What Happens in the First 24 Hours After Ransomware Hits Your Medical Office

It's 8:15 on a Tuesday morning. Your front desk staff tries to log into the EMR to check in the first patient of the day and gets an error. Then another computer. Then a strange message appears on a screen in the back office: your files have been encrypted, and there's a countdown timer.

This is how most ransomware attacks are actually discovered, not through some dramatic alert, but through ordinary staff noticing that ordinary things suddenly aren't working. Ransomware now accounts for 48% of all data breaches industry-wide, according to Verizon's 2026 Data Breach Investigations Report, up from 44% the year before, and healthcare remains one of the most targeted sectors because attackers know practices will feel enormous pressure to pay quickly to restore patient care.

If this happens to your practice, what you do in the first 24 hours matters enormously, both for containing the damage and for meeting your HIPAA obligations. Here's what that timeline should actually look like.

Hour 1: contain, don't panic. The instinct is often to start clicking around trying to fix things. Resist it. The first priority is stopping the spread: disconnect affected devices from the network immediately, unplugging the ethernet cable or turning off WiFi, but don't power them off completely, since powering off can sometimes destroy evidence needed for investigation and recovery; don't pay anything or contact the attacker yourself, since decisions about ransom, if it's even considered, should involve your IT provider, legal counsel, and often your cyber insurance carrier, not be made unilaterally by whoever found the message first; and call your IT provider or managed security team immediately, since if you don't have one on retainer, this is the moment you'll wish you did, and if you do, this is exactly the kind of event they should already have a response plan for.

Hours 1 to 4: assess and notify. Determine what's actually affected, whether it's one workstation or the whole network, and whether your EMR itself is compromised or just local office computers. If your EMR is cloud-based (eClinicalWorks, Athenahealth, CareCloud, etc.), your patient data may still be safe even if your local office network is locked up, which is one more reason cloud-based systems have become the practical default for small practices. Contact your cyber insurance carrier, if you have a policy, since many policies require notification within a specific window and provide access to incident response resources, forensic investigators, and legal counsel you'd otherwise have to find and vet under pressure. And begin documenting everything: when it was discovered, what was observed, what actions were taken, and by whom. This record matters for insurance, for any law enforcement involvement, and for your eventual HIPAA breach assessment.

Hours 4 to 24: investigate and plan patient care continuity. Bring in a forensic investigator, often provided through your cyber insurance or IT provider, to determine whether patient data was actually accessed or exfiltrated, not just encrypted. This distinction matters both for your HIPAA breach determination and for what you'll ultimately need to tell patients. Figure out how to keep seeing patients: paper backup processes for scheduling and basic clinical documentation, even temporarily, can keep a practice functioning while systems are restored, and this is worth having thought through before an attack, not improvised during one. Notify law enforcement, since the FBI's Internet Crime Complaint Center (IC3) takes ransomware reports, and local law enforcement should also be informed. And start the HIPAA breach assessment clock: under the HIPAA Breach Notification Rule, a ransomware attack is presumed to be a reportable breach unless your practice can demonstrate a low probability that patient data was compromised, a determination that needs to happen quickly and needs to be documented, which is another reason having a forensic investigator involved early matters.

What determines whether your practice recovers quickly. The practices that get back on their feet fastest after a ransomware attack almost always share the same thing beforehand: backups that were actually tested and confirmed to restore properly, not just backups that were assumed to be working. If your backups are current, isolated from your main network, and you've verified you can actually restore from them, ransomware becomes a very bad, very expensive day. If they aren't, it can become an existential threat to the practice, and nationally, 60% of small businesses that suffer a serious cyberattack close within six months.

Before it happens, not after. The single best thing a South Florida medical office can do about ransomware is have this plan written down before the countdown timer ever appears on a screen: who to call first, what to disconnect, what your cyber insurance requires, and how you'll keep treating patients while systems are restored. The practices that handle this well aren't the ones that never get targeted. They're the ones that already knew exactly what to do in the first hour.