Ransomware Defence for Medical Practices: The Five Controls That Matter

Why clinics are targeted specifically

Ransomware crews select for victims who cannot tolerate downtime and who hold data with resale value. A medical practice is both: cancelling a day of appointments has immediate financial and clinical cost, and a patient record sells for many times the price of a stolen card number. Small practices are attractive rather than beneath notice, because they rarely have dedicated security staff.

Control 1: Immutable, off-site backup

The single control that determines whether you pay. Modern ransomware operators hunt for backups before encrypting anything, and a backup a domain administrator can delete is a backup the attacker can delete. What survives is a copy that cannot be altered or deleted within its retention window, held somewhere the production credentials cannot reach.

• →Three copies, two media types, one off-site — and one of those immutable or genuinely offline
• →Test restores end to end at least annually, with the elapsed time written down
• →Confirm the backup covers the EHR database, not merely the server it runs on
• →Verify the recovery point objective by restoring, not by reading a dashboard

Control 2: Multi-factor authentication everywhere

Most ransomware arrives through stolen or guessed credentials, not a novel exploit. MFA on remote access, email, and administrative accounts closes that path. Under the 2026 Security Rule NPRM this stops being an addressable specification and becomes required, so the argument for deferring it has expired.

Control 3: Network segmentation

A flat network turns one compromised workstation into an enterprise event. Segmentation puts a control boundary between the front desk, the clinical network, medical devices, and guest Wi-Fi so that lateral movement hits a wall. In our own incident work, segmentation is repeatedly the difference between a rebuilt workstation and a rebuilt practice.

• →Isolate imaging equipment and medical devices that cannot be patched
• →Keep guest Wi-Fi entirely off the clinical network
• →Design rules from observed traffic, not from vendor documentation
• →Re-test after cutover to prove the paths are actually closed

Control 4: Rapid patching and end-of-life planning

Attackers exploit known vulnerabilities far more often than unknown ones. Define a patch SLA by severity and measure against it. For devices that cannot be patched — the reality for most imaging equipment — document a compensating control instead. A written compensating control is defensible; an unpatched device with no documentation is a finding.

Control 5: Staff who report in minutes

Every incident timeline starts with someone noticing. A workforce that reports a suspicious message within minutes gives you hours of advantage; one that stays quiet out of embarrassment gives the attacker the weekend. Measure your reporting rate, not just your click rate, and make reporting consequence-free.

What to do in the first hour

Speed matters more than elegance. Isolate affected machines at the network level rather than shutting them down, which preserves memory evidence. Revoke the credentials involved. Call your cyber liability carrier before engaging any responder, because most policies require it. Then start the written four-factor breach risk assessment — the notification clock runs from discovery, not from containment.