Healthcare Ransomware Defense: The Controls Your Practice Should Have Documented

Your cyber insurance renewal, your HIPAA risk assessment, and your daily schedule all depend on one question. If ransomware reached your systems this week, could your practice keep operating, and could you show which controls were in place?

A day of downtime is a day of appointments you do not get back. This guide covers the healthcare ransomware defense controls, backups, and downtime procedures your practice should have in place, and written down, before anyone asks.

Key takeaways

• Ransomware is an operations problem first. It stops your electronic health record (EHR), schedule, phones, and billing together.
• The HIPAA Security Rule already requires a contingency plan with a data backup plan, a disaster recovery plan, and an emergency mode operation plan.
• Your cyber insurance renewal is likely to ask about MFA, endpoint detection and response (EDR), and backups, and it will want the answers in writing.
• A backup you have not restored is an assumption. Keep dated records of every restore test.
• Separate backups, administrator accounts, vendor access, and connected equipment from everyday systems, so one infected computer does not become an outage.
• Write down who decides what during an incident. Your clinical leaders decide clinical workflows, and the IT steps belong in the same plan.
• The Department of Health and Human Services (HHS) presumes a breach when ransomware encrypts electronic protected health information (ePHI), unless you can show a low probability of compromise. Records make that showing possible.

Why ransomware is an operations problem for your practice

Your EHR, scheduling system, phones, billing software, and patient messaging all depend on the same network. When ransomware locks those systems, the schedule stops with them.

The HHS treats ransomware on your systems as a security incident under the HIPAA Security Rule. When ransomware encrypts ePHI, HHS presumes a breach. You can rebut that by showing a low probability that the information was compromised, as its ransomware and HIPAA fact sheet explains. HHS calls the question fact-specific.

Your compliance lead and counsel make that call. They can only make that determination with reliable records.

What the HIPAA Security Rule already requires

The Security Rule's contingency plan standard is not new, and it applies to every covered entity. It requires three written pieces:

• A data backup plan, meaning procedures to create and maintain retrievable exact copies of ePHI.
• A disaster recovery plan, meaning procedures to restore any loss of data.
• An emergency mode operation plan, meaning procedures to continue critical business processes while systems are down.

Testing and revision of that plan is an addressable specification. Addressable does not mean optional. You either implement it or document why not and what you did instead.

The rule also requires you to identify and respond to security incidents, and to document each incident and its outcome. You can read the full contingency plan standard in 45 CFR 164.308 on eCFR.

The controls your insurer and examiner expect in writing

Your cyber insurance renewal is likely to ask about MFA, EDR, and backups, and it will want the answers in writing. Your HIPAA risk assessment covers the same ground. Here is what to have in place, and what to keep on file for each control.

MFA

Require MFA on email, remote access, your EHR, and every administrator account. Keep a record of where it is enforced. For any system where it is not, record the reason.

Our post on why identity has become your organization's new security perimeter covers the thinking behind these controls.

Endpoint detection and response

EDR software watches workstations and servers for ransomware behavior and can isolate an affected device quickly. Keep a current list of the devices it covers.

Patching and administrator access

Patch internet-facing systems and known exploited vulnerabilities promptly. Limit administrator rights to the people who need them, and remove accounts nobody uses. Record patch dates so you can show them.

Email protection and staff reporting

Your staff are your first detection layer. Give them one simple way to report a suspicious email or login request, and train them on it. The Security Rule expects a security awareness and training program for your whole workforce, management included.

Network separation

Keep guest Wi-Fi, office computers, and connected equipment such as imaging devices and lab interfaces on separate network segments. If a device cannot be updated, isolate it and ask the vendor for an update or replacement plan. Keep a current network diagram that your IT provider or examiner can review.

Vendor and business associate access

Your EHR vendor, billing company, and IT provider each have a path into your systems. Require MFA for vendor remote access, and grant each vendor access only to the systems it supports. Remove old vendor accounts. Keep a list of vendors with a business associate agreement (BAA) on file.

Our post on third-party cyber risk in 2026 looks at what happens when a vendor's breach becomes your problem.

Backups: keep one copy ransomware cannot reach

A backup you have not restored is an assumption. Attackers can reach backups that share credentials or network access with your everyday systems.

Protect backup administration with separate credentials. Keep at least one immutable or offline copy, meaning a copy that nobody can change or delete from your normal environment.

Then restore a real system on a schedule you set. Record the date, the system, how long it took, and whether it worked. Those dated results are evidence your controls work, not just a statement that they do.

Our guide on why backup alone is not a recovery strategy looks at backups and recovery in more depth.

Downtime procedures that keep your schedule moving

Your emergency mode operation plan answers one question. What do your front desk and back office do while the EHR is unavailable?

A written plan covers these items:

• A printed or offline copy of the next day's schedule.
• Paper intake and encounter forms, and where they are stored.
• Alternate phone and messaging contacts for staff and vendors, stored outside your network.
• Who tells patients about delays, and how.
• How staff record work done during downtime and enter it afterward.
• Who decides when to switch to downtime mode, and when to switch back.

Clinical downtime planning belongs to your physicians and clinical leaders, who decide how care continues. The technology side belongs in the same written plan, so nobody searches for it during an outage. Practice the plan once before you need it.

Incident response: decide who does what before it happens

Write down who declares an incident, who isolates affected devices, and who calls your IT provider, your cyber insurer, and your counsel. Store that contact list somewhere you can reach without your network.

Plan to isolate affected devices, not to shut down everything. A blanket shutdown can interrupt appointments in progress. Decide in advance who confirms with your clinical lead before a high-impact system is disconnected.

Keep an incident log, even for incidents that turn out to be minor. The Security Rule requires you to document each one.

Recovery order: decide it before you need it

Restoring systems in the wrong order leaves you with software that runs but cannot connect to anything. Agree on the order now, and have your physicians review it. An example sequence looks like this:

• Network, identity, and authentication services.
• Your EHR and scheduling system.
• Phones and patient messaging.
• Imaging and lab connections.
• Billing and other administrative systems.

Your order will differ. What matters is that you wrote it down before the incident.

What to keep on file

Use this table as a starting point for your own documentation.

What KairosIT delivers

KairosIT delivers documented, HIPAA-aligned IT controls, insurable security controls, and uptime that protects your schedule.

Our compliance IT services cover the documentation and evidence behind these controls.

The KairosIT Compliance Readiness Assessment is a structured evaluation of your security posture, backup integrity, and regulatory documentation gaps, including an inventory of the AI tools your staff is actually using. You finish with a written findings report you can act on, whether or not you work with us.

KairosIT does not provide formal compliance attestation or certification. The Assessment supports your compliance efforts. It does not replace your compliance officer or legal counsel.

Can your practice document its healthcare ransomware defense? Start with KairosIT

The KairosIT Compliance Readiness Assessment is a structured evaluation of your security posture, backup integrity, and regulatory documentation gaps. You finish with a written findings report you can act on. Book Your Compliance Readiness Assessment.