Healthcare Incident Response: Diversion and HHS Reporting

A cyber incident in a hospital is a patient safety event first and a data breach second, yet most incident response plans are written the other way round. When ransomware or a forced shutdown takes out the electronic health record, the first decisions are clinical: whether to divert ambulances, postpone elective work, move to paper and check that infusion pumps and imaging still behave. The HIPAA breach clock, law enforcement contact and medical device reporting follow close behind. This guide joins those threads into one response flow for US hospitals, health systems and their business associates. It is written for CISOs, incident commanders, emergency managers and privacy officers, and it assumes your downtime procedures already exist (see the Clinical Downtime Procedures Guide).

Key takeaways

Run the cyber response inside hospital incident command. ASPR TRACIE guidance places the cyber team under the Incident Management Team so clinical, facilities and IT decisions share one chain of command and one request log.
Decide shutdown and diversion authority in advance. ASPR lists diverting ambulances, disconnecting from the internet and shutting down email or VPN as decisions that need a named owner, and notes that in extreme cases shutdown may be needed before leadership approves.
Treat ransomware on ePHI as a presumed breach. HHS says encryption of ePHI by ransomware is a breach unless a documented four-factor risk assessment shows a low probability of compromise.
Restore by patient safety, not by server list. Rank applications by patient safety impact, dependencies and staff affected, and expect gradual restoration: "Systems will NOT be restored at once," in ASPR's words.
Close the identity door before reconnecting. The Change Healthcare breach began with one remote access login without MFA; recovery must reset the credentials, sessions and service accounts the intruder could have touched.

How a healthcare incident differs from the general case

The Incident Response Guide covers the general lifecycle. Four things change in a clinical setting.

Factor	General enterprise	Hospital or health system
First priority	Contain spread, protect data	Keep patients safe while containing spread; every isolation step has a clinical cost
Who decides	CISO and incident manager	Incident Commander under the hospital emergency plan, with clinical leadership, CISO and privacy officer
Continuity method	Failover or wait	Paper downtime procedures, diversion, cancelled electives, patient transfers
Connected equipment	Servers and endpoints	Infusion pumps, ventilators, imaging, lab analysers and their interfaces, many vendor-managed
Main reporting rules	Sector and state breach laws	HIPAA Breach Notification Rule (45 CFR 164.400-414), state laws, FDA device reporting routes, accreditor and CMS contacts
Third parties in the blast radius	Suppliers	Business associates, clearinghouses, pharmacies, regional partner hospitals and EMS

The first hours: clinical safety decisions

The ASPR TRACIE incident response checklist and its readiness and response considerations document set out what the command team should settle early. In order of urgency:

Declare and name the trigger person. ASPR describes a lead Incident Commander who declares downtime. Record the time, because it also starts several evidence and reporting timelines.
Confirm working communications. Identify which phone systems, portable radios, mobile apps, clinical phones and overhead paging still work, and post a generic inbound phone message and status updates.
Check clinical equipment. Ascertain the status of diagnostic and biomedical equipment. ASPR flags ventilators and infusion pumps as mission-critical devices that need backups or a known source of replacements.
Decide on service changes. Consider postponing elective surgery, diagnostic procedures and clinic visits. Plan whether to divert ambulances and for how long, based on the scale and expected duration, and give partner hospitals a forecast.
Move to downtime ordering. Paper orders may lack dose range, units, frequency or route, and drug interaction and allergy alerts may be unavailable. ASPR suggests pre-printed order sets (for example sepsis and diabetic ketoacidosis), forms for high-risk medications such as insulin infusions, and read-back for verbal orders.
Plan for transfers. A regional outage can stop transfers of critical patients to nearby facilities. Prepare a way to send records with transferred patients and to arrange discharges by phone.
Secure the building. If badge systems are down, add officer presence in high-risk areas and use sign-in sheets for visitors and contractors.

Duration assumptions: ASPR notes that for large organisations short-term downtime may be three days or fewer and long-term downtime more than three days, and advises erring towards the longer procedure when duration is unclear. Our recommendation at NHI Mgmt Group: plan staffing and supplies for at least two weeks on paper for any ransomware event that reaches the EHR.

Diversion and service reduction: decision guidance

Diversion protects incoming patients from a hospital that cannot safely treat them, but it pushes load onto neighbours that may share vendors and networks. Use a short decision table agreed in advance with clinical leadership and your healthcare coalition.

