There is a specific kind of paralysis that strikes home health agency administrators in the first hour of a cybersecurity incident. Systems are down or behaving strangely. Staff are calling with questions. It is unclear what is happening, who to call, or what to do first.
That paralysis is not a character failing. It is the predictable result of having no pre-written incident response plan and no prior experience with what a serious cybersecurity incident feels like from inside an organization experiencing one.
The agencies that navigate cybersecurity incidents well are not the ones with better IT staff or more sophisticated technology. They are the ones that made decisions — about who to call, what to do, and in what order — before the incident occurred.
This is that plan.
Before the Incident: The Two Documents You Need Ready
Document 1: Incident Response Contact List
A single page with:
- Your managed security provider's 24/7 emergency line (ShieldForce SOC: [your SOC number])
- Your healthcare privacy attorney's direct cell
- Your cyber insurance carrier's claims line (and your policy number)
- Your IT vendor's emergency contact
- Your board chair's phone number
- Your HIPAA Security Officer's name and phone
- Your clinical operations director's phone (who manages field staff communication)
Print this and post it in the administrator's office. Save it in every leader's phone contacts labeled "CYBER INCIDENT." It should be accessible when email and the computer are both unavailable.
Document 2: Incident Response Decision Tree
A one-page flowchart covering: Is this a potential ransomware incident or a system failure? Who makes the determination? What do you do in the first 30 minutes?
Hour 0–1: Identify and Isolate
Minute 1–10: Determine if this is a security incident or a system failure
System failures (power outage, internet outage, cloud platform outage) look similar to security incidents at first glance — systems are down, staff can't access records. The distinguishing signs of a security incident:
- Ransom note on screen(s)
- Files with unfamiliar extensions (ransomware renames encrypted files)
- Unexpected account lockouts across multiple users simultaneously
- Antivirus alerts firing across multiple machines
- Systems accessing unusual internet addresses
If you see any of these signs, treat it as a security incident. You can revise this assessment later. You cannot un-ring the bell of a delayed response.
Minute 10–30: Call your managed security provider or IT contact immediately
Do not attempt to investigate or remediate yourself. Do not restart compromised systems — this can destroy forensic evidence. Do not disconnect your internet router — this can prevent remote investigation by your security team.
Call ShieldForce's 24/7 emergency line. Describe what you are seeing. The SOC team will remotely investigate, isolate affected systems, and begin triage. Your job at this stage is to be on the phone and available — not to be the IT person.
Minute 30–60: Isolate what you can without destroying evidence
If your security provider instructs you to disconnect specific devices — a specific workstation, a specific server — follow their instructions precisely. Do not take broader action than instructed.
Document everything you observe: what time you first noticed a problem, what systems are affected, what messages appeared on screen. Photographs of ransom notes or error messages on screens are useful forensic documentation.
Hour 1–4: Assess and Activate
Notify clinical leadership first
Before calling the board, before calling attorneys, before calling anyone else: notify your clinical operations director or director of patient care. She needs to know that systems are potentially unavailable so she can activate downtime procedures and ensure field nurses are safe and can continue providing care.