Incident Response Plan for Small Medical Offices

It is Monday morning. Your front desk opens the EHR and sees a black screen with white text: "Your files have been encrypted. Send 3 Bitcoin ($180,000) to the following address within 72 hours or your data will be published online." The phone system is down. The billing software is locked. Patient schedules are inaccessible.

Your office manager asks: "What do we do now?"

If the answer is "I don't know" — if there is no written plan, no contact list, no defined roles — the next 72 hours will be chaos. Staff will make decisions under pressure that make the situation worse. Critical evidence will be destroyed. Notification deadlines will be missed. And the financial and legal consequences will multiply.

In 2024, 67% of healthcare organizations worldwide experienced ransomware attacks. The average recovery cost was $1.85 million, with an average of 19 days of downtime. Lafourche Medical Group paid $480,000 to OCR after a phishing attack — the first-ever HIPAA settlement for a phishing incident. OCR cited the absence of security incident procedures as a primary finding.

An incident response plan (IRP) is not optional. It is required by HIPAA, demanded by cyber insurers, and the difference between a contained incident and a practice-ending catastrophe.

What HIPAA Requires

The HIPAA Security Rule at §164.308(a)(6) requires covered entities to implement policies and procedures to address security incidents. Specifically, you must:

• Identify and respond to suspected or known security incidents
• Mitigate harmful effects of known incidents to the extent practicable
• Document security incidents and their outcomes

Note the word "suspected" — even attempted attacks must be tracked. A "security incident" under HIPAA includes any attempted or successful unauthorized access, use, disclosure, modification, or destruction of information.

The proposed 2026 HIPAA Security Rule would strengthen this significantly: a written IRP becomes explicitly mandatory, annual plan testing is required, and critical systems must be restorable within 72 hours with backups no older than 48 hours.

The 6 Phases of Incident Response

The NIST SP 800-61 framework is the gold standard recommended by HHS for healthcare incident response. Here is how each phase applies to a small medical practice:

Phase 1: Preparation. Build the plan before you need it. Designate your incident response team, acquire tools, conduct staff training, and establish communication channels. For a small practice, this means identifying your IT contact, your HIPAA Privacy Officer, your cyber insurance carrier's hotline, and your legal counsel — and making sure everyone knows who to call.

Phase 2: Identification. Recognize that an incident is happening. Signs include: ransomware notes on screens, unusual login activity, patient complaints about unauthorized access, alerts from endpoint detection tools, staff reports about suspicious emails, or unexplained system slowdowns. The faster you identify an incident, the less damage it causes. The average time to identify a healthcare breach is 257 days — an IRP cuts that dramatically.

Phase 3: Containment. Stop the bleeding. Short-term: isolate affected systems by disconnecting them from the network, disable compromised accounts, block malicious IP addresses. Long-term: apply temporary fixes while preserving evidence. For a small practice, this may mean unplugging the server and switching to paper workflows temporarily. Do not turn off affected computers — volatile memory may contain evidence your forensic team needs.

Phase 4: Eradication. Remove the threat entirely. Delete malware, patch exploited vulnerabilities, reset all compromised credentials, and rebuild affected systems from clean backups. Verify that the attacker's access has been completely eliminated before restoring systems.

Phase 5: Recovery. Restore systems to normal operations in priority order — EHR first, then billing, then email. Verify system integrity. Monitor closely for re-infection. Resume electronic workflows only when your IT provider confirms the environment is clean. The proposed 2026 HIPAA rule would require critical system restoration within 72 hours.

Phase 6: Lessons learned. Within two weeks of resolution, conduct a formal review. What happened? How did the attacker get in? What worked in the response? What failed? Update the IRP based on findings. Retrain staff if the incident revealed a gap in awareness.

What Your IRP Should Include

A small practice IRP does not need to be 50 pages. It needs to be specific, actionable, and accessible during a crisis. Here are the essential sections:

Incident response team and roles.

• Incident Response Lead: Practice manager or HIPAA Security Officer — coordinates the response
• Clinical Lead: Physician who assesses patient safety impact
• IT Contact: Your managed IT provider's 24/7 emergency line
• Communications Lead: Handles patient and media notifications
• Privacy Officer: Assesses breach scope and HIPAA notification obligations

Emergency contact directory (print and digital, updated quarterly).

