Ransomware at the Scheduling Vendor: Starting the Breach Clock
Riverside Valley Health is a three-hospital system in Ohio, Kentucky and Indiana with 62,000 patient portal users. On Monday April 8, its scheduling vendor MedQueue discovers that ransomware deployed the previous Friday encrypted a database server holding appointment notes, insurance member IDs and free-text intake comments. MedQueue notifies Riverside on April 11. The forensic firm finds no evidence of exfiltration but says it cannot rule out limited access. The encrypted server was not covered by the vendor's encryption-at-rest policy, a configuration drift. A 2022 backup copy of similar data sits unencrypted on a separate server that was untouched. Riverside's incident team wants to pay the $180,000 demand to obtain a decryption key and to keep the event quiet while it investigates. Portal users include residents of all three states and 1,400 in California.
1. When does the HIPAA 60-day notification clock start, and what notifications are required?
Read the worked answer
HIPAA deemed discovery runs from the moment the covered entity knew or, with reasonable diligence, would have known, and a business associate's knowledge is imputed to the covered entity. MedQueue discovered the incident on Monday April 8, so Riverside's 60-day clock starts there, not April 11. The outside date is June 7.
Notifications: individuals without unreasonable delay and no later than 60 days; HHS through the breach portal, filed at the same time as individual notice when 500 or more individuals are affected; and media notice to prominent outlets serving each state where more than 500 residents are affected. With users across Ohio, Kentucky, and Indiana plus 1,400 in California, the media threshold likely applies in the larger states and must be tested against actual residency counts, not the portal total.
State law applies on top because HIPAA does not preempt more stringent provisions: Indiana requires notice within 45 days, Ohio within 45 days, while California and Kentucky require notice without unreasonable delay. The earliest applicable deadline governs, so calendar the 45-day state dates first; the federal 60 days is a backstop, not a target.
2. Is this a reportable breach given unconfirmed exfiltration and the untouched 2022 backup?
Read the worked answer
Under HHS ransomware guidance, encryption of ePHI is presumed to be a breach unless the entity demonstrates a low probability of compromise using the four-factor assessment: the nature and extent of the PHI, the unauthorized recipient, whether the data was actually acquired or viewed, and the extent of mitigation.
Here the factors cut against a low-probability finding. Appointment notes, member IDs, and free-text intake comments are sensitive and identifying; the attacker had administrative control of the server; exfiltration cannot be excluded; and the data was unencrypted at rest because of configuration drift. No evidence of exfiltration is not the same as evidence of no access, and the burden of demonstrating low probability rests on the entity.
The untouched 2022 backup is irrelevant. It is a different data set, and its encryption status does not cure the compromised server. Treat the incident as reportable, document the reasoning, and do not let the absence of confirmed exfiltration push notice past the deadline. If forensics later narrows the affected population, send supplemental notice rather than waiting for certainty that may never arrive.
3. Evaluate the proposal to pay the ransom and to delay notification while investigating.
Read the worked answer
Ransom payment is a business and sanctions question, not a legal shield. Before paying, screen the actor against OFAC's sanctions list, consult the cyber insurer, and engage law enforcement. Paying can itself violate sanctions, does not guarantee a working key, and does not prevent publication of any stolen data.
Delaying notification to keep the event quiet is not a lawful option. HIPAA permits delay only when a law enforcement official states in writing that notice would impede a criminal investigation, and even then only for a limited period. The state deadlines are already running. The defensible path is coordinated disclosure with forensics, insurer, and counsel, plus a call-center script and identity monitoring offer proportionate to the data elements.
The vendor relationship is a separate finding. Check the business associate agreement for notification timing, encryption commitments, and audit rights; the configuration drift leaving a server unencrypted is a vendor-management failure. Request the SOC 2 report, the configuration baseline, and remediation evidence, and consider whether the scheduling function should be re-tendered.