Ransomware at a Family Medicine Clinic — and Why It Was Not a Reportable Breach
A front-desk workstation was encrypted on a Tuesday morning. Because segmentation held and backups were immutable, the clinic restored from clean copies and documented why no breach notification was required.
At a glance
1 location · 3 providers · 14 staff
The challenge
A staff member opened a malicious invoice attachment and a commodity ransomware strain encrypted the local workstation and began enumerating network shares. The clinic had engaged Atascocita IT eight months earlier for a risk assessment and remediation; the controls put in place during that engagement are what limited the blast radius.
- Ransomware executed with local user privileges on a front-desk workstation
- Attacker attempted lateral movement to the EHR server segment
- Clinic had no in-house IT staff and no incident commander
- Breach notification clock starts at discovery, not at containment
What we did
- 1
Containment inside the hour
The workstation was isolated at the switch port and credentials for the affected account were revoked. Network segmentation implemented during the prior engagement blocked the lateral movement attempt at the ePHI VLAN boundary.
- 2
Forensic scoping
We collected the endpoint image, firewall logs, and EHR audit logs to establish exactly which systems the malware touched and whether any ePHI was read or exfiltrated.
- 3
Restore from immutable backup
The workstation was rebuilt from a known-good image; no ransom was considered because the offline backup copy was 40 minutes old and verified.
- 4
Four-factor breach risk assessment
We ran the 45 CFR §164.402 four-factor assessment in writing — nature and extent of PHI, unauthorized person, whether PHI was actually acquired or viewed, and the extent to which risk was mitigated.
- 5
Documented determination and control hardening
The written determination, evidence, and reviewer sign-off were filed in the compliance record. Application allow-listing and phishing-resistant MFA were added to close the initial access vector.
The outcome
The forensic record supported a documented low probability of compromise, so the incident was logged and retained rather than reported to HHS and the media. The clinic's incident response plan was updated with the lessons learned and re-tested the following quarter.
The segmentation we almost cut from the budget the year before is the reason this was an outage instead of a front-page breach.
Services used in this engagement
More case studies
Client identities are protected under our Business Associate Agreements. These engagement stories are anonymised composites drawn from real Atascocita IT audits of the practice type described; metrics reflect the documented outcomes of those engagements.