Ransomware in a Clinic: What Nine Days Without the EHR Really Looks Like

Day one: the front desk finds the paper forms

The practice manager of a four-physician pediatric practice arrives on a Monday to find the electronic health record will not open. The vendor's status page says nothing. The IT firm calls back at nine with the word nobody wants to hear before coffee.

By ten the waiting room has eleven families in it. The front desk has found the paper intake forms in a cabinet, from before the EHR went in. A nurse is writing weights and temperatures on sticky notes. The first physician sees a child with a fever and cannot see her allergy list or the note from the last visit. She asks the mother. The mother thinks it was amoxicillin, but is not sure.

Refills stall on day two, because the e-prescribing link runs through the same system. The pharmacy calls. Then the pharmacies call. Referrals to the specialist go out by fax, once someone finds the fax. Billing stops entirely.

Day nine is when the EHR comes back, restored from a backup the vendor kept. The practice then has to decide something harder than any of this: whether the attacker copied the records before locking them.

In Abu Dhabi the Department of Health should already have heard about the attack within 24 hours of the first morning, and now it will ask the same question. The decision is the manager's, and she has no logs to answer it with.

I have watched a cyberattack stop a hospital. A small practice does not get the hospital's incident team. It gets the practice manager, a legal pad and whatever was prepared before Monday.

What this means in plain words

Healthcare ransomware is malicious software that scrambles the systems a practice runs on, then demands payment for the key. In a clinic the systems are not abstract. They are the chart, the prescription, the schedule and the claim.

EHR downtime is the period when the electronic health record is unavailable. Most downtime procedures were written for a power cut lasting an afternoon. Nine days is a different document.

Exfiltration is the attacker copying records before encrypting them, because a stolen patient list is worth money whether or not the ransom is paid.

A reportable breach is an incident your regulator must hear about. In Abu Dhabi that is the Department of Health under ADHICS v2; under the federal PDPL it is the UAE Data Office. Whether records were copied, and not just locked, is a question only evidence answers, and that evidence is either kept before the attack or not at all.

Notification clocks vary by regulator. Abu Dhabi's ADHICS v2 requires the Department of Health to be told within 24 hours; the PDPL requires the Data Office to be notified on becoming aware of the breach. Both clocks start whether or not you are ready.

The attack is survivable. How well you survive it is decided beforehand, the way a surgical checklist decides most of what happens in theatre before the first incision.

The numbers that matter

In the United States there were 772 large healthcare breaches in 2025 affecting 138.5 million people, and 87% of breaches in the first half of 2026 were hacking incidents, according to HIPAA Journal's 2026 analysis. Hacking, not lost laptops, is now the typical cause.

The median US healthcare breach in the first half of 2026 affected 2,451 individuals, per HIPAA Journal's H1 2026 figures. That is not a hospital system. That is a practice the size of the one in this story. Smaller providers are now the typical victim.

ADHICS v2.0, issued by the Department of Health Abu Dhabi in 2024, requires breach notification to the Department within 24 hours. For a UAE clinic, the first day of the attack is also the reporting deadline.

What to do this week

1. Confirm where the EHR backup lives, who controls it, and when it was last restored as a test. If the vendor keeps it, get the restore time in writing. If you keep it, put one copy where the network cannot reach it. (CIS 11 Data Recovery)
2. Print the downtime kit and put it where the front desk can find it in the first ten minutes: intake forms, a medication reconciliation sheet, a paper schedule template, and the phone numbers of your three busiest pharmacies. (CIS 17 Incident Response Management)
3. Write the one-page incident plan with names, not roles: who calls the IT firm, who calls the insurer, who calls the regulator, who talks to patients. Put the 24-hour ADHICS clock at the top, and HIPAA's 60-day clock if you also treat US patients. (CIS 17 Incident Response Management)
4. Turn on the logs that show which records were opened or exported, and keep them somewhere the attacker cannot delete. These logs are what let you answer "was anything copied" with evidence instead of hope. (CIS 8 Audit Log Management)
5. Find the patient data outside the EHR: the recall texting tool, the fax-to-email inbox, the spreadsheet on the manager's desktop. Encrypt or remove what does not need to be there. (CIS 3 Data Protection)
6. Run a 30-minute tabletop with the whole team: "It is Monday and the EHR is gone." You will find the gaps in half an hour that the real event would find over nine days. (CIS 17 Incident Response Management)

Where AccuSights fits

Our assessment is written for a practice, not a data center: where the records live, whether the backup has ever been restored, and whether the logs exist to answer the breach question with evidence. The Cyber Hygiene Test takes three minutes and asks in plain language. For a clinician's view of what to fix first, meet your Risk Assessor, and I will make sure the answer fits the way a clinic runs.

We map the assessment to DoH ADHICS and to DHA, and the read-only compliance agent shows whether your restores have been tested rather than merely scheduled, and where patient data sits outside the systems you believe hold it. We have no access and do not remediate; you or your IT partner fix, we show you where.

You would not begin an operation without the checklist on the wall. Put the downtime kit on the same wall, and Monday becomes a bad day instead of a bad month.