Stop ransomware before it reaches your patient records

Why practices are targeted

Patient records are valuable, and practices can't work without them. That combination makes healthcare an attractive target for ransomware. Attackers don't need to pick your practice by name. They send phishing emails by the thousand, try stolen passwords against every remote access portal they can find and look for unpatched systems. Small and mid-sized practices get caught because they have the same data as a hospital and less protection around it.

HHS has reported that large breaches reported to OCR rose 102 percent between 2018 and 2023, driven mainly by hacking and ransomware. Behind that number are practices that lost access to their schedule, their charts and their imaging, often for days.

What a ransomware attack means under HIPAA

HHS guidance says that when ransomware encrypts ePHI, it is presumed to be a breach. You can only avoid notifying patients if a documented risk assessment shows a low probability that the information was compromised. Without logs that show what the attacker did and didn't touch, that is very hard to show. So security for a practice has two goals: stop the attack, and keep the evidence you'll need if one gets through.

The protections we put in place

• Multifactor authentication on email, remote access, the EHR where supported and every administrator account. Stolen passwords are the most common way in, and MFA stops most of those attempts.
• Managed endpoint detection and response (EDR) on every workstation and server, watched by people who can isolate a machine when something looks wrong, not just a dashboard nobody checks.
• Email security that filters phishing, impersonation and malicious attachments, with banners on outside mail and an easy way for staff to report suspicious messages.
• Patching for Windows, browsers and common applications on a set schedule, with exceptions documented for medical devices that can't be updated.
• Network segmentation so imaging devices, guest Wi-Fi and business systems can't freely talk to each other. If one is compromised, the damage is contained.
• Least-privilege access, so staff use everyday accounts and administrator rights are separate and rare.
• Logging and alerting for sign-ins, administrator activity and security events, kept long enough to support an investigation.
• Security awareness training with short, regular lessons and simulated phishing, plus records that satisfy the training requirement at 164.308(a)(5).

Remote access and vendors

Many practices let EHR vendors, imaging companies and billing services connect remotely. Each connection is a door. We inventory every remote access tool, remove the ones no one uses, put MFA on the rest and make sure vendor access is turned on only when needed and logged when used.

When something happens

If an incident occurs, we contain it first: isolate affected machines, disable compromised accounts and protect the backups. Then we preserve logs and gather the facts you'll need for your breach risk assessment. We work with your attorney and cyber insurance carrier, who usually appoint their own forensic firm, and we bring your systems back from clean backups. We don't make notification decisions for you, but we give you the technical facts to make them.

Cyber insurance

Insurers now ask detailed questions before they write or renew a policy: Do you use MFA? Do you have EDR? Are backups isolated? Do you train staff? We help you answer accurately, because a wrong answer on an application can create problems with coverage when you need it most.

Recognized security practices

A 2021 amendment to the HITECH Act directs HHS to consider whether a practice had recognized security practices in place for the prior 12 months when it decides on penalties and audit outcomes. Frameworks such as the NIST Cybersecurity Framework and the HHS 405(d) Health Industry Cybersecurity Practices qualify. We align your safeguards with the 405(d) practices for small and medium organizations and document them, so the work counts in your favor.

Questions about cybersecurity & ransomware