Most small practices do not lose patient data because they lack tools. They lose it because nobody knew who to call, what to disconnect, or how to prove what happened.
Ask a practice owner what they would do if the front desk arrived Monday morning and the schedule, imaging, and charts would not load. The honest answer is usually some version of "call our IT guy." That is a phone number, not a plan.
Cybersecurity incident response in healthcare is the set of decisions you make under pressure: how you detect something is wrong, how you contain it without destroying evidence, how you determine whether electronic protected health information was actually accessed or acquired, how you notify patients and HHS if it was, and how you get back to seeing patients. Each of those steps has a different owner, a different clock, and a different failure mode. Practices that have not worked through them ahead of time tend to improvise badly, and improvisation is expensive.
The numbers explain why this keeps landing on small practices. Healthcare accounted for roughly 7% of global breach counts in 2023 but about 31% of all exposed records, meaning healthcare incidents are unusually data-rich. In the first half of 2023 alone, roughly 40 million healthcare records were compromised. And the burden is not concentrated at the top: providers with fewer than 50 employees experienced about three times the breach rate of large providers in 2023, while practices in the 50 to 500 employee range accounted for roughly 70% of healthcare breaches. Attackers are not skipping the independent dental group, the retina practice, or the ambulatory surgery center. They are starting there.
There is also a timing problem specific to healthcare. Clinical operations do not tolerate downtime well. When e-prescribing, imaging, and documentation are unavailable, the pressure to restore quickly collides with the need to investigate carefully. Restore too fast from an unknown-good backup and you may reinfect yourself or erase the evidence you need to determine breach scope. Move too slowly and you cancel a week of appointments. Good ransomware response for a medical practice is the discipline of doing both correctly, in the right order.
HIPAA adds a second clock. Under the Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI, notify the HHS Secretary, and, when more than 500 individuals in a state or jurisdiction are affected, notify prominent media outlets. That 60-day window starts at discovery, not at the moment you finish your investigation. If your forensic picture is still unclear on day 45, you are making notification decisions with incomplete facts.
If you cannot name who declares an incident at your practice, you do not have incident response yet. You have hope.
A practical walkthrough of the five phases of cybersecurity incident response for healthcare, what small practices usually get wrong in each one, and the specific questions to ask whoever supports your systems.
**Preparation and detection.** You cannot respond to what you never see. Most small practice breaches are not discovered by the practice; they are discovered when files stop opening, when a patient reports a strange email, or when a bank flags a fraudulent transfer. That is late. Meaningful detection means someone is actually watching endpoint alerts, email sign-in activity, and unusual administrative changes, and that someone is reachable outside business hours. Ask directly: who monitors our alerts at 9 p.m. on a Saturday, and what do they do when one fires? If the answer is "the software sends an email," nobody is monitoring. Email remains the dominant entry point, which is why email security for healthcare practices and ongoing phishing risk reduction for healthcare employees belong in the same conversation as response planning.
**Containment.** The instinct to unplug everything is not always wrong, but it should be a decision, not a reflex. Containment in a medical office means isolating affected endpoints from the network while preserving their memory and disk state, disabling compromised user accounts and revoking active sessions, rotating credentials for administrative and remote access, and confirming whether backups are reachable from the compromised network. That last point matters enormously. Ransomware operators routinely target backup repositories first. A backup that was connected to the same domain with the same credentials is frequently encrypted alongside production data. If you have never tested a restore, you do not know your recovery time; you know your vendor's marketing claim.
**Investigation and scope determination.** This is where HIPAA and cybersecurity diverge, and where practices most often stumble. Under the Breach Notification Rule, an impermissible acquisition, access, use, or disclosure of unsecured PHI is presumed to be a reportable breach unless the covered entity demonstrates a low probability of compromise through a documented four-factor risk assessment covering the nature and extent of the PHI, who accessed it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated. You need logs to make that argument. Practices that keep 30 days of email logs and no endpoint telemetry often cannot prove data was not taken, which means they notify by default. Log retention is a breach-cost decision disguised as a storage decision. Your HIPAA security risk analysis should surface those gaps before an incident does, and unpatched, internet-facing systems identified through vulnerability management are a common root cause worth closing in advance.
**Notification and regulatory handling.** Beyond HIPAA's 60-day individual notice requirement and HHS reporting, most states impose their own breach notification obligations with shorter timelines, and your cyber insurance policy almost certainly requires prompt notice and may require you to use panel counsel and an approved forensics firm. Calling your own vendor first can jeopardize coverage. Know that before you need it. Engaging breach counsel early also helps structure the investigation under privilege.
**Recovery and after-action.** Recovery is not "systems are back." It is verified clean rebuilds, credential resets across the whole environment, restored clinical workflows, and confirmation that the original entry point is closed. Then write down what happened and what you changed. The practices that get hit twice are usually the ones that restored operations and never fixed the door.