Security incident response plan, ransomware playbook and incident log

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.308(a)(6) (security incident procedures). Breach notification follows document 22 (45 CFR 164.400–414).

Approved by Dr. Maria Lindqvist, Owner. Plan owner: Janelle Okafor, Office Manager. Backup designee: Dr. Maria Lindqvist.

Purpose

This plan tells every workforce member of Granite City Family Dental what to do in the first hour of a security incident, who takes charge, how the incident is contained and recovered, and how the practice decides whether patients and HHS must be notified. The incident log at the end is kept even in a year with no incidents; the burden of proving that an event was not a breach rests on the practice.

1. Definitions

• Security incident: the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations (45 CFR 164.304). A failed attempt is still an incident and is logged.
• Privacy incident: any use or disclosure of PHI, in any form, that this binder's policies do not permit, such as a misdirected fax, a chart left in a public area or a conversation overheard.
• Breach: an impermissible acquisition, access, use or disclosure of unsecured PHI that is presumed reportable unless the four-factor assessment in document 22 shows a low probability that the PHI was compromised (45 CFR 164.402).
• Ransomware: malware that encrypts or steals data and demands payment. HHS treats ransomware encryption of ePHI as a presumed breach unless the four-factor assessment shows otherwise.

2. Severity levels

• Level 1 – Minor: single misdirected fax or email recalled; no PHI viewed. Officer logs and closes.
• Level 2 – Moderate: PHI possibly viewed by an unauthorized person; lost unencrypted device. Four-factor assessment within 5 business days.
• Level 3 – Major: ransomware, account takeover, confirmed exfiltration or more than 50 patients affected. Activate the response plan, call the IT provider, counsel and insurer the same day.

The Security Officer assigns the level when the report is received and may raise it as facts emerge. Every level is logged.

3. How staff report

Tell the Privacy or Security Officer immediately, in person or by phone, then complete an Incident Report Form the same day. Do not investigate, delete or forward anything yourself.

• Do not turn the computer off, do not delete messages, do not reply to the attacker, and do not discuss the event with patients or on social media.
• If the officers cannot be reached within 30 minutes, call Dr. Maria Lindqvist and then the IT provider directly.
• Reporting in good faith is never punished.

4. Incident response contacts

Keep a printed copy of this table at the front desk and in the downtime binder; during a ransomware event the electronic copy may not be reachable.

Other numbers: HHS OCR breach portal https://ocrportal.hhs.gov/ocr/breach ; FBI Internet Crime Complaint Center https://www.ic3.gov ; CISA report line 888-282-0870.

5. Response phases

Authority: 45 CFR 164.308(a)(6)(ii).

Identify (first hour). The Security Officer takes the report, opens an Incident Report Form, assigns a severity level, and decides who else is called. For Level 2 and 3, CRU Technologies is called at once. Write down times; they matter later.

Contain (same day). Stop the spread without destroying evidence: disconnect the affected device from the network (unplug the cable or turn off Wi-Fi, do not power it off), disable the compromised account, reset the password and revoke sessions, block the sender, recall the message, retrieve the paper. For Level 3, contain first and investigate second.

Eradicate. The IT provider removes the malware or the unauthorized access, closes the path it came through (patch, setting, account), and confirms no other device or account is affected. The practice does not reuse a compromised device until the IT provider has rebuilt it.

Recover. Restore systems from clean backup under document 17, verify data is complete, re-enable accounts with new passwords and MFA, and watch the logs closely for 30 days. Patients are seen under emergency-mode procedures until the EHR is back.

Lessons learned (within 30 days). The Security Officer writes a short summary: what happened, what worked, what did not, and what changes. Each change becomes a risk-register entry with an owner and date, and training is updated where a person's action let the incident in.

6. Ransomware playbook

Owner of the pay / do-not-pay decision: Dr. Maria Lindqvist. The default decision at Granite City Family Dental is not to pay; paying funds further crime, does not guarantee recovery, may violate federal sanctions, and the HHS four-factor analysis is unaffected by payment.