• IT provider emergency line
• Cyber insurance carrier claims hotline and policy number
• HIPAA legal counsel
• FBI field office cyber division
• HHS OCR breach reporting portal
• State Attorney General's office
• EHR vendor support line
• Key business associates (clearinghouse, cloud providers)

Incident classification. Define severity levels so the team knows how aggressively to respond:

• Critical: Active ransomware, mass data exfiltration, EHR down
• High: Compromised credentials with PHI access, insider breach confirmed
• Medium: Phishing attempt with potential compromise, lost unencrypted device
• Low: Failed login attempts, blocked malware, spam campaigns

Response playbooks by incident type. Write step-by-step procedures for the most likely scenarios: ransomware, phishing compromise, lost or stolen device, unauthorized record access, and vendor breach. Each playbook should list immediate actions, containment steps, who to notify, and evidence preservation instructions.

Breach notification procedures. HIPAA requires notification within 60 days of discovering a breach. For breaches affecting 500+ individuals, you must also notify the HHS Secretary and prominent local media. Most state laws have additional notification requirements. Pre-draft your notification letter templates — you do not want to write them under crisis pressure.

Evidence preservation rules. Print these on a card and post them in the server room:

• Do NOT power off affected computers (preserve volatile memory)
• Do NOT delete suspicious emails (they are evidence)
• Document everything with timestamps — take screenshots and photos
• Preserve all system and access logs
• Do NOT attempt to "clean up" without IT provider guidance

Tabletop Exercises: Practice Before the Real Thing

A tabletop exercise is a discussion-based session where your team walks through a hypothetical incident. A facilitator presents a scenario — "It is Monday morning and your EHR displays a ransom note" — with evolving complications, and participants talk through their responses using the IRP.

For a small practice, a tabletop exercise takes 60 to 90 minutes and reveals gaps that reading the plan on paper never would. Who calls the insurance carrier? Where is the policy number? What if the IT contact does not answer? Can you run the practice on paper for three days?

Run exercises at least annually — and after any major staff or system changes. CISA offers free tabletop exercise packages designed for different sectors. The proposed 2026 HIPAA rule would make annual plan testing mandatory.

Scenarios to practice:

• Ransomware locks your EHR on a Monday morning
• A staff member clicks a phishing link and their email account sends messages to patients
• A laptop with patient records is stolen from a car
• Your billing clearinghouse reports a breach affecting your patients
• You discover an employee has been accessing records of non-patients

Cyber Insurance and Your IRP

Cyber insurers now list four baseline requirements for coverage: multi-factor authentication, endpoint detection, encrypted offline backups, and a documented incident response plan. Without all four, many carriers will not issue a policy.

Practices with documented, tested IRPs qualify for 20-40% premium discounts. But the plan is not just about getting a policy — it is about getting paid when you file a claim. Over 40% of cyber insurance claims were denied in 2024. Common denial reasons include failure to maintain stated security controls, late notification to the carrier, and using unapproved forensic vendors.

Your IRP must include your carrier's approved vendor panel and claims reporting instructions. Most policies require notification within 24 to 72 hours of discovering an incident — before you engage any outside forensic vendor. Calling your insurer should be one of the first three calls in your plan.

Building Your IRP: A 2-Week Plan

Week 1:

1. Designate your incident response team (5 roles listed above)
2. Build your emergency contact directory and print physical copies
3. Write your incident classification definitions
4. Draft your ransomware response playbook (the most likely scenario)
5. Locate your cyber insurance policy number and approved vendor list

Week 2:

1. Draft playbooks for phishing compromise, lost device, and unauthorized access
2. Pre-draft breach notification letter templates
3. Write evidence preservation rules and print for the server room
4. Schedule your first tabletop exercise within 30 days
5. Store the completed IRP in three locations: printed binder in the office, digital copy on a secure cloud drive, and a copy with your IT provider

Total time: 6 to 10 hours of focused work. If you have a managed IT provider, they should help you build the plan, provide templates, and facilitate the tabletop exercise. If they do not offer this, it is a gap in their service agreement.

The Bottom Line

An incident response plan is not a document you write and forget. It is the playbook your team follows when the worst happens — and in healthcare, "the worst" is statistically likely. 67% of healthcare organizations experienced ransomware in 2024. The question is not whether your practice will face a security incident, but when.

The practices that survive incidents are the ones that prepared for them. They knew who to call, what to do, and how to contain the damage before it spread. The ones that did not prepare paid in downtime, penalties, and patient trust.

If you do not have a written IRP today, build one this month. If you have one, test it. The 2026 HIPAA rule will make both mandatory — but the threat landscape will not wait for the regulation.

Book a free IT assessment and we will help you build an incident response plan, run a tabletop exercise, and ensure your practice can survive the incident that every healthcare organization should expect. Explore our cybersecurity services and managed IT plans.