When your organization detects unauthorized access to patient data servers, you can't afford to build your response plan from scratch. Nutex Health's August 2026 breach, disclosed through two separate SEC filings as the investigation unfolded, illustrates what happens when a cyberattack forces you to act under regulatory deadlines while facts are still emerging.
This checklist covers the critical actions you need to take in the first 72 hours after detecting a potential data breach. It's designed for healthcare organizations subject to the Health Insurance Portability and Accountability Act (HIPAA), but the core framework applies to any regulated entity managing sensitive data.
Prerequisites
Before you can execute this checklist effectively, verify these elements are already in place:
- Documented incident response plan that assigns specific roles and includes decision trees for escalation.
- Pre-negotiated contracts with third-party forensics and legal counsel specializing in healthcare breaches.
- Current data inventory that maps where patient, employee, and financial information resides across your systems.
- Established communication protocols with your legal team, board, and regulatory counsel.
- SEC filing obligations clearly documented if you're a public company (Item 1.05 Form 8-K requires disclosure of material cybersecurity incidents within four business days of materiality determination).
If you're missing any of these, you're starting behind. But you still need to move forward.
Hour 0-4: Detection and Immediate Containment
1. Activate your Computer Security Incident Response Team
Pull in your designated CSIRT members immediately. Don't wait to confirm the scope. Your team should include IT operations, information security, legal counsel, compliance, and a designated communications lead.
Good looks like: Everyone on the CSIRT knows they're activated within 30 minutes. Your first meeting happens within two hours, even if it's just to confirm you don't have answers yet.
2. Document everything from this moment forward
Start a timestamped incident log. Record every action taken, every system touched, every person notified. This log becomes your evidence trail for regulators and your defense in potential litigation.
Good looks like: A shared document where every CSIRT member logs actions in real-time, including what they checked and what they found.
3. Preserve forensic evidence
Before you touch affected systems, capture memory dumps, system logs, and network traffic. Engage your third-party forensics team now, not after you've accidentally overwritten critical evidence.
Good looks like: Your forensics partner is on a call within four hours, guiding your preservation steps, and has remote access to begin analysis within 24 hours.
4. Implement initial containment
Isolate affected systems without destroying evidence. This might mean network segmentation, not immediate shutdown. Your forensics team should guide this decision.
Good looks like: Affected systems are isolated but remain accessible for investigation. You can demonstrate you stopped lateral movement without destroying the attack timeline.
Hour 4-24: Investigation and Initial Assessment
5. Identify the attack vector and scope
Work with your forensics team to determine how the attacker got in, what systems they touched, and whether they're still present. Don't assume you've found everything in the first pass.
Good looks like: A preliminary attack timeline that identifies entry point, dwell time, and systems accessed. You can articulate what you know and what you're still investigating.
6. Assess data exposure
Map the affected systems against your data inventory. What types of data lived on those servers? Patient records? Employee Social Security numbers? Financial data? The Nutex incident involved patient, employee, credentialed provider, business, and financial information. You need specifics.
Good looks like: A matrix showing affected systems, data types present, number of records potentially exposed, and confidence level in that assessment.
7. Determine if this meets HIPAA breach notification thresholds
The HIPAA Security Rule requires notification if there's an unauthorized acquisition, access, use, or disclosure of protected health information that compromises its security or privacy. Your legal counsel needs to make this call, but don't wait for perfect information.
Good looks like: A documented legal analysis of whether the 72-Hour Notification Requirement to the Department of Health and Human Services applies, even if that analysis includes significant uncertainty.
8. Check for ransom demands or threat actor communications
Search for ransom notes, check your public-facing email for extortion attempts, and monitor dark web leak sites. The Gentlemen, the RaaS group behind the Nutex attack, uses double extortion tactics and threatens to publish stolen data.
Good looks like: You've checked all likely communication channels and documented what you found (or didn't find). If there's a ransom demand, you've preserved it without responding.
