Ransomware readiness for a clinic
Small practices are targeted precisely because they are small. Almost every case comes through the same three doors — and closing them is cheaper than you would expect.
Small practices are targeted precisely because they are small: real money, real data, and rarely a full-time security team. Almost every case arrives through the same three doors, and closing them costs far less than most owners expect.
The three doors
| Stolen credentials | A password phished or reused from a breach elsewhere. Defeated almost entirely by MFA. |
|---|---|
| Exposed remote access | Remote Desktop or a management interface reachable from the open internet. Scanned and attacked continuously, automatically. |
| Unpatched software | A known vulnerability in a VPN appliance, firewall, server or plugin, months after a fix shipped. |
Note what is not on the list: sophisticated novel attacks. This is overwhelmingly opportunistic, and the controls below are correspondingly ordinary.
The checklist
MFA on everything reachable from outside
Email, VPN, EHR, remote access, and any administrator account. This is the single highest-value control — see Password managers and MFA.
Get RDP off the internet
If staff need remote access, put it behind a VPN or a zero-trust broker. Remote Desktop exposed directly to the internet is the most reliable way to be compromised.
One offline or immutable backup copy
Attackers look for and encrypt backups first. A copy they cannot reach or alter is what determines whether you recover or pay — see Backups and recovery.
Patch on a schedule
Operating systems, firewalls, VPN appliances, EHR clients, browsers. Put a recurring date in the calendar with a named owner.
Remove local administrator rights
Day-to-day accounts should not be able to install software. This alone stops a large share of malware from getting a foothold.
Separate the clinical network
Guest Wi-Fi must not reach clinical systems. Nor should the smart TV, the security cameras or the thermostat.
Turn on reputable endpoint protection
Modern behaviour-based tooling on every workstation and server, actually reporting somewhere someone reads.
Test the restore
Untested backups fail exactly when you need them. Restore something real, twice a year, and write down how long it took.
The first hour
Isolate
Disconnect affected machines from the network immediately. If spread is rapid, disconnect the practice internet at the router.
Call for help
Your IT provider and your cyber insurer, in that order. Insurers frequently require notification before you engage anyone — calling the wrong person first can void cover. Know the number in advance.
Preserve everything
Do not delete the ransom note, do not wipe machines, do not start reinstalling. Photograph screens. Note times.
Switch to paper
You have downtime procedures for this. Keep seeing patients. Assume systems are unavailable for days, not hours.
Start the breach assessment
Ransomware involving PHI is presumed to be a breach unless you can demonstrate low probability of compromise. Deadlines are real: individuals within 60 days, HHS within 60 days, and media notification for incidents affecting 500 or more. Begin documenting immediately.
Prepare the things you cannot improvise
- A printed contact list — IT, insurer, counsel, EHR vendor, key staff. It is useless in an encrypted file.
- Your cyber insurance policy number and the incident hotline, also printed.
- Downtime clinical procedures your staff have actually practised.
- A short patient communication drafted in advance.
- A named decision-maker, and a deputy for when they are unreachable.
FAQ
We are a five-person practice. Are we really a target?
Yes — and not personally. Attacks are automated and indiscriminate; small healthcare organisations are attractive because they hold valuable data, cannot tolerate downtime, and often lack the controls above. Size is not cover.
Is cyber insurance worth it?
For most practices, yes — largely for the incident response it brings: forensics, legal counsel and breach notification handled by people who do it constantly. Read the conditions carefully: many policies require MFA and tested backups, and claims have been reduced where those were absent.
Our EHR is cloud-hosted. Does that protect us?
It helps considerably — the clinical data is not sitting on a server in your closet. But your workstations, email and local files remain exposed, and a compromised staff account can still reach the cloud EHR. It reduces the blast radius; it does not remove it.