Ransomware readiness is not a document on a shelf. It is the demonstrated ability to isolate an incident, preserve safe clinical operations, restore trustworthy systems, and communicate under pressure.
Start with essential care workflows
Identify the systems a practice needs to schedule, treat, prescribe, document, bill, and communicate. Recovery priorities should reflect patient safety and operational dependency—not only server importance.
Assume identity is part of the incident
Modern attacks often compromise credentials before encryption begins. Recovery plans should cover administrator access, remote tools, identity providers, backups, and the ability to rebuild trust after containment.
Exercise the decisions
A tabletop exercise should force leaders to make timed choices with incomplete information. Combine that exercise with technical validation of segmentation, backup isolation, endpoint coverage, and recovery evidence.