Ransomware readiness for medical and dental offices

How attacks on small medical and dental offices usually start

Ransomware rarely starts with anything clever. In small practices, the entry points are usually ordinary:

• Phishing. A front-desk or billing staff member opens an attachment or enters a password on a fake sign-in page. The attacker now has a working email account and often access to everything that account can reach.
• Exposed remote access. Remote desktop or a remote support tool is reachable from the internet and protected only by a password. Attackers scan for these constantly and try leaked or guessed passwords.
• Unpatched systems. A server, firewall or VPN device has a known vulnerability that was never updated. Edge devices are a common target because they face the internet.
• Stolen vendor credentials. A software or IT vendor's account that can reach your network gets compromised, and the attacker uses it to get in.

Once inside, attackers typically look for backups and administrator accounts before they encrypt anything. Many also copy patient data first so they can threaten to publish it. Restoring files is only part of readiness. You also need to limit what an attacker can reach and be able to tell what was taken.

Backups that survive an attack

Plenty of offices have backups. Fewer have backups that an attacker cannot delete. If your backup drive is mapped as a network drive on the server, or your backup console uses the same administrator password as everything else, assume ransomware can reach it.

A backup setup worth relying on has these traits:

1. At least one copy is offline or immutable. Offline means disconnected from the network. Immutable means the storage will not allow changes or deletion for a set period, even by an administrator.
2. Separate credentials. The backup system uses its own accounts, with MFA, and does not share your everyday administrator account.
3. It covers what you actually need. This includes practice management and EHR data, imaging, scanned documents, accounting, and the configuration needed to rebuild servers. If your EHR is cloud-hosted, confirm in writing what the vendor backs up and how fast they can restore it.
4. Restores are tested. Pick a date each quarter, restore a real system or database to a test location, and time it. Write down how long it took.
5. Someone checks the job results. Backups that fail quietly for months are common, and a regular check catches them.

The restore test is easy to put off. It is also the only step that tells you whether you could reopen in a day or in two weeks.

Turn on MFA everywhere it matters

Multi-factor authentication blocks many attacks that start with a stolen password. Turn it on in this order:

• Email (Microsoft 365 or Google Workspace) for every user, including the owner and part-time staff
• Remote access of any kind, including VPN and remote desktop
• Administrator accounts on servers, firewalls and cloud consoles
• The backup system
• EHR, practice management, clearinghouse and banking portals that support it

Where the system allows it, use an authenticator app or a security key instead of text messages. Shared front-desk logins make MFA difficult and make investigations harder. If staff share an account today, moving everyone to individual accounts is worth the effort.

Patching and the systems nobody owns

Patching only works when a specific person is responsible for it. Start with a simple list:

• Every computer and server, its operating system, and whether it still receives security updates
• Internet-facing devices: firewall, VPN, any remote access gateway
• Line-of-business software, including imaging software that sometimes requires an older operating system

Set a target of applying critical updates to internet-facing systems within days, not months. CISA publishes a Known Exploited Vulnerabilities catalog at cisa.gov, which is a practical way to decide what to patch first.

Some older systems cannot be updated, such as an imaging workstation tied to a specific device. For those, the usual answer is isolation. Network segmentation keeps those machines, along with printers, smart TVs and other connected devices that share the network, separated from the systems that hold patient records. Our segmentation guide explains the approach, and network security covers how we design it.

Vendor and remote access

Small practices often have several outside parties with remote access: an IT provider, the EHR or practice management vendor, an imaging vendor, a phone system vendor. Each one is a way into your network.

Use this checklist:

• List every vendor with remote access and the tool they use
• Remove access for vendors you no longer work with
• Require MFA on vendor accounts, with individual accounts for each person instead of one shared login
• Turn vendor access on when it is needed instead of leaving it always open
• Confirm Business Associate Agreements are in place where vendors handle patient data
• Ask each vendor how they would notify you of an incident on their side

Who to call, decided ahead of time

During an incident, nobody should be searching for phone numbers. Keep a printed contact sheet somewhere other than the network that might be encrypted. It should include:

• Your cyber insurance carrier's claims or breach hotline. Many policies expect you to call them first and use their approved responders.
• Your attorney or privacy counsel, for notification decisions
• Your IT provider and key software vendors
• Your bank, if payment accounts may be affected
• Law enforcement: the FBI, through a local field office or the Internet Crime Complaint Center (IC3)

Also decide in advance how the office will run while systems are down. Plan for paper intake forms, a recent printed schedule, and a way to reach patients. Our incident response plan guide explains how to write this down. A short tabletop exercise is the best way to find the gaps. See incident response readiness.

How this supports HIPAA Security Rule work

The HIPAA Security Rule requires covered entities and business associates to perform a risk analysis. It also requires contingency planning, including a data backup plan, a disaster recovery plan and an emergency mode operation plan. The work above supports those requirements. It does not by itself mean an office meets them, and this guide is not legal advice.

On breach notification, HHS has published guidance stating that a ransomware incident affecting protected health information is presumed to be a breach unless the practice can show a low probability that the information was compromised. Notification decisions and timelines depend on the facts, so involve counsel early. HHS guidance on both topics is available at hhs.gov.

Practices in Santa Barbara, Goleta and across the Central Coast can book a free security consult or call (805) 800-8163 to talk through where they stand. A security risk assessment puts the findings in writing.