How to Prevent Ransomware Attacks in Healthcare: A Step-by-Step Tutorial

How to Prevent Ransomware Attacks in Healthcare: A Step-by-Step Tutorial

Author Jake Yates at Healthcare Compliance Pros

Ransomware remains one of the most disruptive cybersecurity risks for healthcare organizations today. A successful attack can take down electronic health records (EHR) systems, interrupt scheduling and billing systems, delay communications, impair clinical workflows, and expose electronic protected health information (ePHI).

For healthcare providers, ransomware prevention is not only an IT responsibility. It is a patient safety, business continuity, and HIPAA compliance responsibility. The HIPAA Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI) through reasonable and appropriate administrative, physical, and technical safeguards.[1]

This blog article outlines practical healthcare cybersecurity steps for clinics, hospitals, medical practices, and business associates seeking to prevent ransomware attacks in healthcare in the digital age.

Why Healthcare Is a Top Ransomware Target in 2026

Healthcare organizations hold valuable information. It has been said that a medical record is worth over $100/record on the black market, while a date of birth, social security number, and name are worth less than $1 each. No wonder threat actors want to get their hands on this data! Healthcare organizations also rely on time sensitive operations and often support a complex mix of EHRs, cloud applications, legacy systems, medical devices, remote users, billing platforms, laboratories, imaging systems, and third-party vendors.

Attackers know that healthcare downtime can create urgency and pressure to restore systems. When an organization cannot access clinical documentation, prescriptions, referrals, patient communications, or scheduling tools, the operational impact can escalate quickly, and in some cases lead a healthcare organization to actually pay the ransom. But remember, paying the ransom is not a guarantee the threat actor will return your data. Ransomware is no longer limited to file encryption. Threat actors can steal sensitive data before deploying encryption, threaten to publish data, abuse compromised email accounts, disable security tools, delete backups, or use stolen credentials to move through the network.

The Department of Health and Human Services (HHS) explains that ransomware and other forms of malware are classified as security incidents under the HIPAA Security Rule and may result in impermissible disclosures of PHI. In many situations, ransomware involving PHI is presumed to be a reportable breach unless the organization can demonstrate a low probability that PHI was compromised using the required risk assessment.[2]

The strongest approach is a layered defense. No individual safeguard can prevent every ransomware event, whether it is an antivirus product, employee training course, firewall, or backup platform. A resilient organization combines people, processes, technology, documentation, and tested recovery procedures.

Step 1: Implement a Robust Backup and Recovery Strategy

Backups are essential because prevention controls can fail. An employee may click a malicious link, an attacker may exploit an unknown vulnerability, or a vendor account could be compromised. The organization's ability to restore critical systems safely and quickly may determine whether a cyber incident becomes a manageable disruption or a prolonged operational crisis.

A useful framework is the "3-2-1 Backup Rule", a common information technology backup resilience practice:

• Maintain at least three copies of critical data.
• Store the copies on at least two distinct types of media or storage platforms.
• Keep at least one copy offline, immutable, or otherwise isolated from the production environment.

An isolated backup is important because attackers increasingly target backup systems. If an attacker compromises an administrator account and can access production servers, cloud storage, backup consoles, and backup credentials, ordinary backups may be encrypted or deleted along with the primary environment.

The CISA Stop Ransomware Guide[3] recommends maintaining offline, encrypted backups and regularly testing restoration to confirm that data can actually be recovered.

Identify what must be restored first

Not every application has the same operational urgency. Healthcare organizations should identify systems that are essential for patient care, safe operations, and communications, such as:

• EHR and practice management platforms
• Medication, laboratory, imaging, and pharmacy systems
• Identity management services and domain controllers
• Scheduling, telehealth, and patient communication platforms
• Billing and revenue cycle systems
• Secure messaging, telephone, and emergency communication tools
• Backup infrastructure and security management platforms

For each system, document a recovery time objective (RTO) and recovery point objective (RPO). The RTO identifies how quickly a system must be restored. The RPO identifies how much data loss may be acceptable. A system used for medication administration may require a short recovery target while a non-critical archive may have a longer target.

