Ransomware does not announce itself politely. Often it starts with a nurse who cannot open a chart, a printer spewing odd pages, or a file server where every document suddenly has a strange extension. What your team does in the next hour can decide whether the incident stays small or spreads across the whole building.
This walkthrough is written for administrators and directors of nursing as much as for IT staff. It assumes you have a small team and limited tools, which describes most long-term care and senior-living operators.
The first step is simply recognizing that something is wrong and telling the right person quickly. Signs include:
Files that will not open or have been renamed.
A ransom note on a screen or in a shared folder.
Many users reporting problems at the same moment.
Systems that were fine a few minutes ago suddenly running very slowly.
Staff should know who to call, whether that is your IT provider, an internal lead or the administrator on duty. A phone number posted at each nurse station is more reliable than hoping people remember.
The goal is to stop the infection from reaching more systems.
Disconnect affected computers from the network by unplugging the network cable or turning off Wi-Fi.
If you cannot tell which machines are affected, ask your IT provider whether to isolate a whole network segment.
Disable accounts that appear compromised.
Keep affected machines powered on if possible, since memory can hold useful evidence. Your IT provider can advise on this.
Do not wipe or reinstall machines yet. You may destroy evidence and lose chances to recover.
Do not pay anything or contact the attackers on your own.
Do not log in to other systems from an infected computer.
Backups are your path to recovery, and attackers often try to destroy them. Confirm quickly that your backup copies are separate from the main network and have not been touched. Do not connect an external backup drive to an infected network. If backups are in the cloud, have someone change administrator passwords from a clean device.
Resident care continues whether or not computers work. Your emergency preparedness planning, which CMS requires of long-term care facilities, should already address how you operate through disruptions. In practice that means:
Paper medication administration records and care notes.
Printed resident census and emergency contact lists.
A way to communicate with staff and families that does not rely on the affected systems.
A designated person to track what is recorded on paper so it can be entered later.
Within the first hour, make sure these people know:
Your administrator and corporate leadership.
Your IT or security provider.
Your cyber insurance carrier, if you have a policy. Many policies require prompt notice and may offer incident response resources.
Your legal counsel or compliance officer.
A ransomware attack on systems holding protected health information is presumed to be a HIPAA breach unless a risk assessment shows a low probability that the information was compromised. That analysis takes time and documentation, so start a written log now: who noticed what, when, and every action taken.
Assign one person to write down times, decisions and observations. Include which machines were isolated, who was contacted and what was said. This log will matter later for HIPAA breach assessment, insurance and any law enforcement report.
The hours that follow involve scoping the damage, deciding how to restore from clean backups, resetting credentials and evaluating notification duties under the HIPAA Breach Notification Rule. Reporting the incident to law enforcement and to CISA is also worth considering.
The best response plan is the one you rehearsed. Write a one-page checklist, assign roles, test your backups, and practice once a year with a tabletop exercise. Keep a printed copy somewhere accessible when systems are down.
UnityCare IT helps healthcare and senior-living organizations build incident response plans, verify backups and respond when something goes wrong. If you do not yet have a written plan, we can help you draft one that fits your building and your team.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034