Hour 24-48: Regulatory and Stakeholder Notification
9. Make your materiality determination for SEC filing
If you're a public company, you have four business days from determining an incident is material to file Form 8-K Item 1.05. Nutex filed an initial Item 8.01 disclosure, then upgraded to Item 1.05 when materiality became clear. Work with your securities counsel to make this call.
Good looks like: A documented discussion with legal counsel about materiality factors: business disruption, data sensitivity, potential financial impact, and reputational harm. Your decision is defensible even if facts change.
10. Notify the Department of Health and Human Services if required
If you've determined this is a HIPAA breach affecting 500+ individuals, you must notify HHS within 60 days. For breaches affecting fewer than 500 individuals, you have until your annual notification. But if you're unsure of the count, start the notification process.
Good looks like: Your legal team has drafted the HHS notification and is ready to file as soon as you have a defensible count of affected individuals.
11. Prepare for patient and employee notification
Even if you don't have final numbers, draft your notification letters now. HIPAA requires notification without unreasonable delay and no later than 60 days after discovery. State laws may impose shorter timelines.
Good looks like: Draft letters ready for legal review, call center scripts prepared, and a dedicated webpage ready to publish with FAQs and resources.
12. Brief your board and executive leadership
Your board needs to understand the incident, your response, potential regulatory exposure, and financial impact. Don't sugarcoat, but also don't speculate beyond what you can support.
Good looks like: A concise executive briefing that covers what happened, what you've done, what you still don't know, and what decisions you need from leadership.
Hour 48-72: Eradication Planning and Communication Execution
13. Develop your eradication and recovery plan
Once you understand the attack, plan how you'll remove the threat actor's access and restore normal operations. This isn't just patching the entry point; it's validating that you've closed all potential backdoors.
Good looks like: A sequenced plan for credential resets, system rebuilds, and security control enhancements, with clear ownership and timelines.
14. Execute required notifications
Send notifications to affected individuals, post required public notices, and file regulatory reports. Coordinate timing so you're not blindsided by your own disclosures.
Good looks like: All notifications go out simultaneously. Your call center is staffed before letters hit mailboxes. Your public statement is published before journalists start calling.
15. Implement enhanced monitoring
Even after eradication, you need heightened monitoring for re-compromise attempts. Threat actors often return using different tactics.
Good looks like: Enhanced logging on previously affected systems, threat hunting focused on the attack patterns you observed, and a defined period for elevated monitoring (typically 90 days minimum).
Common Mistakes That Will Cost You
Delaying forensics engagement to "handle it internally": By the time you realize you need experts, you've contaminated evidence and lost critical timeline data. Engage specialists immediately.
Making premature "all clear" statements: Nutex's initial filing said they didn't believe the incident would have material impact, then filed a second disclosure confirming materiality. It's better to say "we're still investigating" than to walk back reassurances.
Treating this as purely an IT problem: Breach response is a legal, regulatory, and communications challenge that happens to involve technology. Your CSIRT must include non-technical stakeholders.
Assuming you've found everything in the first 48 hours: Sophisticated attackers leave multiple access points. Your initial containment stops the bleeding; full eradication takes weeks.
Negotiating with threat actors without legal counsel: Any communication with ransomware operators has legal implications, especially if they're sanctioned entities. Never respond without clearing it through legal.
Next Steps
This checklist gets you through the critical first 72 hours. What comes next:
- Complete your forensic investigation (typically 4-8 weeks)
- File final regulatory notifications with accurate affected individual counts
- Implement remediation measures identified in your investigation
- Conduct a post-incident review to update your incident response plan
- Consider whether you need to engage breach coaching services for affected individuals
- Evaluate your cyber insurance coverage and file claims if applicable
The Nutex incident demonstrates that even with quick SEC disclosure and third-party forensics support, determining the full scope of a breach takes time. Your job in the first 72 hours isn't to have all the answers. It's to execute a defensible response that protects patients, meets regulatory obligations, and positions you to manage the long-term fallout.
Build this checklist into your incident response plan now. When you're dealing with exfiltrated patient data and a threat actor threatening to publish, you won't have time to figure out the sequence.