Here is a basic backup and recovery checklist you can use to confirm if you have a good plan in place:

• Encrypt backup data at rest and in transit.
• Use separate administrative accounts for backup platforms.
• Limit backup administrator privileges.
• Maintain an offline, immutable, or otherwise isolated backup copy.
• Test file level, application level, and full system restoration.
• Document restoration procedures and escalation contacts.
• Review backup alerts, failures, and exception reports.
• Include cloud applications and software-as-a-service (SaaS) data in the backup strategy.
• Validate that the recovery environment is free of malware before restoring production systems.

A backup that has never been restored is an assumption, not a proven recovery capability.

Step 2: Educate and Train Staff

Ransomware often begins with human interaction. Phishing messages, fraudulent password-reset alerts, fake invoices, malicious attachments, phone scams, and impersonation attempts are designed to persuade employees to reveal credentials or run malicious files.

The HIPAA Security Rule requires covered entities and business associates to implement a security awareness and training program for all workforce members, including management.[4]

However, annual training alone is rarely enough. Effective training should be short, recurring, realistic, and aligned with actual healthcare workflows.

Train for realistic healthcare threats

Staff should know how to recognize these key threat styles and types:

• Messages that create urgency around payroll, benefits, invoices, credential expiration, or patient records
• Unexpected attachments disguised as referrals, scanned faxes, laboratory reports, or insurance documents.
• Emails impersonating an executive, EHR vendor, IT employee, payer, or business associate.
• Repeated multi-factor authentication prompts intended to pressure users into approving a fraudulent login.
• Requests to bypass normal verification procedures.
• Unexpected requests for PHI, remote access, payment changes, passwords, or security codes

Covered entities and business associates should run simulated phishing exercises using scenarios that reflect real employee roles. For example, the front office staff may receive a simulated referral or appointment messages while the billing staff may receive simulated payer communications. The purpose is to identify patterns and improve behavior, not to embarrass staff.

Here is a brief workforce training checklist that can help you determine if what you have fits the basic needs for a healthcare organization:

• Provide security training during onboarding.
• Provide reinforcement training throughout the year.
• Provide a more in-depth refresher training for all staff annually.
• Include executives, clinicians, temporary workers, contractors, and remote personnel.
• Run phishing simulations and track trends.
• Provide immediate and constructive follow-up after failed simulations.
• Make suspicious message reporting easy and highly visible.
• Train staff to report quickly after a click or credential entry.
• Keep training attendance, content, and remediation records.

A positive reporting culture is a critical defense. Employees need to understand that reporting a mistake quickly is safer than hiding it. Early reporting may allow IT teams to isolate a device, reset credentials, revoke sessions, and prevent lateral movement.

Step 3: Keep Systems and Software Up to Date

Unpatched vulnerabilities remain a major ransomware risk. Healthcare organizations may face real patch management constraints including clinical validation needs, legacy applications, vendor-controlled systems, medical device limitations, and downtime concerns. Those challenges require a risk-based patch process rather than an informal "patch when possible" approach.

Begin with a complete ePHI asset inventory. An organization cannot secure technology it does not know exists. The ePHI asset inventory should include all physical devices, virtual machines, cloud applications, operating systems, mobile devices, remote access tools, EHR components, network equipment, connected medical devices, AI services, and vendor supported systems that create, receive, maintain, or transmit ePHI of any kind. Even your website host should also be evaluated and added to the list if needed.

