suspected PHI breach be assessed for notification obligations?

Refer a suspected exposure to your privacy or breach response team as soon as it is identified so the organization can investigate and make a documented determination. HIPAA notification timelines apply to breaches of unsecured PHI; covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery. State law, contracts, and other applicable requirements may also apply.