Ransomware Notification Clock at a Healthcare SaaS Provider
A healthcare SaaS provider discovers ransomware on a billing application at 02:10 on a Saturday. The incident affects 42,000 patients across three states, including 1,100 whose billing records contain diagnosis codes. The provider’s contract with a hospital customer requires notification within 72 hours. State law requires notice “without unreasonable delay” and, for one state, within 30 days if personal information is involved. HIPAA requires notification within 60 days of discovery. Forensics has contained the malware but cannot confirm whether data was exfiltrated. The CEO wants to wait for the final report, due in 10 days, before notifying anyone. The general counsel asks you to lead the incident response. Backups restored billing in 18 hours. The FBI has been contacted informally. A ransom note demands payment in 48 hours.
1. Advise on the notification decision and timing. What should happen before the 72-hour contractual deadline, and why is waiting for the final report risky?
Read the worked answer
Waiting for the final report is risky because notification duties are triggered by discovery of a reportable incident, not by certainty about exfiltration. The contract requires notice within 72 hours, which expires early Tuesday. State law’s “without unreasonable delay” standard generally expects notice after a reasonable investigation, not after every forensic question is resolved. HIPAA’s 60-day outer limit does not create a 60-day waiting period. Because the data includes diagnosis codes for 1,100 patients, the risk assessment should assume a high harm potential until evidence shows otherwise.
Before the 72-hour deadline, counsel should confirm the contractual notice recipient and required content, assess each state’s threshold and content rules, and prepare a preliminary notice that states known facts, containment status, and the investigation timeline without speculating. Notify the hospital customer within the contractual deadline unless counsel documents a lawful reason to delay. Notify regulators and patients according to the applicable thresholds and timing; if exfiltration is unconfirmed, do not say there was no breach. Use qualified language such as “no evidence of exfiltration at this time.” The FBI contact does not substitute for contractual or statutory notice. The ransom deadline is a separate decision and should not drive the notification timeline.
2. Set out the incident command structure and the evidence and decision log you would require in the first 72 hours.
Read the worked answer
Establish an incident commander, a deputy, and leads for legal, forensics, IT recovery, communications, clinical or customer impact, and regulator liaison. The incident commander owns the timeline and convenes twice-daily briefings. Legal counsel should direct privileged forensic work and separate legal advice from operational facts. A single source of truth should record discovery time, affected systems, data types, patient counts, containment actions, backup restoration, ransom communications, and every notification decision.
The decision log should capture: who decided what, when, on what information, and what alternatives were rejected. Record the rationale for treating or not treating the event as a breach, the advice received on each state and contract, and the approval for any external communication. Preserve logs, ransom note, email headers, and forensic images; do not let remediation destroy evidence. The communications lead should prepare holding statements for patients, the hospital customer, and regulators, with a cadence and an escalation path for media. The clinical or customer lead should assess whether billing downtime affects patient care or cash flow. The ransom decision should be separated from notification and made with counsel and law enforcement, including sanctions screening and payment-risk analysis. Report to the board within 24 hours and daily thereafter.
3. Recommend remediation and post-incident actions, including how to report to the board and regulators without overpromising.
Read the worked answer
Remediation should address the intrusion path and the response gaps. Harden identity controls with multi-factor authentication, privileged-access review, and segmentation of billing from clinical systems. Test backup restoration for the full application, not just files. Close the vulnerable entry point identified by forensics and scan for persistence. Review third-party and hospital contract notification clauses, and build a notification matrix by state, regulator, and customer. Run a tabletop with the 72-hour clock, the ransom scenario, and uncertain exfiltration. Assign owners and dates, and track completion through the risk committee.
Report to the board with known facts, unknowns, decisions taken, and the remediation plan. Avoid saying the incident is “contained” if containment is only partial, and avoid promising that no data left the environment until forensics supports it. To regulators, provide the required notices on time, state the investigation status, and commit to supplemental updates rather than a final conclusion. Include a corrective-action plan with measurable milestones: MFA coverage, segmentation completion, restoration test results, and notification drill completion. After the final report, update the risk assessment and consider whether the incident changes the enterprise risk appetite or vendor strategy. Document any residual risk accepted by the board.