When your incident response plan faces its first real test during a ransomware attack, you'll quickly see if your preparation was effective. The difference becomes clear in hours, not days.
Five healthcare providers recently disclosed ransomware incidents affecting thousands of patients. What separates organizations that contained damage within hours from those still recovering months later? A checklist you can execute under pressure.
This checklist outlines critical actions healthcare CISOs must take from the moment you detect unusual network activity through post-incident hardening. It's built around HIPAA Security Rule requirements and informed by what actually worked when ransomware groups like INC Ransom and RansomHouse targeted healthcare organizations.
Prerequisites
Before executing this checklist effectively, confirm you have:
- Documented incident response plan aligned with NIST Cybersecurity Framework (CSF) 2.0 Respond function, with specific playbooks for ransomware scenarios.
- Pre-vetted third-party cybersecurity forensics firm with healthcare sector experience and an active retainer or engagement letter.
- Isolated backup systems that meet HIPAA Security Rule § 164.308(a)(7)(ii)(A) requirements, tested within the last 90 days.
- Computer Security Incident Response Team with defined roles, contact information, and authority to make containment decisions.
- Legal counsel contact familiar with Health Insurance Portability and Accountability Act breach notification requirements under the Health Information Technology for Economic and Clinical Health Act.
What good looks like: You can reach your forensics firm and activate your incident response team within 30 minutes of detection, and your backups restore within your documented recovery time objective.
Incident Response Checklist
Detection and Initial Containment (Hour 0-2)
1. Document the initial detection timestamp and indicators
Record when unusual activity was first identified, what triggered the alert, and which systems are affected. This timestamp determines your HIPAA breach notification clock.
What good looks like: You have a timestamped log entry showing detection time, affected systems, and the team member who initiated response procedures.
2. Activate your Computer Security Incident Response Team
Notify all designated team members using your out-of-band communication channel (not email if your mail system is potentially compromised).
What good looks like: Your team assembles within 30 minutes with clear role assignments and decision authority established.
3. Isolate affected systems without powering them down
Disconnect network cables or disable network interfaces on affected machines. Do not shut down systems yet as this may destroy volatile memory evidence. Cornerstone Behavioral Healthcare powered down affected computers within an hour of discovery, limiting encryption to less than 10% of data on those systems.
What good looks like: Network segmentation controls prevent lateral movement while preserving forensic evidence.
4. Engage third-party forensics experts
Contact your pre-vetted forensics firm immediately. Don't wait to understand the full scope before bringing in expertise.
What good looks like: Forensics experts are on-site or remotely connected within 4 hours of initial detection.
Investigation and Scope Determination (Day 1-7)
5. Identify the initial access vector and timeline
Work with forensics experts to determine how attackers entered your network and when. Alta Orthopaedics determined unauthorized access occurred between February 3 and February 6, 2026, though unusual activity wasn't identified until March 10.
What good looks like: You have a documented timeline showing initial compromise, lateral movement, data exfiltration periods, and encryption events.
6. Determine if data was exfiltrated
Check for outbound data transfers, compressed archives, or evidence of staging. Assume exfiltration occurred if you cannot prove otherwise. INC Ransom claimed 26 GB of data was stolen from Alta Orthopaedics.
What good looks like: Network logs and forensic analysis either confirm no exfiltration or identify the approximate volume and types of files transferred.
7. Identify all potentially compromised data elements
Map affected systems to the data they contain. For HIPAA purposes, you need specific data elements, not just system names. Alta Orthopaedics' review identified names, Social Security numbers, financial account information, diagnoses, treatment information, and biometric data.
What good looks like: You have a documented list of data categories potentially compromised, mapped to HIPAA Security Rule § 164.312(a)(2)(iv) access control requirements.
Containment, Eradication, and Recovery (Day 1-30)
8. Make the ransom payment decision
Evaluate with legal counsel, executive leadership, and law enforcement whether to pay. Cornerstone Behavioral Healthcare chose not to pay, instead wiping affected computers and purchasing new systems.