HHS describes the Security Risk Analysis as the first step in HIPAA Security Rule compliance and explains that it should be an ongoing process used to identify risks, vulnerabilities, and needed security updates.[5]

Start by creating a patch management workflow. This workflow should:

1. Maintain an accurate ePHI Asset Inventory
2. Assign each system an owner and business criticality rating.
3. Identify whether the system stores, processes, transmits, or supports ePHI.
4. Monitor vendor notices, security advisories, and government alerts.
5. Prioritize internet facing systems and vulnerabilities known to be actively exploited.
6. Test updates when required by clinical, vendor, or operational constraints.
7. Apply updates within documented risk-based timelines.
8. Record patch exceptions, compensating controls, ownership, and remediation deadlines.
9. Confirm that patches were successfully installed.

CISA's Known Exploited Vulnerabilities Catalog[6] identifies vulnerabilities confirmed to be exploited in the wild and should be incorporated into an organization's vulnerability prioritization process.

Medical devices especially require specific planning. Coordinate with biomedical engineering, IT, clinical leadership, and the manufacturer before patching or modifying device configurations. When prompt patching is not possible apply compensating controls such as segmentation, restricted access, additional monitoring, and removal of unnecessary internet connectivity.

Step 4: Enforce Multifactor Authentication and Access Controls

Multifactor authentication (MFA) requires more than one method of verification before access is granted. Common examples include a password plus an authenticator application, hardware security key, biometric factor, or approved push notification.

MFA is not a complete solution, but it substantially reduces the risk that a stolen password alone will provide access to email, remote access, cloud storage, or administrative systems. Healthcare organizations should prioritize MFA where compromise would have the greatest impact. The importance of enabling MFA when interacting with sensitive data cannot be overstated! It should be a requirement for all high-risk systems.

If you are not sure where to start, here is a helpful list of common place MFA should be enabled:

• Remote access tools and virtual private networks (VPNs)
• Email and cloud productivity platforms.
• EHR administration and high-risk clinical applications
• Privileged IT accounts
• Backup management systems
• Security consoles
• Billing, payroll, and financial systems
• Third-party and vendor remote support connections

The HIPAA Security Rule requires technical access controls and procedures to ensure that only authorized users receive access to ePHI.[7] Require a username and strong password alongside MFA. Each user should have only the access necessary for their role. A receptionist should not have the same system permissions as the EHR administrator and a routine IT account should not be used for high level administrative work.

Here is a quick access control checklist to help you see how you are doing:

• Require unique user accounts.
• DO NOT permit shared credentials.
• Separate routine accounts from privileged administrator accounts
• Remove access promptly after termination or role changes.
• Review user access routinely.
• Limit local administrator permissions.
• Protect administrator accounts with strong MFA.
• Disable stale vendor and contractor accounts.
• Log and review elevated risk access activity.
• Establish a secure process for account recovery and password resets.

Step 5: Segment Networks and Restrict Access

Network segmentation reduces the likelihood that a compromise in one area will spread throughout the organization. Without segmentation, ransomware introduced through a front desk workstation may reach file servers, backups, clinical systems, imaging platforms, or medical devices.

Segmenting clinical systems, administrative systems, guest Wi-Fi, biomedical devices, backups, security tools, and third-party connections should be done wherever it is feasible. The objective is to restrict communications to only the systems and services required for legitimate work and business needs. CISA recommends segmentation as a ransomware defense because it can limit an attacker's ability to move laterally across the network.[8]

Use Practical Zero Trust Principles

Zero Trust means verifying access rather than automatically trusting a device simply because it is connected to the internal network. In practice, which may include checking the user's identity, device security status, role, location, and requested resource before allowing access.

Here are some manageable controls most healthcare organizations can start with little or no cost or experience:

• Separate guest networks from internal networks
• Restrict workstations to required applications and servers.
• Isolate backup infrastructure from normal user networks
• Limit medical device communications to required destinations.
• Control and monitor vendor remote access sessions.
• Block unnecessary traffic between clinical and administrative network segments.
• Review firewall rules and network diagrams regularly.

Now this one is important: Keep documentation current! You never know what tomorrow may bring so it is important to have documentation showing what is done and where to find the right information if changes are required. Network diagrams, system ownership records, firewall rule approvals, and access decisions are valuable evidence during risk analyses, incident investigations, insurer reviews, and HIPAA audits.

