Ransomware and data breaches: steps for a dental practice

This post collects steps from federal guidance on ransomware and data breaches for small dental practices. It is a checklist for planning and conversation. It is not legal or technical advice. Involve a HIPAA adviser, an IT professional and an attorney for any real incident.

What is ransomware?

CISA describes ransomware as “a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” Attackers then demand ransom for decryption. CISA adds that attackers have also taken victim data and pressured victims “by threatening to release the stolen data.” CISA calls the use of both tactics “double extortion.”

For a dental office, locked files can mean no schedule, no charts and no images. The effect is operational first and a privacy matter second. The ransomware and data breach entries in the glossary define the terms.

What does CISA say to do before an attack?

CISA’s guide has a preparation section. It says organizations should keep offline, encrypted backups and test them. It says: “It is important that backups are maintained offline, as many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.”

The guide is written for a wide audience, including IT professionals and others who build incident response plans. A small practice will rely on its IT vendor for most steps. The table below lists items from the guide that a practice can ask about.

A business continuity plan covers how the office keeps seeing patients if systems are down. The ADA’s risk management page also lists tips on emergency action and disaster recovery plans.

What does HHS say about ransomware and HIPAA?

HHS says a ransomware attack is presumed to be a breach unless the office shows otherwise. Its fact sheet states: “Unless the covered entity or business associate can demonstrate that there is a ‘…low probability that the PHI has been compromised,’ based on the factors set forth in the Breach Notification Rule, a breach of PHI is presumed to have occurred.”

If a breach is presumed, the notification rules apply. The entity must notify affected individuals “without unreasonable delay,” then HHS, and then the media when the breach affects over 500 individuals. An adviser decides whether the presumption applies in a given case.

What steps does HHS list after an attack?

HHS lists response activities in order. They begin with an initial analysis to find the scope, origin and timing of the incident. Later steps are listed below.

1. Contain the impact and spread of the ransomware.
2. Eradicate the ransomware and fix the weaknesses that allowed it.
3. Recover by restoring lost data and returning to normal operations.
4. Run post-incident activities, such as checking whether any regulatory, contractual or other duties apply, and record lessons learned.

HHS notes that those duties could include “providing notification of a breach of protected health information.” The office should also call its insurer and attorney early, since policies and state laws can add steps. This post does not give advice on either.

Who should receive a report?

CISA’s guide says to report the incident to, and consider asking for help from, “CISA, your local FBI field office, the FBI Internet Crime Complaint Center (IC3), or your local U.S. Secret Service field office.” The ADA’s risk management page also points dentists to the IC3, which it describes as run by the FBI and “the Nation’s central hub for reporting cyber crime.”

HHS timing depends on size, as the HIPAA for dental offices post explains. If a breach affects 500 or more individuals, HHS says covered entities must notify the Secretary “without unreasonable delay and in no case later than 60 days following a breach.”

How can an office start this week?

A first step is a short meeting with the IT vendor. Ask three things. Where are the backups? When was the last restore test? Is there a written incident plan? The ADA says “identifying the risks that exist in a dental practice is the first step to effectively managing them.” Write the answers down and set a date to review them.

The dental compliance checklist lists the other areas a practice tracks. The post on website accessibility covers another part of patient-facing technology. The glossary explains cybersecurity and risk management.

Next step

Read the dental compliance checklist for the wider view. To ask about consulting, contact Dr. Copeland about consulting.