When Highlands Oncology Group settled class action litigation after their 2025 ransomware attack affecting 113,575 individuals, the settlement terms revealed a familiar pattern: documented losses capped at $4,250 per claimant, pro rata payments around $50, three years of monitoring services, and a legal process spanning over a year from breach notification to final fairness hearing. Your organization's settlement wouldn't look much different. The question isn't whether you'll face litigation after a material breach. It's whether you can demonstrate you did everything reasonably required beforehand.
This checklist covers the defensive posture elements that influence legal exposure when a breach occurs. Each item represents a control or process that plaintiffs' attorneys and regulatory investigators will scrutinize.
Prerequisites
Before working through this checklist, ensure you have these in place:
- A designated data protection officer or privacy lead with authority to enforce controls across business units.
- An accurate data inventory covering protected health information, personally identifiable information, and payment card data locations.
- Executive sponsorship for security spending tied to risk reduction.
Without these, you're documenting aspirations rather than verifiable controls.
Checklist Items
Access Controls and Authentication
1. Privileged Access Management is enforced for all administrative accounts
- Administrative credentials require multi-factor authentication with phishing-resistant methods (hardware tokens or platform authenticators, not SMS).
- Privileged sessions are logged with keystroke recording for forensic reconstruction.
- Just-in-Time Access limits standing privileges to 8-hour windows maximum.
Good looks like: An attacker who compromises one credential can't pivot to domain admin because PAM requires a second approval workflow and hardware token you can't phish.
2. Role-Based Access Control follows the Principle of Least Privilege
- Access provisioning requires manager approval and quarterly recertification.
- Former employee accounts are disabled within 2 hours of HR notification.
- Vendor and contractor accounts expire automatically after 90 days without renewal.
Good looks like: Your access review logs show you removed 15% of permissions during the last quarterly recert because job roles changed.
Network Segmentation and Monitoring
3. Network segmentation isolates critical data repositories
- Protected health information databases sit behind application-layer firewalls with deny-all default rules.
- Lateral movement between network segments requires explicit firewall rules you can enumerate in 10 minutes.
- Backup infrastructure operates on a separate VLAN with one-way replication only.
Good looks like: Ransomware that encrypts your file servers can't reach your backups because there's no network path from production to backup storage.
4. Security information and event management captures authentication failures and privilege escalation
- Failed login attempts trigger alerts after 5 attempts within 15 minutes.
- New local administrator account creation generates high-priority tickets.
- Log retention meets your jurisdiction's breach notification investigation period (typically 90 days minimum).
Good looks like: When investigators ask "when did the attacker first access the network?", you can answer with timestamp precision, not "sometime in Q1."
Incident Response Planning
5. Computer Security Incident Response Team procedures are tested quarterly
- Tabletop exercises simulate ransomware scenarios with legal counsel present.
- External forensics firm is on retainer with 4-hour response commitment.
- Breach notification templates are pre-drafted and legally reviewed for HIPAA Security Rule, HITECH Act, and state breach notification statute compliance.
Good looks like: Your notification to affected individuals goes out within 30 days of breach discovery because you didn't spend three weeks arguing about wording.
6. Backup and recovery procedures are validated monthly
- Full system restoration is tested end-to-end, not just backup job completion.
- Recovery time objective for critical systems is documented and achievable.
- Offline backup copies exist that ransomware can't encrypt via network access.
Good looks like: You restore from backups and resume operations within 48 hours instead of negotiating with ransomware operators for decryption keys.
Vendor Risk Management
7. Third-party service providers undergo annual security assessments
- Business associate agreements specify breach notification timelines (24-48 hours, not "prompt").
- Vendors handling protected health information provide SOC 2 Type II reports or equivalent.
- Vendor access to your systems is logged and reviewed quarterly.
Good looks like: When your email filtering vendor gets breached, they notify you within 24 hours per contract terms, and you can demonstrate you verified their security posture annually.
Data Protection and Encryption
8. Data at rest encryption protects all repositories containing regulated data
- Encryption key management uses hardware security modules or cloud-native key management services.
- Encryption keys are rotated annually and after any suspected compromise.
- Encryption is independently verified during internal audits, not assumed based on vendor claims.
Good looks like: Exfiltrated database files are cryptographically useless to attackers because you can prove encryption was active and keys weren't compromised.
9. Data in transit encryption is enforced for all external communications
- TLS 1.2 minimum is configured on all web applications and APIs.
- Email containing protected health information requires encryption (S/MIME or portal-based).
- File transfers use SFTP or HTTPS, not unencrypted FTP.
Good looks like: Network packet captures from the breach investigation show encrypted sessions, limiting what attackers could intercept.
Detection and Response Capabilities
10. Endpoint detection and response covers 100% of workstations and servers
- EDR alerts on known ransomware behaviors (mass file encryption, shadow copy deletion, backup service termination).
- Security operations center or managed detection service monitors alerts 24/7.
- Mean time to respond to critical alerts is measured and improving quarter-over-quarter.
Good looks like: Your EDR blocks the ransomware encryption routine on 95% of endpoints before damage occurs because you detected and contained within 15 minutes.
Common Mistakes
Treating breach notification deadlines as targets rather than maximums. The HITECH Act's 60-day notification window is not a planning assumption. Highlands Oncology Group notified affected individuals 60 days after identifying the attack. Faster notification demonstrates good faith and may influence settlement negotiations.
Confusing cyber insurance coverage with breach preparedness. Insurance pays for forensics and notification costs. It doesn't reduce the reputational damage or demonstrate you implemented reasonable safeguards before the breach.
Documenting policies without verifying implementation. Your incident response plan's value in litigation is zero if you can't produce evidence you tested it. Tabletop exercise documentation and restoration test logs matter.
Assuming HIPAA Security Rule compliance is sufficient. HIPAA establishes a regulatory floor. Plaintiffs' negligence claims rest on whether you implemented reasonable safeguards relative to known threats, not just minimum regulatory requirements.
Next Steps
Schedule a 90-minute working session with your Computer Security Incident Response Team, legal counsel, and a senior IT operations lead. Walk through this checklist item by item. For each unchecked box, assign an owner and a 60-day completion target.
Your goal isn't perfection. It's demonstrating you took reasonable, verifiable steps to protect data before the breach occurred. That's what influences whether you're defending against thirteen consolidated lawsuits or two, and whether settlement discussions start at $4,250 per claimant or somewhere lower.
The Highlands Oncology Group breach timeline shows attackers had network access for over four months before detection. Your checklist review should answer one question: if an attacker compromised your network today, would you detect them in days or months?
