The morning the computers do not turn on

1. Map the office before you need the map

Write down, on paper, what actually holds a chart. In most offices that is four things. The practice-management server or hosted database, which has the schedule, ledger, and notes. The imaging database, which may be a second computer even when the sensors feel like part of the same system. Email and the domain name, which are how labs, payers, and patients reach you. The backup target, which is worthless if it is a folder on the same server the incident just reached.

Next to each one, write who administers it and a phone number that is not stored only inside that system. Add the cyber-insurance claims number if you carry a policy. Add the after-hours number for the imaging vendor. This is the same call tree as the hurricane page, pointed at machines instead of shutoff valves. If that page does not exist in the office, the outage will be spent searching inboxes.

2. The first hour is containment

CISA’s public ransomware checklist starts with a plain instruction: determine which systems were hit and isolate them immediately. If you cannot disconnect a device from the network, power it down so the problem does not spread. Isolation means pulling the network cable, turning off that machine’s Wi-Fi, or shutting the port on the switch. It does not mean gathering the staff to click through the message “to see if it clears.”

Treat a single operatory differently from the server. One front-desk PC with a warning can be unplugged and left on the bench. If the shared drive that holds images is affected, or every workstation opens to the same message, unplug the server from the switch and stop using the wireless network. Do not reboot a machine over and over. Do not install a cleanup tool you found in a search. Do not wipe the disk because an empty computer feels safer. The person who investigates will want the machine as it was, including memory if they get there quickly. Photograph the screen for your insurer and your IT contact, then leave it.

Use a phone that is not on the office Wi-Fi to call the person who already manages the network. One caller. Everyone else stops experimenting. Tell the team not to forward the email that arrived with the outage and not to log in from home “just to check the schedule.” A home PC that connects back with a saved password can become the next affected machine.

3. Patients get one sentence, and the chart stays honest

Downtime is an operational mode, not a pause in recordkeeping. The sentence is the same one used for a storm closure: we are closed, or we are on paper, here is the emergency number, we will post when the computers are back. Do not promise a clock time. Print or hand-copy the day’s schedule only if you can do it from a system that is still clean. If you cannot, the book is the book you still have on paper.

Do not reconstruct a chart from memory and file it later as if it were the original note. When the database returns, enter downtime treatment as downtime treatment, with the time and the initials, the way the practice already handles a day the server was off for maintenance. Guessing a perio charting from last year is how a bad week becomes a bad record.

4. A backup is a restore you have timed

CISA’s small-business guidance is specific about this failure. Many organizations hit by ransomware had no backup, or had a backup that was incomplete or already damaged, because it lived where the incident could reach it. Copying the server to a drive that stays plugged in is not an offline copy. A useful pattern is three copies of the data, on two kinds of media, with one copy offline or offsite so a program running on the server cannot change it. The offline copy can be a drive in a safe, or a cloud backup whose account is not saved in the office browser. The brand matters less than the unplug.

Test the restore on a schedule, and test the thing you would actually need: the practice-management database and the imaging catalog, not a folder of PDFs. Time it. That time is your recovery time. The hours of charting you are willing to re-enter by hand are your recovery point. If the last good backup is three weeks old, the office needs to know that on a calm Tuesday, not during the outage. Write both numbers in the call-tree notebook.

During the incident, restore only onto equipment your IT contact has said is clean. Putting yesterday’s backup onto a machine that is still affected just hands the backup over. If the only clean computer is a laptop from someone’s house, that laptop does not join the office network until the passwords have been changed from a known-good device.

5. Accounts, then the HIPAA question

After containment, the next technical step is credentials. Change email, remote-access, practice-management, and backup-account passwords from a computer that was not on the affected network. Turn on multi-factor authentication anywhere the vendor already offers it, especially email and any remote login. Do this with your IT contact. A password changed on a machine that is still affected is not a new password for long.

Whether patient information was viewed or taken is a separate legal question. HHS publishes the breach-notification rule and a risk assessment built around what happened to the information: what it was, who may have had it, whether it was actually acquired or viewed, and what you have done to mitigate. Encryption and a prompt containment can change that analysis. They do not let a blog post declare “this was not a breach.” Your counsel, your compliance officer, or your cyber insurer runs that analysis. Call the insurer from the clean phone if you have a policy. The claims line often brings an incident firm. Use that firm before you hire a stranger from a search result.

6. Who is on the phone list

Your IT person or managed-service provider. Your cyber insurer. CISA’s report page, which is how the federal cybersecurity agency takes an incident report from a small business. The FBI’s Internet Crime Complaint Center. SCDA does not operate an incident desk, does not negotiate, and does not restore servers. What the association can do afterward is what it does after a storm: members who have already lived through a week on paper, talking about what failed in the backup, not about how the intrusion worked.