What to do with user accounts after a cyberattack on a medical practice

When a cyberattack hits your practice, isolate the affected systems and save the logs before you change anything else. Then look for accounts the attacker used or created. Reset passwords on affected systems once they have been cleaned and rebuilt. After that, close any emergency logins you opened during the outage. The order of these steps, up to the password reset, follows the #StopRansomware Guide from the federal Cybersecurity and Infrastructure Security Agency (CISA). HIPAA’s Security Rule requires you to have incident procedures and a contingency plan in place before any of it happens.

What HIPAA requires when an incident happens

45 CFR 164.304 defines a “security incident” as an attempted or successful unauthorized access, use, disclosure, change, or destruction of information, or interference with how a system runs. OCR, the HHS office that enforces HIPAA, says that ransomware, or any other malware, found on your systems counts as a security incident.

Two parts of 164.308 apply. Security incident procedures, in 164.308(a)(6), include a required step called response and reporting. You identify and respond to suspected or known incidents and limit their harm where you can. You also document each incident and its outcome. The contingency plan, in 164.308(a)(7), requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan. Testing the plan and ranking which applications and data matter most are addressable. That means you assess whether each fits your practice. If it doesn’t, you document why and use an equivalent measure if one is reasonable.

OCR’s ransomware fact sheet describes what a response should include: detect and analyze, contain, eradicate, recover, and review afterward. It says to start your incident response plan right away and isolate infected systems. It also recommends contacting your local FBI or US Secret Service field office.

Save the records first

Work through the first three steps of CISA’s checklist in order: detection and analysis, reporting and notification, then containment and eradication. In those steps, it asks you to keep evidence that disappears quickly or is kept only for a short time. Examples include system memory, Windows Security logs, and firewall logs. Ask your IT support where each one is kept. It also suggests taking system images (full copies of a computer’s disk) of a sample of affected machines. It warns that powering a device down loses what is in its memory, so do that only if you can’t disconnect it another way.

These records matter for HIPAA too. OCR says that if ransomware encrypted patient data, a breach is presumed. That presumption holds unless a risk assessment of four factors shows a low probability that the data was compromised. OCR’s examples of evidence that feed this assessment include signs of data being sent to the attackers. If you wipe a server before reading its logs, you lose the facts you need to make that call.

If your EHR or practice management system is hosted by a vendor, its logs may sit with the vendor. Find out before an incident who to call and how fast they can send them.

Find the accounts the attacker used or created

Account checks start in the detection phase. CISA’s checklist says to look for newly created accounts, accounts whose privileges went up, and recent activity on admin accounts. It also says to look for unusual logins to your VPN (the secure connection staff use to reach your network from home) and other suspicious sign-ins. Then, during containment, work out which systems and accounts the attacker first broke into, email accounts included.

Attackers often steal logins in bulk, CISA notes. To shut off access through stolen logins, it suggests turning off services reachable from the internet. Those include VPNs, remote access servers, and single sign-on (one login that opens many apps). It also asks you to look for ways back in, such as accounts the attacker set up and hidden entry points (backdoors) on internet-facing systems. Finding them can mean auditing local and network accounts.

Reset passwords once the systems are clean

Wait to reset passwords until the systems are clean. CISA’s checklist puts this step late in containment and says to reset passwords on all affected systems “once the environment has been fully cleaned and rebuilt.” That includes the affected accounts, along with removing any way the attacker set up to stay in.

Shared logins make this step harder. When several people use one username, the new password has to reach each of them. If it goes out by text message or on a sticky note, it lands in the same places the old one did. The system’s log also shows one name for everyone. OCR’s Summer 2021 newsletter says shared usernames make it hard to tell which user fell for a phishing email that let ransomware in. Unique user identification, in 164.312(a)(2)(i), is a required part of the Security Rule. For more on resetting shared passwords, see The limits of changing shared passwords every time someone leaves.

Close emergency access after recovery

During an outage, staff may use downtime procedures, paper charts, or temporary logins. HIPAA’s emergency access procedure, in 164.312(a)(2)(ii), is required. It covers how to get needed patient data during an emergency. OCR’s audit protocol asks how practices limit who can start emergency access. It also asks how access goes back to normal once the emergency is over.

So when systems are back, disable any temporary logins you handed out and reset emergency accounts that were used. Then review what they were used for. What is a break-glass account? explains how emergency accounts are usually set up.

What to have ready before an attack

Have an incident response plan and a communications plan, both of which are on CISA’s preparation list. Keep a printed copy and an offline copy, since your network may be down. The list also includes offline, encrypted backups that you test regularly, and an inventory of your systems that marks which ones matter most. OCR’s fact sheet also calls for frequent backups and test restores. Because some ransomware goes after online backups, it suggests considering offline ones.

For accounts, keep a current list of who holds admin logins for each system. CISA recommends separate admin accounts, changed default admin passwords, and phishing-resistant multi-factor authentication (MFA: a second check besides the password). OCR’s 2024 breach report shows why. Breaches it investigated involved weak passwords, including on admin accounts, default passwords on system accounts, and remote access protected by a password alone.