by Bethany Page Ishii
Quick answer (what to do before + during the first day)
- Pre-assign leadership roles (incident commander, security lead, IT ops, clinical ops, comms, legal counsel, compliance/privacy) and practice the handoffs.
- Decide up front what ‘care continuity’ means for your organization (downtime thresholds, critical apps, critical vendors, restore order).
- Plan for containment and evidence discipline: capture key logs and decisions as you isolate systems — ideally under attorney-client privilege where applicable.
- Assume third parties will be involved (EHR, MSP/MSSP, cloud/SaaS, medical devices, cyber insurance carrier/broker, outside breach counsel, and law enforcement) and define engagement paths.
- Use a time-boxed checklist for the first 24 hours so leaders know what’s next, even with incomplete information.
- Know your ransom-payment decision path before it’s needed — OFAC sanctions screening, law enforcement notification, and named decision authority.
Why ransomware is different in healthcare
Ransomware response in healthcare is not only a security event—it’s an operational continuity event. When clinical workflows, registration, lab/radiology interfaces, and revenue cycle systems degrade, the business impact escalates quickly. That’s why the best ransomware preparedness programs focus on decision-making, roles, and recovery priorities, not just technical controls.
Frameworks like NIST CSF 2.0 (the Respond and Recover functions) and the HHS 405(d) Health Industry Cybersecurity Practices (HICP) give this structure a shared vocabulary that boards, auditors, and regulators already recognize.
Preparedness starts with role clarity (who decides what)
Many incident plans fail when the organization is under stress because the decision owners are unclear. Assign roles and decision rights in advance—and practice them in a tabletop.
[table “” not found /]
First 24 hours checklist (healthcare-focused)
This checklist is designed to help leaders move from ‘chaos’ to ‘controlled response.’ You will not have perfect information on day one—so the goal is to set a stable operating rhythm, contain safely, and protect care continuity.
[table “” not found /]
Communication decisions: be clear, be consistent
- Use a single ‘source of truth’ channel for internal updates (and designate who writes them).
- In executive updates, separate facts from hypotheses and unknowns.
- Avoid overpromising timelines—anchor on next update time and current priorities.
- Track decisions and approvals (what was decided, by whom, when, and why).
What to have ready before an incident (minimum viable readiness)
- A documented restore order for critical systems (clinical + business).
- At least one recent restore test for each critical system class, including verification that immutable/offline backups are isolated from the production domain—and a record of results.
- A vendor/third-party contact tree (who to call, how to escalate, what info to request), including your cyber insurance broker and outside legal counsel.
- An incident log template (decisions, actions, evidence captured, timestamps).
- A tabletop cadence (annually is a common starting point) with clear improvement owners.
- Clinical staff proficiency with EHR downtime (paper) procedures, using Business Continuity Access (BCA) machines, and validated through drills rather than assumed.
FAQ
What’s the #1 mistake in first-day ransomware response?
Not establishing decision ownership and cadence early. Without a stable operating rhythm, teams duplicate work and miss critical dependencies.
Should we ‘shut everything down’ immediately?
Containment needs a plan. Some isolation actions can protect systems; others can break recovery paths. Pre-approved containment playbooks help avoid risky improvisation.
How do we prioritize restoration in healthcare?
Prioritize care continuity and safety first, then restore supporting services and revenue cycle. Define this order in advance so it doesn’t become a debate mid-incident.
Do we need a tabletop if we have an incident response plan?
Yes. Tabletop exercises expose the real gaps: unclear roles, missing vendor contacts, untested restores, and conflicting decision criteria.
What should executives expect in the first hour?
A short brief: what is impacted, what actions are underway, who is accountable, and when the next update will be delivered.
How do we involve third parties effectively?
Predefine who contacts which vendor, what information you need (logs, access details, status), and how decisions are coordinated across parties.
Should we pay the ransom?
There’s no universal answer, but the organization should establish its position on whether it is willing to pay a ransom before a ransomware event occurs. If payment remains a possibility, the decision process should also be predefined: confirm OFAC sanctions screening on the threat actor or cryptocurrency wallet, involve law enforcement and outside counsel, and designate the executive with final decision-making authority. Determining whether to pay—and how that decision will be made—during an active incident, under pressure and with incomplete information, is where organizations make costly mistakes.
Do we need to assume a HIPAA breach occurred?
HHS guidance presumes a breach when ransomware affects systems containing PHI, unless a documented 4-factor risk assessment demonstrates a low probability that PHI was compromised. Build this assessment into your Compliance/Legal workflow rather than reasoning it out mid-incident.
About the Author
Bethany Page Ishii
VP of Cybersecurity Strategy & Advisory
Bethany is a seasoned cybersecurity and risk management executive with nearly 2 decades of experience spanning security consulting, operational leadership, and customer success. She leads a portfolio that includes Security Risk Assessments, GRC, Resiliency, HITRUST, Offensive Security Services, and Strategic Advisory, bringing together strategic vision and hands-on execution to help healthcare organizations strengthen their security and compliance posture.
Bethany also spent 5 years as a CISO, directing data security and threat response programs, and lead her organization through its first SOC 2 Type II. She later played a key role at CORL Technologies, focusing on customer success, strategy, and delivery of Third Party Risk Management (TPRM) services.
Over the course of her career, Bethany has worked with hundreds of healthcare organizations, assessing security, compliance, and risk management maturity and guiding clients toward practical, sustainable improvements. Her approach combines practitioner experience with consulting insight and a steadfast commitment to client relationships.