Ransomware Protection & Response Guide

Protect your healthcare practice from ransomware attacks with prevention strategies and a step-by-step response playbook.

The Ransomware Threat to Healthcare

Ransomware attacks against healthcare organizations increased 94% in 2025. The average ransom demand for healthcare targets is $1.27 million, and the total cost of recovery (including downtime, lost revenue, and remediation) averages $4.82 million. For a small practice, a single ransomware attack can be devastating — even fatal to the business.

How Ransomware Attacks Work

Phase 1: Initial Access

Attackers gain entry through:

• Phishing emails (68% of healthcare ransomware attacks start here)
• Exploited vulnerabilities in unpatched software
• Compromised remote access (VPN, RDP, remote desktop)
• Supply chain compromise through infected vendor software

Phase 2: Lateral Movement

Once inside, attackers:

• Harvest credentials from memory and Active Directory
• Map the network to identify critical systems
• Move between systems to maximize their reach
• Identify and attempt to delete or encrypt backups

Phase 3: Data Exfiltration

Modern ransomware gangs practice "double extortion":

• Steal sensitive data before encrypting
• Threaten to publish patient records if ransom isn't paid
• This means backups alone won't protect you from exposure

Phase 4: Encryption

The ransomware activates:

• All accessible files are encrypted
• Ransom note appears demanding cryptocurrency payment
• Systems become unusable — EHR, billing, scheduling, email
• Patient care is disrupted

Prevention Checklist

Email Security

• Deploy advanced email filtering with sandbox analysis
• Implement DMARC, DKIM, and SPF records
• Block dangerous attachment types (.exe, .js, .vbs, .scr)
• Enable link rewriting and URL scanning
• Conduct monthly phishing simulations

Endpoint Protection

• Deploy endpoint detection and response (EDR) on all devices
• Enable automatic OS and software updates
• Restrict administrative privileges (least privilege)
• Disable macros in Microsoft Office by default
• Block PowerShell execution for non-admin users

Network Security

• Segment clinical networks from administrative and guest networks
• Restrict Remote Desktop Protocol (RDP) — disable if not needed
• Require VPN with MFA for all remote access
• Deploy intrusion detection/prevention systems (IDS/IPS)
• Monitor DNS queries for known malicious domains

Backup Strategy (The 3-2-1 Rule)

• Maintain at least 3 copies of critical data
• Store on 2 different media types (cloud + local)
• Keep 1 copy offline (air-gapped, disconnected from network)
• Test backup restoration monthly
• Encrypt all backup data

Staff Training

• Quarterly cybersecurity awareness training
• Phishing recognition and reporting procedures
• Social engineering awareness
• USB and removable media policies
• Incident reporting procedures

Ransomware Response Playbook

Hour 0-1: Detection and Containment

1. Isolate affected systems — disconnect from network immediately (unplug Ethernet, disable WiFi)
2. Do NOT power off — this preserves forensic evidence
3. Alert your incident response team (or designate one now)
4. Document everything — timestamps, affected systems, ransom note details
5. Do NOT pay the ransom yet — this is a business decision for later
6. Preserve the ransom note — take photos, save screenshots

Hour 1-4: Assessment

1. Determine scope — which systems are affected?
2. Identify the ransomware variant — use the ransom note, encrypted file extension, or upload a sample to ID Ransomware (id-ransomware.malwarehunterteam.com)
3. Check for free decryptors at nomoreransom.org
4. Assess data exfiltration — were files stolen before encryption?
5. Evaluate backup integrity — are your backups intact and unencrypted?