Situation	Typical response (NHI Mgmt Group suggestion)	Who to tell
EHR down, imaging and lab working, expected under 12 hours	Downtime procedures, no diversion, defer non-urgent electives	Internal staff, healthcare coalition for awareness
EHR, imaging or lab interfaces down, duration unknown	Selective diversion (for example stroke, STEMI or trauma if imaging is impaired), cancel electives	EMS and regional partners through the coalition and state, local health department
Multiple clinical systems down, devices affected, over three days likely	Broad diversion, transfer planning for high-acuity patients, repatriation plan	Coalition, state, local health department, The Joint Commission and CMS as ASPR suggests considering
Incident at a shared vendor or clearinghouse, no local encryption	No diversion; pharmacy, claims and eligibility workarounds	Payers, pharmacies, business associate

ASPR's appendix advises informing local partners through the healthcare coalition and the state first. Agree the wording of diversion notices in advance, and decide who can lift diversion as systems return.

Containment and eradication in a clinical network

Isolate by zone, not by building: segmenting clinical networks beforehand is what lets you disconnect corporate IT without cutting off device networks. See the Hospital Clinical Network Segmentation Guide.
Coordinate device actions with clinical engineering: do not patch, reimage or power-cycle a connected medical device during an incident without clinical engineering and the manufacturer. See the Medical Device Security Guide.
Separate eradication from restoration: ASPR's appendix warns that many intrusions restore services without removing the threat. Do not reconnect a restored EHR to a domain the attacker still controls.
Bring in vendors and insurers early: ASPR's checklist lists contacting IT vendors and cyber insurance representatives, who may provide backup services, connectivity or equipment.
Preserve evidence while you keep care going: image affected servers before rebuilding where possible, keep logs from remote access gateways, identity providers and EDR, and record every clinical workaround and its start time.

Where identity fits

Healthcare intrusions usually begin with a valid account and end with privileged access across shared clinical systems. Containment and recovery must cover non-human identities as well as staff.

Identity	Why it matters in a hospital incident	Recovery action
Remote access and vendor support accounts	Common entry point; vendors hold standing access to imaging, lab and EHR systems	Disable, then re-enable one vendor at a time with phishing-resistant MFA and time-bound access
Domain and EHR administrator accounts	Attackers use them to push ransomware and disable backups	Reset twice where Active Directory is affected, rebuild tier 0 from clean media
Interface engine and HL7 service accounts	Hold broad read and write access to patient data flows	Rotate credentials before restarting interfaces; confirm each interface's source and destination
Device and modality service accounts	Shared or vendor-default credentials on devices and their servers	Change with the manufacturer's procedure; record which devices could not be changed
Shared clinical workstation logins	Tap-and-go and kiosk sessions can mask attacker activity	Review session logs, force re-enrolment where tokens were exposed

See the Healthcare Identity Security Guide and Recovering IAM and PAM After Ransomware or Domain Compromise.

Recovery: restoring by patient safety

Use the business impact analysis and dependency map: ASPR recommends an application dependency map that shows restoration priority, with tested recovery time and recovery point objectives.
Rank by clinical criteria: ASPR suggests factors such as patient safety, number of staff and patients affected, dependent systems, revenue lost per day and legal implications.
Restore identity and core infrastructure first: directory, PAM and DNS before clinical applications, so restored systems authenticate against a clean source.
Validate before go-live: clinical users test a restored application with known patients before it is released; back-enter downtime records in an agreed order.
Reopen services in stages: lift diversion only when the services that triggered it are back and staffed, and plan repatriation of patients who were transferred.
Roll back if needed: keep paper processes ready to resume if a restored system shows integrity problems or reinfection.

HHS breach reporting and other notifications

The HIPAA Breach Notification Rule applies to covered entities and business associates. HHS presumes an impermissible use or disclosure is a breach unless a risk assessment shows a low probability that PHI was compromised, based on four factors: the nature and extent of the PHI, the unauthorised person, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. HHS's ransomware fact sheet applies this directly: encryption of ePHI by ransomware is a breach unless that low probability can be shown, and PHI that full disk encryption transparently decrypted for a logged-in user is unsecured.

Notice	When it applies	Deadline (as stated by HHS)
Individuals	Every breach of unsecured PHI	Without unreasonable delay, no later than 60 days after discovery; substitute notice (website for 90 days or media, plus a toll-free number for 90 days) if contact details are out of date for 10 or more people
Media	More than 500 residents of a state or jurisdiction	Without unreasonable delay, no later than 60 days after discovery
HHS Secretary	500 or more individuals	Without unreasonable delay, no later than 60 days after the breach
HHS Secretary	Fewer than 500 individuals	May be logged and reported within 60 days after the end of the calendar year of discovery
Business associate to covered entity	Breach at or by the business associate	Without unreasonable delay, no later than 60 days after discovery

