The 2026 Ransomware Surge Is Targeting Small Medical Practices. Here Is Your Action Plan.

Why are small medical practices attractive ransomware targets?

There is a persistent myth in healthcare that ransomware gangs only go after hospitals and large health systems. Small and mid-size medical practices can present a different opportunity: fewer dedicated security resources combined with an urgent need to keep scheduling, billing and clinical systems available.

In the first quarter of 2026 alone, Comparitech recorded 201 ransomware attacks on healthcare providers and businesses, with Qilin the most active group against providers. A small practice may have little tolerance for extended downtime, which can increase the pressure to restore operations quickly.

The economics are serious. IBM’s 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million across its surveyed organizations, but that industry average is not a prediction for an individual practice. Your own exposure depends on downtime, affected systems, response costs, lost revenue and whether patient data was compromised.

The recurring weaknesses worth checking are outdated and unpatched systems, exposed or weakly protected remote access, inadequate monitoring, untested backups, and staff who have not practiced recognizing current phishing lures. Those lures can mimic patients requesting records, vendors sending invoices, or internal staff.

What happens during a medical-practice ransomware attack?

Ransomware is malicious software that denies access to systems or data, usually by encrypting files, and then demands payment. Before encryption, attackers may spend time mapping systems, stealing credentials and patient records, escalating privileges and locating backups.

When the attack triggers, workstations and servers can become unusable, EHR access can disappear, and scheduling can go offline. Staff may need to activate downtime procedures. Attackers can then use both encryption and threats to publish stolen records as leverage.

What are your HIPAA obligations after ransomware?

Ransomware is a HIPAA security incident. When it encrypts ePHI, HHS presumes a breach unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised through a documented four-factor assessment. The assessment considers the nature of the PHI, the unauthorized person, whether the PHI was actually acquired or viewed, and how far the risk was mitigated. Involve incident-response specialists and healthcare counsel, and preserve the supporting evidence.

For a reportable breach of unsecured PHI, individual notices are due without unreasonable delay and no later than 60 days after discovery. Notice to HHS has the same outer limit when 500 or more individuals are affected; breaches affecting fewer than 500 may be reported annually, no later than 60 days after the end of the calendar year. Media notice is required when more than 500 residents of a state or jurisdiction are affected. State law and insurance contracts can impose additional or earlier duties.

What would the proposed HIPAA Security Rule change?

The current Security Rule already requires risk analysis, risk management, security incident procedures and contingency planning. Its addressable implementation specifications are not simply optional: if one is not reasonable and appropriate, the organization must document why and implement an equivalent alternative when reasonable and appropriate.

HHS proposed a substantial Security Rule overhaul in late 2024. The proposal would remove the distinction between required and addressable implementation specifications and make several safeguards more explicit. A proposal does not change current obligations by itself; do not treat proposed language as though it were already an enforceable final rule.

Which controls are in the proposal?

The proposal addresses encryption of ePHI, multi-factor authentication, vulnerability scanning, penetration testing, audit logging, technology asset inventories and network mapping, and verification of business associates’ security controls. Review the final regulatory text and its applicability when HHS publishes it rather than relying on a summary of the proposal.

What should practices do under the current rule?

Do not wait for a final rule to address known risks. Assess your current environment, implement reasonable and appropriate safeguards, document decisions and update the analysis as systems and threats change. OCR can enforce the existing Security Rule now.

Which seven controls should your practice prioritize?

These controls address common attack paths and support a current HIPAA security program; several also appear in the proposed rule. They are a practical starting point, not a one-size-fits-all compliance checklist.

1. Multi-factor authentication on everything

MFA adds a critical barrier against stolen passwords. Enable it on email, your EHR, your billing system, and every remote-access tool. If your EHR vendor does not support MFA, document the gap and discuss compensating controls and the vendor's roadmap.

Do not expose RDP directly to the public internet. Require a VPN with MFA before RDP, restrict which users and vendors can connect, and include those remote-access paths in your risk analysis.

2. Endpoint detection and response (EDR)

Traditional antivirus focuses on known threats; EDR watches endpoint behavior and can help detect and contain suspicious activity. It still needs timely investigation and response. See our managed cybersecurity.

3. Offline, tested backups

Attackers may look for backups before triggering encryption. Offline, immutable or otherwise isolated backups can keep one incident from destroying every restore point. Test real restores on a documented cadence, record the results, and measure whether you can recover the systems your practice needs first.

4. Network segmentation

If ransomware hits one workstation, a flat network can make lateral movement easier. Segment clinical systems from administrative devices and restrict traffic between segments to limit the blast radius.

