The agencies that come through a data breach intact — financially, operationally, reputationally — are almost always the ones that prepared before the incident occurred. The ones that sustain lasting damage are, almost without exception, the ones experiencing the first 30 days for the first time, with no plan, no forensic support, and no documentation ready to show regulators and insurers. This is what those 30 days typically look like. It is far more expensive than most administrators expect, and far more manageable when an agency is ready for it.
For a closer look at the specific procedures that matter most in the opening hours, see Incident Response for Home Health Agencies: The First 24 Hours. This article picks up that same starting point and follows the full 30-day arc through to system restoration and its financial aftermath.
Days 0–2: Discovery, Paralysis, and the Critical First Decisions
Discovery typically happens one of four ways: a staff member reports that screens across the office are displaying ransom messages; the phone starts ringing because patients are calling about fraudulent activity; a managed security provider or EDR platform fires an alert; or a billing employee notices their credentials no longer work. In a significant share of incidents, the discovery itself triggers a cascade of well-intentioned but damaging actions — rebooting infected systems, deleting suspicious files, disconnecting devices without forensic preservation. Each of these actions destroys evidence that forensic investigators, insurance adjusters, and potentially federal investigators will need.
The first phone call in the first hour should go to a managed security provider or incident response firm — not to an IT contact, not to the EHR vendor, and not to the billing company. The second call opens the claim with the cyber insurance carrier. The third goes to legal counsel. In that order, every time.
The single most important decision in the first two hours is whether to isolate affected systems immediately or preserve them for investigation. This decision requires forensic expertise to make correctly. Isolating too early stops the attack but may sever the forensic trail. Investigating too long allows the attack to spread. Without a managed security provider or IR firm on the call, agencies frequently make the wrong call under pressure.
Days 2–7: The Forensic Investigation and What It Costs
The forensic investigation establishes the facts that every subsequent decision depends on: which systems were compromised; which patient records were accessed, copied, or encrypted; how long the attacker was present before detection (the "dwell time," which averages around 28 days in healthcare incidents); and what the initial access vector was. For home health agencies in the 50–200 employee range, this investigation typically costs $25,000–$50,000, depending on the scope of the incident, the complexity of the environment, and whether forensic evidence was preserved in the first 48 hours.
During the investigation, clinical operations continue under downtime procedures — or they don't, if none exist. This is where the absence of documented downtime procedures becomes a patient safety issue and a compliance issue simultaneously. Nurses in the field can't access care plans. Medication orders are unavailable. Supervisors can't see which patients have been visited. Agencies that handle this phase well typically have laminated downtime procedure cards in every nursing bag and a manual visit log that activates automatically when the EHR goes down. Agencies that struggle most are still writing their downtime procedures while the forensic team is mid-investigation.
Days 7–14: The Legal and Regulatory Decision Phase
Based on the forensic findings, legal counsel guides the four-factor HIPAA risk assessment that determines whether a reportable breach has occurred. The four factors — nature and extent of PHI involved, who accessed it, whether it was actually viewed or acquired, and what mitigation has occurred — must be assessed and documented in writing. In ransomware incidents where patient data was encrypted, the current OCR position is that encryption of PHI by an unauthorized actor constitutes a breach unless the data was encrypted before the attack. This means most ransomware incidents at home health agencies are reportable breaches.
If the breach is reportable, the 60-day individual notification clock is now confirmed. Legal counsel typically engages a breach notification vendor — a firm that manages letter drafting, printing, mailing, and call center services for affected patients. Simultaneously, if 500 or more individuals in a single state are affected, the HHS OCR breach portal submission must also be filed within 60 days. That submission asks detailed questions about the nature of the breach, the safeguards that were in place, and the remediation steps taken — questions that are much easier to answer with good documentation already in hand.