The decision to pay a ransomware demand is one of the most consequential choices a home health administrator will ever face — made under enormous time pressure, with incomplete information, while clinical operations are disrupted and staff are anxious. I have supported home health agencies through this decision many times. My recommendation is consistent: do not pay. Not primarily for ethical reasons, though those matter. For practical ones: paying does not reliably restore operations, does not prevent data publication if double extortion is involved, and funds the infrastructure that will be used to attack the next organisation.
The alternative to paying — recovery from clean backup — only works if the backup architecture was designed to survive a ransomware attack. Standard backups fail against ransomware for a predictable reason: they are connected to the production environment. When ransomware spreads through an agency's network, it finds and encrypts backup files alongside production files, because the backup location is mounted to the same network the ransomware traverses. The agencies that pay ransoms are almost always agencies whose backups were not immutable, not isolated, or not tested.
The Backup Architecture That Enables No-Pay Recovery
Immutability: The Non-Negotiable Requirement
An immutable backup is a backup that cannot be modified or deleted during a defined retention period — by any account, including administrator accounts. The immutability is enforced at the storage layer, not by software that can be disabled by an account with sufficient privileges. Cloud object storage with object lock enabled — AWS S3 with Object Lock in Compliance mode, Azure Blob Storage with immutability policies, Wasabi with object lock — provides genuine immutability. An attacker with full administrative credentials over the agency's environment cannot modify or delete an immutable backup during the lock period.
The retention period for immutable backups should be set to at least 35 days — which covers the typical ransomware dwell time of 14–28 days plus a buffer. This ensures that at least one backup copy predates the initial compromise, giving the recovery team a clean restore point that was captured before the attacker had any presence in the environment.
Isolation: Physical and Logical Separation
Immutability prevents modification of existing backup files. Isolation prevents the ransomware from reaching the backup location to attempt modification in the first place. True isolation means the backup storage is not accessible from the production network during normal operations — it is only connected during the backup window, and the connection is initiated by the backup process (not continuously mounted). For cloud-hosted home health environments, isolation is achieved through separate cloud accounts, separate authentication contexts, and backup processes that authenticate temporarily during the backup window without maintaining persistent connectivity.