Step 6: Deploy Endpoint Detection and Response

Endpoint detection and response (EDR) tools monitor computers and servers for suspicious activity. They can help identify malicious software, credential theft, abnormal encryption behavior, attempts to disable security tools, and unauthorized system changes. EDR can also support rapid containment if a workstation is compromised. Information technology security personnel may be able to isolate it from the network while investigating the event. This can be particularly important in healthcare where a fast response can reduce disruption to clinical and administrative systems.

EDR should complement and not replace backups, MFA, patching, training, segmentation, and incident-response planning.

Here is a quick EDR evaluation checklist.

• Confirm coverage for workstations, servers, and remote devices.
• Evaluate ransomware behavior detection and device isolation capability.
• Confirm that alerts are monitored after hours.
• Assess integration with existing IT, managed security, or SOC resources.
• Verify logging and investigation features.
• Evaluate operational impact on critical clinical systems.
• Identify support for legacy systems where appropriate.
• Confirm vendor security and contractual obligations.

If an EDR vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, that vendor is a business associate, and whether a business associate agreement (BAA) is required. HHS explains that covered entities must obtain "satisfactory assurances that business associates will appropriately safeguard PHI."[9]

Step 7: Conduct Regular Risk Assessments and Penetration Testing

A HIPAA Security Risk Analysis is not a one-time checklist or a vulnerability scan. It is an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Treat it as a living document that changes as security policies, procedures, or processes change in your organization.

HHS states that regulated entities must conduct an accurate and thorough assessment of risks and vulnerabilities to ePHI, then implement security measures that reduce risk to a reasonable and appropriate level.[10]

A ransomware focused assessment should consider attack paths including phishing, exposed remote services, unsupported software, weak credentials, inadequate MFA, unsecured vendor access, ineffective backups, inadequate monitoring, and poor network segmentation.

Your organization can build a recurring assessment cycle following these steps:

• Perform and document a comprehensive HIPAA SRA.
• Update the SRA after major technology, vendor, operational, or environmental changes (and especially after a HIPAA security incident)
• Conduct regular vulnerability scanning.
• Use the CISA KEV Catalog[11] to prioritize vulnerabilities under active exploitation.
• Perform penetration testing based on risk and environment.
• Test backup restoration.
• Review phishing simulation performance.
• Assess third-party and business associate access.
• Track remediation items through completion.

Penetration testing can help determine whether weaknesses are exploitable in practice. The scope should be defined carefully especially around production clinical systems and connected medical devices. The test agreement should identify approved systems, timing, methods, safety restrictions, emergency contacts, data handling rules, and reporting expectations.

Step 8: Create and Test a Ransomware Incident Response Plan

An incident response plan (IRP) is useful only if it is current and accessible during an outage and familiar to the people who must use it. Similarly, a ransomware plan should address technical containment, legal and compliance obligations, patient safety, operations, communications, and recovery.

HHS states that ransomware affecting ePHI requires a documented breach risk assessment that considers the nature and extent of the PHI involved, who used or received it, whether PHI was in fact acquired or viewed, and the extent to which risk was mitigated.[12]

An effective breach risk assessment should include these elements:

• Incident declaration criteria and escalation procedures
• Current 24/7 contact information
• Defined roles for IT, security, compliance, privacy, legal, leadership, clinical operations, communications, and vendors
• Instructions for isolating affected devices and systems.
• Procedures for preserving logs and evidence.
• Clinical downtime and patient safety workflows
• Criteria for backup restoration and system prioritization
• Communication procedures for staff, patients, vendors, insurers, law enforcement, and regulators
• HIPAA breach risk assessment procedures
• Post incident documentation and corrective action requirements.

This plan should be assessed thoroughly in a tabletop exercises. For example, simulate a scenario in which a staff member enters credentials into a fraudulent EHR login page, an attacker accesses a file server, encryption begins during clinic hours, and clinical leadership must activate downtime workflows. The exercise should test decisions, communications, handoffs, documentation, and recovery, not just the technical response.

