Ransomware Response Playbook for Healthcare IT Teams

You're two days into a long weekend when the call comes: an employee clicked a link in what looked like a routine email from a trusted vendor. By the time your security team flagged the anomaly, an unauthorized actor had already accessed your environment. The clock is ticking, and you need to know exactly what to do next.

This guide walks you through the technical and procedural steps for building and executing a ransomware response plan that meets HIPAA Security Rule standards while protecting patient data and your organization's operations.

Scope: What This Guide Covers

This playbook addresses ransomware detection, containment, investigation, and notification obligations under the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312) and Breach Notification Rule (45 CFR § 164.400-414). It's designed for security engineers and IT leads responsible for incident response at Covered Entities and Business Associates.

In scope:

• Technical detection and containment procedures
• Forensic investigation requirements
• HIPAA breach determination and notification timelines
• Security Rule compliance during and after an incident

Out of scope:

• Ransom payment decisions (executive/legal domain)
• Cyber insurance claim procedures
• Public relations strategy

Key Concepts and Definitions

Unauthorized Access: Any acquisition, access, use, or disclosure of Protected Health Information (PHI) in violation of the HIPAA Privacy Rule. For ransomware incidents, the critical question isn't whether systems were encrypted but whether an unauthorized party accessed or exfiltrated PHI.

Exfiltration vs. Encryption: Modern ransomware groups typically steal data before encrypting it. The Interlock ransomware group's claim of exfiltrating 710 GB of data from AngMar Management Services demonstrates this dual-threat model. Even if you restore from backups without paying, you still face a potential breach if data left your environment.

Discovery Date: The first day you or any workforce member knew or should have known that a breach occurred. In the AngMar incident, unauthorized access occurred around July 18, 2026, but discovery happened July 20, 2026. Your 60-day notification clock starts from discovery, not intrusion.

Breach Determination: You must complete a risk assessment to determine if unauthorized access constitutes a breach requiring notification. This assessment must evaluate the nature and extent of PHI involved, the unauthorized person who accessed it, whether PHI was actually acquired or viewed, and the extent to which risk has been mitigated.

Requirements Breakdown

Detection and Containment (Security Rule § 164.308(a)(6))

Required actions within first 24 hours:

• Isolate affected systems from the network (don't power down; preserve forensic evidence)
• Document the timeline: when you detected the incident, when logs suggest intrusion began, which systems were accessed
• Preserve all logs, memory dumps, and system images before they rotate out
• Activate your incident response team and establish a communication chain

Within 48-72 hours:

• Engage forensic investigators if you lack in-house expertise
• Identify the initial attack vector (phishing email, compromised credentials, unpatched vulnerability)
• Map lateral movement through your environment
• Determine which systems contained PHI and whether that data was accessed or exfiltrated

Investigation and Assessment (Breach Notification Rule § 164.402)

You have a narrow window to complete your forensic review and breach determination. The AngMar investigation took from July 20 to September 8, 2026, about seven weeks, to confirm which data elements were compromised. That timeline is reasonable for a complex incident, but you can't delay notification indefinitely while investigating.

PHI elements you must identify:

• Demographic data (names, addresses, dates of birth)
• Financial identifiers (Social Security numbers, payment card data)
• Health insurance information
• Medical record numbers and patient IDs
• Clinical data (diagnoses, treatment records, prescription information)
• Sensitive categories (substance use disorder, mental health, HIV status)

If forensic analysis shows the attacker accessed directories or databases containing these elements, you must presume they acquired the data unless you have evidence to the contrary.

Notification Obligations (Breach Notification Rule § 164.404-414)

Individual notification (§ 164.404):

• Required within 60 days of discovery
• Must be sent by first-class mail or, if you have documented email consent, by email
• Must include: description of the breach, types of information involved, steps individuals should take, what you're doing to investigate and prevent recurrence, and contact procedures

Media notification (§ 164.406):

• Required if breach affects 500+ residents of a state or jurisdiction
• Must notify prominent media outlets serving that area
• AngMar notified the Texas Attorney General about 35,916 Texas residents affected, triggering this requirement

HHS notification (§ 164.408):

• Breaches affecting 500+ individuals: notify OCR within 60 days via the breach portal
• Breaches affecting fewer than 500: maintain internal log and submit annual notification

Implementation Guidance

Build Your Detection Layer

Your security monitoring must catch anomalies before attackers establish persistence. Focus on:

Email security: Implement DMARC, SPF, and DKIM to block domain spoofing. The Eskenazi Health incident involved a compromised business contact's email account sending credential-harvesting links to thousands of recipients. Your email gateway should flag authentication anomalies and unusual sender behavior.

Endpoint detection: Deploy EDR tools that flag suspicious process execution, lateral movement, and data staging. Configure alerts for PowerShell execution, WMI activity, and connections to known bad IP ranges.

Identity and access monitoring: Log all authentication attempts, especially for privileged accounts and cloud-based email systems. The Eskenazi employee's credentials were captured on June 3, 2026, but the compromise wasn't detected until July 27, 2026, a 54-day gap during which the attacker could access emails and attachments.

Harden Your Environment

Addressable Specifications you should implement as Required:

• Multi-factor authentication for all remote access and privileged accounts (§ 164.312(a)(2)(i))
• Encryption of ePHI at rest and in transit (§ 164.312(a)(2)(iv) and § 164.312(e)(2)(ii))
• Automatic logoff for inactive sessions (§ 164.312(a)(2)(iii))

Segment your network: Isolate systems containing PHI from general corporate networks. If ransomware enters through a phishing email in your billing department, it shouldn't be able to reach your EHR database.

Maintain offline backups: Keep at least one backup copy offline and immutable. Test restoration procedures quarterly.

Train Your Workforce

The HIPAA Security Rule requires security awareness training (§ 164.308(a)(5)(i)). Make it specific and recurring:

• Monthly phishing simulations with immediate feedback
• Quarterly tabletop exercises walking through ransomware scenarios
• Role-specific training for employees who handle PHI or have elevated access
• Clear reporting procedures so employees know whom to contact if they suspect they've been compromised

Common Pitfalls

Waiting too long to engage forensics. If you don't have in-house expertise to image systems, analyze logs, and trace attacker activity, bring in a third-party forensic firm within 48 hours. Evidence degrades quickly.

Assuming encryption means no breach. If an attacker encrypted your files but you have no evidence they accessed or exfiltrated PHI, you still must conduct a risk assessment. The absence of evidence isn't evidence of absence.

Missing the 60-day notification deadline. OCR doesn't accept "we're still investigating" as justification for late notification. If you can't complete your investigation within 60 days, notify based on what you know and provide updates as you learn more.

Failing to document your response. OCR will expect detailed records showing when you discovered the incident, what steps you took, how you determined which individuals were affected, and why you made the decisions you did. Document everything in real time.

Neglecting Business Associate agreements. If a Business Associate caused or contributed to the breach, they have their own notification obligations. Don't assume they'll handle it, verify and coordinate.

Quick Reference Table

Critical thresholds:

• 500+ individuals in one state/jurisdiction → media notification required
• 500+ individuals total → immediate OCR notification required
• Fewer than 500 individuals → annual OCR notification (within 60 days of calendar year end)

Bookmark this guide and review it with your incident response team quarterly. When you're two days into a breach investigation with executives demanding answers and OCR expecting notification, you'll need a clear roadmap that keeps you compliant while you contain the damage.