Can Your Practice Recover From Ransomware Tomorrow?

Ransomware can lock your schedule, your health record and your email at the same time. Whether that becomes a bad day or a long shutdown depends largely on preparation you do now. Answer each question honestly with a yes or no. There is no score; the goal is to see where you stand.

The questions

1. Do you back up your critical systems and patient data automatically, on a schedule you have confirmed is working?
2. Is at least one copy of your backups kept offline or otherwise protected so that ransomware on your network could not encrypt or delete it?
3. Have you restored real data from backup in the last six months to prove it works?
4. Do you know how long it would take to restore your most important systems, and is that time acceptable to your practice?
5. Have you identified which systems and data you need first to keep caring for patients?
6. Do you have a written plan for operating without your normal systems, such as paper scheduling and documentation, while you recover?
7. Does your plan list who to call first, including your IT provider, cyber insurance carrier, legal counsel and key vendors, with contact details stored somewhere other than your network?
8. Have you walked through a ransomware scenario with your team in the past year?

What your answers suggest

Mostly yes. You have a solid foundation. Keep testing, update the plan when systems or vendors change, and make sure more than one person knows how to carry it out.

A mix of yes and no. You likely have backups but less certainty about recovery. Questions 2 and 3 matter most: backups that are reachable from your network, or that have never been restored, may not help when you need them.

Mostly no. Your practice may struggle to recover quickly. Start with protected backups and a tested restore, then build a simple plan for keeping patient care going.

Whatever your answers, remember that ransomware is also a HIPAA matter. HIPAA expects a contingency plan with backups, disaster recovery and emergency operations, and HHS has said that ransomware encrypting patient information is generally presumed to be a reportable breach unless you can show a low probability that the information was compromised.

Take the next step

Our free HIPAA security assessment gives you a quick, private view of where your safeguards for patient information may have gaps. It is a starting point; a limited assessment like this cannot establish complete HIPAA compliance.

Related reading

• Ransomware and patient records
• Logging, Backups, Malware Protection, and Incident Response Basics
• 7 HIPAA Security Gaps Healthcare Organizations Commonly Miss