1. Isolate. Disconnect every affected device from the network immediately. Leave it powered on. Disconnect the backup target if it is reachable from the network and has not yet been touched.
2. Preserve. Photograph the ransom screen. Do not wipe, reinstall or run cleanup tools. Keep the ransom note and any email that preceded it.
3. Call the IT provider. CRU Technologies leads the technical response and confirms the scope: which systems, which data, whether data was copied out.
4. Call counsel and the insurer the same day. The attorney and the cyber insurance claims line in the contacts table are called before any communication with the attacker. The insurer may supply a forensic firm and a negotiator; counsel protects the investigation.
5. Decide. Dr. Maria Lindqvist makes the pay / do-not-pay decision with counsel and the insurer in the room. Payment is considered only if clean backups are confirmed unusable and patient safety requires it; the decision and its reasons are written down.
6. Restore from the immutable backup. Granite City Family Dental keeps an immutable or offline copy with CRU Backups; restore from it onto rebuilt systems, never onto the infected ones.7. Run emergency mode. Paper downtime forms and printed schedules (document 17) keep patients seen. The phones are forwarded if the phone system is affected.
7. Assess the breach. Ransomware is a presumed breach of every record on the affected systems. Janelle Okafor with counsel begins the four-factor assessment in document 22 within 5 business days; the 60-day notification clock started on discovery.
8. Report. Counsel advises on reporting to the FBI (IC3) and CISA. HHS and patients are notified under document 22 if the assessment does not show low probability of compromise.
9. Rebuild and harden. Devices are reimaged, every password in the practice is changed, MFA is confirmed everywhere, and the way in is closed. The lessons-learned summary is presented at the next annual review.

7. Hand-off to the breach assessment

Every incident in which PHI may have been seen, taken or lost by someone not permitted to have it is handed to Janelle Okafor with counsel on the day it is contained. The assessor completes the four-factor worksheet in document 22, records the conclusion in the incident log, and, if notification is required, starts the letters. The decision that an event was not a breach is documented just as carefully as one that was; OCR asks for both.

8. Testing this plan

The practice walks through this plan once a year as a tabletop exercise (a ransomware scenario and a lost-laptop scenario) and records it in the contingency test log (document 17). The contacts table is checked at the same time.

9. Enforcement

Failing to report an incident, hiding one, or interfering with a response is handled under the sanction policy (document 05).

Incident Report Form

Purpose: to record a suspected or confirmed security or privacy incident at Granite City Family Dental. Complete the same day the event is noticed and hand it to the Security Officer.

Date and time of incident: __________________________________________

Date and time discovered: __________________________________________

Location / system affected: __________________________________________

Reported by (name and role): __________________________________________

Contact information: __________________________________________

Description of what happened (who, what, where, how it was noticed):

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

Was PHI involved? [ ] Yes [ ] No [ ] Unknown

If yes, approximate number of patients and the kind of information (names, dates of birth, Social Security numbers, diagnoses, insurance, other): __________________________________________

Immediate actions taken (device disconnected, account disabled, message recalled, item retrieved):

__________________________________________________________________________

__________________________________________________________________________

Severity level assigned by the Security Officer: [ ] Level 1 [ ] Level 2 [ ] Level 3

Who was called and when (IT provider, counsel, insurer, vendor):

__________________________________________________________________________

Follow-up actions required and owner:

__________________________________________________________________________

Handed to breach assessor (Janelle Okafor with counsel) on: ______________

Four-factor outcome (from document 22): [ ] Not a breach, documented [ ] Breach, notifications required [ ] Under review

Reported by signature: ___________________________ Date: ______________

Security Officer review (Janelle Okafor): ___________________________ Date: ______________

Incident log — 2026

Authority: 45 CFR 164.308(a)(6)(ii); 164.414 (burden of proof). Retain six years. If nothing has happened this year, enter one row dated today reading "No incidents to date".

Log reviewed at the annual meeting by: ___________________________ Date: ______________

Approval

Plan approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor Signature: ___________________________ Date: ______________