After every exercise document the lessons learned, assign corrective actions, and update the plan.

Mapping Ransomware Prevention to HIPAA

Prevention Activity	HIPAA Connection	Recommended Evidence
Backup and restoration testing	Contingency planning and ePHI availability	Test records, restoration logs, recovery procedures
Phishing and security training	Security awareness and training	Training records, simulation results, remediation documentation
Patch management	Risk management and protection from malicious software	Asset inventories, patch reports, documented exceptions
MFA and access reviews	Access controls and authorization	MFA configurations, access reviews, termination checklists
Segmentation and monitoring	Technical safeguards and risk management	Network diagrams, firewall rules, monitoring records
EDR deployment	Security incident procedures and technical safeguards	Alert logs, investigation records, vendor reviews
Incident-response exercises	Incident procedures and contingency planning	Tabletop records, after-action reports, revised plans

Remember, the HIPAA Security Rule is scalable and risk based. It does not require every organization to use the same products or security architecture in some cases. However, it does require covered entities and business associates to identify risks, implement reasonable and appropriate safeguards, document their efforts, and respond to security incidents.[13]

Healthcare organizations should review applicable state breach notification laws, contractual commitments, payer requirements, cyber insurance conditions, and licensing obligations. Many times, these can vary from organization to organization, so it is important to know and understand what expectations are in place for your organization. HIPAA does not replace more stringent state requirements!

Healthcare Compliance Pros: Ransomware Defense Support

Ransomware readiness requires coordination between compliance, IT, clinical operations, leadership, workforce members, and vendors. Healthcare Compliance Pros help organizations translate healthcare cybersecurity requirements into practical and documentable safeguards.

Some of the support provided may include an SRA, ransomware readiness assessments, workforce training, policy development, incident response plan templates, documentation review, and compliance focused audit preparation.

The most effective next step is to identify one high risk gap and address it now. This may mean testing backups, enforcing MFA for remote access, updating an ePHI Asset Inventory, reviewing vendor accounts and business associates, completing an SRA, or assistance running a ransomware tabletop exercise.

Frequently Asked Questions

What is the most important ransomware prevention step for healthcare organizations?

There is no single control that prevents every ransomware attack. Healthcare organizations need layered safeguards, including tested backups, MFA, timely patching, workforce education, endpoint monitoring, network segmentation, risk analysis, and an effective incident response plan.

Is ransomware automatically a HIPAA breach?

Not necessarily, but it will more likely than not be classified as a breach. However, HHS presumes that ransomware involving PHI is a breach unless the organization demonstrates a low probability that PHI was compromised through a documented risk assessment.

Does the HIPAA Security Rule require MFA?

The HIPAA Security Rule does not specifically name MFA as a mandatory technology. However, the Security Rule requires access controls and risk-based safeguards to protect ePHI. MFA is a widely used safeguard for email, remote access, privileged accounts, EHR administration, and other high-risk systems.

How often should backups be tested?

Backup testing frequency should reflect your organization's risk profile, system criticality, RTO, and RPO. Regular testing should include restoring files and validating recovery of critical applications or systems. CISA recommends regularly testing backups to verify that recovery is possible.

Should medical devices be part of ransomware planning?

Yes! Medical devices and related systems can affect patient safety, clinical workflows, and network security. They also include ePHI. Include them in ePHI Asset Inventories, SRAs, segmentation plans, vendor management procedures, downtime planning, and incident response exercises. The HHS Healthcare and Public Health Sector (ASPR) ransomware resource library provides additional government resources for healthcare facilities.

What should an employee do after clicking a suspicious link?

The employee should report the event immediately through the organization's established process. Prompt reporting enables IT and security teams to isolate devices, reset credentials, revoke sessions, review logs, and potentially contain an incident before ransomware spreads.