Business associate incidents: in its Change Healthcare FAQ, OCR says only one entity needs to complete notifications, the covered entity may delegate individual notices to the business associate, and an addendum can update an earlier report to HHS. Agree who notifies in writing.
Burden of proof: covered entities and business associates must be able to show notices were made or that no breach occurred, so keep the risk assessment and its evidence.
Law enforcement: HHS advises contacting the local FBI or US Secret Service field office for ransomware. CMS's cyber attacks page lists the FBI CyWatch line, CISA, and HHS HC3 for sector analysis.
Medical devices: CMS's page points to FDA MedWatch for device problems and to [email protected] for urgent device issues tied to a cyberattack. Confirm the current route on FDA's site before relying on it.
State law and contracts: state breach laws, payer contracts and accreditor expectations may add shorter clocks. See the Healthcare Cyber Regulation Map.

Involve counsel early so the forensic work is structured with privilege in mind. See the Legal Privilege in Incident Response Guide.

Implementing the plan

Align plans: map the cyber incident response plan to the hospital emergency operations plan so the same Incident Command roles are used. Name a representative and backup from each department, as ASPR recommends.
Write the authority matrix: who may disconnect the internet, shut down email or VPN, divert ambulances and lift diversion, with deputies for nights and weekends.
Pre-stage the paper: downtime order sets, high-risk medication forms, registration packs and printed contact lists, stored where staff can find them without the network.
Pre-agree notifications: templates for HHS, individuals, media and partners, plus business associate agreements that state who notifies and how fast information flows.
Exercise: ASPR suggests system-level exercises once or twice a year and a full tabletop annually. Include a multi-day EHR outage and a business associate outage.
Test rollback: rehearse returning to paper after a failed restoration, not only the first switch to paper.

Detection and measurement

Time to downtime declaration: from first confirmed indicator to formal declaration.
Time to diversion decision: and how long diversion lasted against the forecast given to partners.
Clinical safety events during downtime: medication errors and delayed results reported through the patient safety system.
Restoration against RTO: per tier-one clinical application.
Breach assessment completion: days from discovery to a documented four-factor assessment, against the 60-day outer limit.
Credential reset coverage: percentage of privileged, vendor and interface accounts rotated before reconnection.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev 5	HIPAA Security Rule
Executing the plan with partners	RS.MA-01	IR-4, IR-8	Security incident procedures, 164.308(a)(6)
Notifying stakeholders and regulators	RS.CO-02, RS.CO-03	IR-6	Breach Notification Rule, 164.400-414
Downtime and continuity	RC.RP-01	CP-2	Contingency plan, 164.308(a)(7)
Restoring systems and communicating progress	RC.RP-01, RC.CO-03	CP-10	Contingency plan, 164.308(a)(7)
Credential recovery	RC.RP-01	IA-5	Access control, 164.312(a)

See the HIPAA Security Rule Guide for the safeguards themselves.

Common failure patterns

Remote access without MFA: the Change Healthcare breach started with a stolen password on a remote access portal and spread nationally because pharmacies and practices depended on one clearinghouse.
No owner for diversion: clinical and IT leaders each wait for the other, so ambulances keep arriving at a hospital that cannot read images.
Restoring before eradicating: the EHR comes back on a domain the attacker still controls and is encrypted a second time.
Paper procedures only tested for hours: stock, staffing and back-entry plans run out after a few days.
Breach assessment left until systems are back: the 60-day limit runs from discovery, not from recovery.
Vendor access re-enabled in bulk: every support account returns at once, including the one that was abused.

Practitioner checklist

Embed the cyber incident team in the hospital Incident Command structure with a named trigger person and deputies.
Agree in writing who can disconnect the internet, shut down email or VPN, divert ambulances and lift diversion.
Keep a diversion decision table agreed with clinical leadership and your healthcare coalition.
Pre-stage downtime order sets, high-risk medication forms and printed contact lists.
Maintain an application dependency map with tested RTO and RPO for tier-one clinical systems.
Rotate vendor, interface, device and privileged credentials before reconnecting restored systems.
Start the four-factor breach risk assessment on day one and document it.
State in each business associate agreement who notifies, how fast and with what information.
Exercise a multi-day EHR outage and a clearinghouse outage at least once a year.

Standards and references

Related NHI Mgmt Group resources: Clinical Downtime Procedures Guide · Threat Actors Targeting Healthcare Guide · HIPAA Security Rule Guide · Medical Device Security Guide · Incident Response Guide. This guide summarises the HIPAA Breach Notification Rule and related federal guidance and is not legal advice.

Healthcare Incident Response Guide: Patient Safety, Diversion Decisions and HHS Breach Reporting