Hour 4-24: Notification and Response

1. Contact law enforcement — FBI (ic3.gov) and/or local field office
2. Notify your cyber insurance carrier (if applicable)
3. Engage a forensic investigation firm (your insurer may have preferred vendors)
4. Assess HIPAA breach notification requirements — if ePHI was accessed or exfiltrated, the 60-day notification clock starts
5. Communicate with staff — provide clear instructions on what to do and not do

Day 1-7: Recovery

1. Rebuild from clean backups — do NOT restore from backups connected during the attack
2. Reset ALL passwords across the organization
3. Patch the vulnerability that allowed initial access
4. Deploy enhanced monitoring on rebuilt systems
5. Verify system integrity before reconnecting to the network

Day 7-30: Post-Incident

1. Conduct a thorough post-incident review
2. Update your incident response plan based on lessons learned
3. Complete HIPAA breach notifications if required
4. Implement additional security controls to prevent recurrence
5. Provide targeted training to staff on the attack vector used

To Pay or Not to Pay

The FBI recommends against paying ransoms. However, the decision is complex:

Arguments against paying:

• No guarantee you'll get a working decryptor
• Funds criminal organizations
• Makes you a target for future attacks
• May violate OFAC sanctions if the attacker is a sanctioned entity

Arguments for paying (in some cases):

• Patient safety may require immediate system restoration
• Backups may be compromised or insufficient
• Double extortion threat to publish patient data

If you decide to pay: Work with law enforcement and a professional ransomware negotiator. Never communicate directly with attackers.

HIPAA Implications

A ransomware attack is presumed to be a HIPAA breach unless you can demonstrate a low probability that PHI was compromised. You must:

• Conduct a risk assessment per the Breach Notification Rule
• Notify HHS within 60 days of discovery (or immediately if 500+ individuals affected)
• Notify affected individuals
• Notify media if 500+ individuals in a single state are affected

Assess Your Ransomware Risk Now

Your HIPAA Agent Compliance Score™ directly evaluates the controls that prevent ransomware attacks. The 83-tool scan checks whether your practice has the defenses ransomware gangs look for before targeting an organization — exposed RDP/SMB services, missing email authentication, unpatched vulnerabilities, weak encryption, and login pages without MFA.

Why this matters for ransomware protection: The 2024 Change Healthcare attack started with a single credential and no MFA. The HIPAA Agent Compliance Score™ identifies exactly these gaps — exposed remote access ports, missing multi-factor authentication indicators, email spoofing vulnerabilities (the #1 ransomware delivery method), and SSL/TLS misconfigurations that signal weak security posture to automated scanning tools used by threat actors.

Get your free HIPAA Agent Compliance Score™ →

How HIPAA Agent Helps with Ransomware Protection & Response

Ransomware defense requires both proactive hardening and a tested response plan. HIPAA Agent delivers both. The 83-tool external scan identifies the exact entry points ransomware gangs exploit to infiltrate healthcare networks — open RDP ports, exposed SMB services, unpatched web servers, missing email authentication, and login pages without multi-factor authentication. These are the same attack vectors used in the Change Healthcare breach and nearly every major healthcare ransomware incident.

Beyond perimeter scanning, HIPAA Agent's 12-phase internal network scan evaluates network segmentation, lateral movement paths, and internal service exposure — the factors that determine whether a ransomware infection stays contained to one workstation or spreads across your entire practice. HIPAA Agent also generates a complete ransomware response playbook customized to your practice, including incident response procedures, communication templates, and breach notification checklists.

HIPAA Agent's contingency planning tools help you build the three plans HIPAA requires: a data backup plan, a disaster recovery plan, and an emergency mode operations plan. Annual tabletop exercise guidance walks your team through simulated ransomware scenarios so your response is tested before a real attack occurs.

Key Features

• 83-tool external scan identifies ransomware entry points including open RDP, SMB, unpatched services, and exposed login pages
• 12-phase internal network scan checks network segmentation and lateral movement paths
• Ransomware response playbook with step-by-step incident response procedures customized to your practice
• Contingency planning: data backup plan, disaster recovery plan, and emergency mode operations plan generation
• Annual tabletop exercise guidance with simulated ransomware scenarios
• Breach risk assessment determines HIPAA notification obligations after a ransomware attack
• Real-time threat intelligence integration from CISA and HHS HC3 on active ransomware campaigns targeting healthcare
• Incident response plan generator aligned with NIST CSF and HIPAA Security Rule requirements

Start by getting your free HIPAA Agent Compliance Score™ at hipaaagent.ai/check to identify whether your practice has the exposed services and missing controls that ransomware operators actively scan for before selecting their next target.

Ready to Automate Your Compliance?

HIPAA Agent handles all of this for you automatically.

Related Guides