Resources • Cybersecurity Incident Response Checklist: redacted... • natrevmd.com (redacted • Trusted Resources: redacted A healthcare record sells for 10 to 40 times more than a credit card number on criminal markets, and it cannot be cancelled the way a card can. Independent practices hold that data with the least defense in the entire healthcare system: one IT contractor, a server in a closet, and no one whose job it is to think about security. Attackers know it. Why independent practices are the target Three attack vectors specific to practice settings: Phishing emails that look like they are from an EMR vendor, billing company, or payer. Remote access set up for telehealth or post-COVID flexibility that was never properly secured. Third-party vendor access, where a billing company or IT contractor gets breached and the practice is compromised through them. What to do in the first 24 hours if you are hit 1. Isolate immediately. Disconnect affected systems from the network, but do not power them down, powered systems preserve evidence forensic teams need. 2. Call your cyber insurance carrier first, then your attorney. Do not call the attackers, and do not pay anything without guidance. 3. Document everything from the moment you discover the breach. This becomes the foundation of your HIPAA breach report if one is required, and the 60-day notification clock starts at discovery. 4. Do not restore from backup until forensics has cleared the system. Restoring too early can reintroduce the attack. Three asks for your team this week • Ask your IT contractor: do we have multi-factor authentication enabled on our EMR, our email, and our remote access tools? If not, when can you turn it on? • Ask your IT contractor: when was the last time we tested a restore from our backup? Can you run a test this month? • Call your business insurance broker: do we have cyber liability coverage? If not, what would it cost to add it? Episode breakdown • Why independent practices are the target • Three attack vectors specific to practice settings • Five things most practices are not doing • What to do in the first 24 hours if hit • Three asks for your team this week