What good looks like: You have a documented decision rationale that considers FBI guidance, organizational policy, insurance coverage, and recovery capabilities.
9. Rebuild affected systems from clean backups or new installations
Do not simply decrypt and resume operations. Wipe compromised systems completely and restore from known-good backups or rebuild from scratch.
What good looks like: Restored systems are verified clean through forensic analysis before reconnecting to production networks.
10. Reset all credentials that may have been compromised
Change passwords for all accounts that had access to affected systems. Implement multi-factor authentication where not already deployed, addressing HIPAA Security Rule § 164.312(a)(2)(i) unique user identification requirements.
What good looks like: Credential reset is completed within 72 hours for privileged accounts, 7 days for all other accounts.
Notification and Reporting (Day 1-60)
11. Determine if HIPAA breach notification is required
If protected health information was accessed, acquired, used, or disclosed in a manner not permitted by the HIPAA Privacy Rule, notification is required unless you can demonstrate a low probability that the information has been compromised through a risk assessment.
What good looks like: You have a documented risk assessment addressing the four factors in HIPAA's breach notification rule.
12. Notify the HHS Office for Civil Rights
If the breach affects 500 or more individuals, notify HHS within 60 days of discovery. Cameron Regional Medical Center detected its attack on June 18, 2026, and announced it in August 2026.
What good looks like: HHS notification is submitted with accurate individual counts and data element descriptions.
13. Notify affected individuals
Mail notification letters within 60 days of discovery. Include specific data elements compromised for each individual, steps taken to investigate and mitigate, and resources available (credit monitoring, identity theft protection). Suntree Internal Medicine notified 9,810 individuals about exposed names, addresses, treatment information, and health insurance information.
What good looks like: Notification letters are clear, specific about what data was involved, and offer concrete assistance rather than generic apologies.
Post-Incident Hardening (Day 30-90)
14. Implement enhanced security controls
Review and strengthen controls based on lessons learned. Cornerstone Behavioral Healthcare implemented additional server security measures and provided specialized ransomware training to its workforce.
What good looks like: You have documented control enhancements mapped to specific attack vector weaknesses, with implementation timelines and ownership assigned.
15. Conduct tabletop exercises based on actual incident
Use your real incident as the scenario for future training. What worked? What failed? Where did communication break down?
What good looks like: Within 90 days of incident closure, you've conducted a tabletop exercise incorporating lessons learned and updated your incident response plan accordingly.
Common Mistakes
Delaying forensics engagement. Waiting to understand the incident before calling experts wastes critical hours. Engage your forensics firm immediately upon detection.
Assuming no data exfiltration. Ransomware groups routinely exfiltrate data before encryption. If you cannot prove data stayed within your network, assume it left.
Incomplete data element identification. Saying "patient data was compromised" doesn't satisfy HIPAA notification requirements. You need specific data elements for each affected individual.
Restoring from potentially compromised backups. If your backup systems were accessible to the attacker, they may contain backdoors. Verify backup integrity before restoration.
Skipping the breach risk assessment. You cannot assume every unauthorized access triggers HIPAA breach notification. Conduct the four-factor risk assessment even when you're confident notification is required.
Next Steps
If you're reading this before an incident, schedule time this week to:
- Test your backup restoration process with a realistic recovery scenario.
- Verify your Computer Security Incident Response Team contact information is current.
- Confirm your third-party forensics retainer is active and contact procedures are documented.
- Review your network segmentation to ensure you can isolate clinical systems within minutes.
If you're reading this during an incident, focus on checklist items 1-7 before attempting comprehensive remediation. Accurate scope determination prevents notification errors that create secondary compliance problems.
Your incident response plan is only as good as the checklist you can execute when systems are encrypted and executives are demanding answers. Build it now, while you have time to think clearly.