5. Patch management

Unpatched operating systems, browsers and internet-facing services give attackers opportunities to get in. Use a managed, risk-based patch cycle that prioritizes critical exposures and tests updates around clinical workflows. Running Windows 10 after its October 2025 end of support leaves a system without regular security updates and needs prompt attention.

6. Security awareness training

Phishing can resemble routine referrals, records requests, invoices and internal messages. Regular simulations with immediate coaching give staff practice pausing, verifying and reporting suspicious messages; a once-a-year slideshow alone does not build that habit.

7. Documented risk analysis

A documented analysis identifies your ePHI, maps threats and vulnerabilities, evaluates current safeguards, and prioritizes remediation. Review and update it as your environment and risks change; HHS does not prescribe one universal annual deadline. Our HIPAA risk assessment process explains the deliverables, and HIPAA compliance services can help carry out the plan.

What should you do if ransomware is active right now?

Activate your incident-response plan rather than improvising. The immediate priorities are containment, evidence, qualified help and continuity of patient care.

1. Isolate affected systems from the network. Disconnect ethernet or Wi-Fi where it is safe to do so. Follow your response team's instructions before powering down or rebooting, because those actions can destroy volatile evidence.
2. Call your incident-response provider. Do not wipe, reformat or reimage devices while the investigation is beginning. If you need help, use ACS Cyber’s ransomware response steps and contact path.
3. Preserve evidence and start a timeline. Save logs and ransom notes, photograph screens where practical, and record which systems, accounts and locations are affected.
4. Notify your cyber insurer promptly and involve healthcare counsel. Follow policy notice requirements, begin the documented HIPAA breach assessment, and check applicable state-law and contractual duties.
5. Recover only after containment and eradication. Restore from known-clean, tested backups in the order your contingency plan sets. Make any ransom decision with your response, legal and insurance advisers; payment does not guarantee recovery or deletion of stolen data.

How can ACS help protect your practice?

Atlantic Computer Systems manages IT and cybersecurity for medical practices nationwide, from solo offices to multi-location groups. Healthcare is not a vertical we added to a general IT business, it is the practice we built from the ground up.

24/7 monitoring and threat response

Our security operations monitor your endpoints, network, and cloud around the clock. When something looks wrong, a process behaving oddly, a login from an unexpected place, a large file transfer at 2am, we investigate immediately, not the next morning.

HIPAA risk assessments and documentation

We run formal risk analyses that meet OCR's current expectations, not checkbox exercises. You get an asset inventory, a mapped threat landscape, and a prioritized remediation plan that doubles as your compliance documentation.

EHR and clinical-system expertise

We support the EHR environments medical practices run, every day. When a security update needs testing before it touches a clinical workstation, we handle it without a generalist's learning curve.

Cloud, backup, and disaster recovery

We configure and manage offline backups with documented, tested restore procedures, so if the worst happens you have a verified path back to operations, not a backup that turns out to be corrupt when you need it.

Frequently asked questions

How do ransomware attackers typically get into a medical practice?

Common entry points include phishing emails, stolen or reused passwords, unpatched software and exposed remote access. RDP should not be reachable directly from the public internet; put remote access behind a VPN with MFA and restrict vendor access as well.

Should we pay the ransom if we are attacked?

Do not make that decision under deadline pressure without your incident-response, legal and insurance advisers. Payment does not guarantee working decryption, full recovery or deletion of stolen data. Prioritize containment, evidence preservation and a recovery path from known-clean backups.

When does the new HIPAA Security Rule take effect?

A proposed rule does not itself create an enforceable compliance date. The final rule's publication, effective date and compliance timetable control. While rulemaking is pending, the existing Security Rule remains enforceable, so practices should address current risks rather than wait for proposed requirements.

Does cyber-liability insurance cover ransomware?

Coverage and exclusions depend on your policy. Applications, control representations, notice deadlines and response-vendor requirements can all affect a claim. Review the policy before an incident, keep evidence of required controls, and notify the carrier promptly when an incident occurs.

How long does it take to recover from a ransomware attack?

Recovery can take days to months. It depends on the attack's scope, clean and tested backups, how quickly containment occurred, and whether a practiced response and contingency plan exists. Sophos put the mean cost of recovery in healthcare at $1.02 million in its 2025 survey, but recovery time and cost for one practice can differ substantially.

Sources and further reading

• Fact Sheet: Ransomware and HIPAA, HHS
• Breach Notification Rule, HHS
• Cost of a Data Breach Report 2025, IBM
• The State of Ransomware in Healthcare 2025, Sophos
• Healthcare Ransomware Roundup Q1 2026, Comparitech
• 2026 HIPAA Security Rule Update, Medcurity
• Healthcare Data Breach Statistics, HIPAA Journal
• Healthcare Cybersecurity Top Risks 2026, AHA