Only 19% of Practice Leaders Are "Very Confident" They Could Recover From a Cyberattack. Here's What Separates Them From Everyone Else

Ask any practice owner whether they have cybersecurity, and most will say yes — firewall, antivirus, maybe cyber insurance too. Ask a different question — "if ransomware hit your systems tomorrow morning, could you actually get the practice running again, and how fast?" — and the confidence usually drops. A Medical Group Management Association poll taken October 6, 2026 put a number on that drop: only 19% of medical group leaders said they're "very confident" their practice could recover quickly from a cyberattack. Another 61% said "somewhat confident." The remaining 21% admitted they're not confident at all. Add it up, and roughly four out of five practices are leaning on a recovery plan they've never actually tested.

What actually happened

MGMA polled 238 practice leaders and compared the results to a similar poll from January 2025. The headline number barely moved — "very confident" held almost flat, 20% to 19% — but the shape of the response shifted: "not confident" shrank from 27% to 21%, and "somewhat confident" grew to 61%. Read generously, that's practices feeling a little better prepared than they did. Read carefully, it's a lot of practices drifting from "definitely not ready" to "probably fine," without much concrete changing in between.

The backdrop makes the stakes clear. Ransomware accounted for 36% of cyber threats reported to the FBI's Internet Crime Complaint Center in 2025 — more than 3,600 complaints, with reported losses north of $32 million, a figure that doesn't even count lost business, staff overtime, or remediation. Practices don't have to guess what "not confident" looks like, either: an informal survey taken after the 2024 Change Healthcare outage found 80% of respondents lost revenue from unpaid claims, 85% burned extra staff hours on revenue cycle work, and 55% covered practice expenses out of personal funds while the system was down. Seventy-eight percent of the affected practices had ten or fewer physicians — practices that look a lot like the ones reading this.

There's also a regulatory clock running in the background. The proposed HIPAA Security Rule update — the one we covered a few weeks back when its timeline slipped to 2027 — would require restoring critical systems within 72 hours of an incident. It isn't final yet, but OCR already treats a ransomware attack as a presumed HIPAA breach unless a practice can document a low probability that data was compromised. "We got hit, and we're still rebuilding" isn't currently a defense; it may soon come with a deadline attached.

Why it matters

Most practice cybersecurity spending goes toward keeping attackers out: firewalls, email filtering, endpoint protection, the annual phishing training half the office forgets by lunch. All of that is worth having. None of it answers MGMA's actual question, which was about getting back up, not staying out. Prevention and recovery are different disciplines, and a practice can be genuinely good at one while never having tested the other.

Here's the uncomfortable version of that gap: there are really only two kinds of practices — the ones who've actually restored a file or a server from backup and timed how long it took, and the ones about to find out, for the first time, whether their backups work, live, during an active ransomware incident. Nobody signs up for the second group. Almost everyone ends up there anyway, because "we have backups" and "we've successfully restored from backups" get treated as the same sentence when they aren't.

What this means if you're a South Florida practice

For practices across Palm Beach, Broward, and Miami-Dade counties — and increasingly for the practices we're hearing from along the Treasure Coast, as UpsiteGroup extends its HIPAA-focused support into Martin and St. Lucie counties — this survey isn't an abstract national statistic. Florida has shown some of the highest search interest in HIPAA compliance topics in the country this year, and the Change Healthcare numbers above describe exactly the kind of practice most common here: independent, ten physicians or fewer, running on a single EHR and clearinghouse with no real fallback. That's not a criticism — it's simply how small specialty practices are built. It does mean the recovery question MGMA asked is worth answering honestly, on purpose, before an incident forces the answer for you.

Practical takeaways

• Actually test your backup restore process. Pick a file or a server, restore it, and time it. "We have backups" and "we've restored from backups" are different claims — only one is something you can prove.

• Write down an incident response plan, and keep a printed copy off the network it's meant to help you recover. A plan locked inside an encrypted laptop during an attack isn't a plan.

• Check what your cyber insurance actually covers. Data recovery and business interruption are often separate line items — and know who to call first, since most policies want the insurer looped in before your IT vendor starts remediation.

• Ask your EHR, billing, and clearinghouse vendors what their own contractual recovery-time commitment is, in writing. A vendor with no stated number has no real commitment.

• Run a short tabletop exercise — even 30 minutes — twice a year, so the first time staff walks through the plan isn't during a real incident.

• If it does happen: disconnect affected devices first, call your cyber insurer before your IT vendor, switch to paper downtime procedures, and report it to the FBI through IC3. Law enforcement's standing advice is not to pay the ransom.

Confidence is cheap. A tested restore isn't. The 19% aren't necessarily smarter or better funded than everyone else — they're just the ones who've actually checked.