Article guide
Published October 22, 2026.
A staff member clicks a link and a screen fills with a ransom message. Or the practice management system slows down, files rename themselves, and the front desk cannot open the schedule. The first hour is not the time to diagnose the malware. It is the time to protect patients, preserve evidence, and get the practice onto a controlled downtime process.
The front desk is often the first witness. It may see the pop-up, hear a caller say the practice’s email is sending strange messages, or notice that the schedule will not load. The response should be written down before that happens, because a panicked team will either overreact or keep working as if nothing is wrong.
Stop, preserve, and notify
The first actions should be approved by the practice’s incident response lead. A general sequence is:
- Stop using the affected device or account.
- Disconnect the device from the network only if the incident lead instructs it.
- Do not power off, wipe, or reset equipment unless instructed.
- Preserve screenshots, messages, and the time the problem was noticed.
- Notify the designated incident lead, IT contact, and privacy officer.
- Record who discovered the issue and what they observed.
Do not send a practice-wide email about the incident from a potentially compromised account. Use a previously agreed out-of-band channel, such as a phone call or a separate messaging system. The phishing email checklist covers the earlier recognition step, while this article focuses on the first hour after a suspected incident.
Do not delete suspicious emails or files to “clean up.” They may be evidence. If a device is isolated, label it and keep it away from patients and staff who do not need access.
Move to the downtime process
Once the incident lead activates downtime, the front desk needs paper or offline tools:
- Today’s schedule and patient contact list.
- New-patient forms and intake instructions.
- Insurance information already verified.
- A call log for messages and arrivals.
- The approved emergency routing instructions.
- A list of patients with appointments in the next 48 hours.
If the practice management system is unavailable, do not recreate the entire database from memory. Capture the minimum information needed to keep the day safe and to reconcile later. Record the source of each fact, such as a printed schedule or a patient’s confirmation.
The practice should have a downtime kit that is tested and stored where the front desk can find it. A binder that nobody has opened in two years is not a plan.
Protect patient communication
Patients may notice the disruption before the practice says anything. They may receive strange emails, see a portal outage, or hear a rumor. The front desk needs approved language that does not speculate.
A safe holding statement is:
“We are experiencing a system disruption and are following our downtime process. We can still help you with scheduling and urgent questions by phone. We will update you when our systems are restored.”
Do not say “your data is safe,” “there was no breach,” or “we were hacked” until the incident lead and legal counsel approve the statement. Do not discuss the incident with reporters, vendors, or other patients.
If a patient reports a suspicious email or text claiming to be from the practice, record the message, the sender, and the time. Do not click links or reply. Route it to the incident lead.
Keep clinical boundaries intact
A cyber incident does not change the front desk’s role. Staff should still avoid diagnosis, treatment advice, and emergency triage beyond the approved protocol. If a patient describes urgent symptoms, use the practice’s emergency routing plan and document the caller’s words.
If the practice cannot access medical records, do not guess about medications, allergies, or prior treatment. Tell the patient what the office can and cannot confirm, and route clinical questions to the available clinician.
Preserve the call and message trail
During downtime, keep a single log for:
- Calls received and returned.
- Patients who arrived or missed an appointment.
- Prescription or records requests.
- Urgent or clinical messages.
- Patients who asked about the incident.
- Messages sent through the website or portal.
Assign an owner to each item. The log will be used to reconcile the schedule and patient communication after systems return. It may also support the incident review. The missed call recovery log is a useful starting structure for the call portion.
Coordinate with the privacy officer
A cyber incident may trigger a HIPAA breach risk assessment. The privacy officer, legal counsel, and incident lead decide whether notification is required. The front desk should not make that determination.
Reception can help by preserving facts:
- Which systems were affected.
- When the disruption began.
- Which patients were scheduled or contacted during the downtime.
- What information was visible on screens or paper.
- Who accessed the affected devices.
Do not speculate about what the attacker saw or took. Record observations, not conclusions.
Restore service in a controlled way
When IT authorizes restoration, test before resuming normal work:
- Confirm the schedule is accurate.
- Confirm appointment statuses and messages.
- Confirm the phone and portal are working.
- Confirm users can access the records they need.
- Confirm no suspicious forwarding rules or accounts remain.
Reconcile the downtime log against the restored system. Look for appointments that were missed, duplicate bookings, messages that were not sent, and patients who were told something that is no longer true.
Review and rehearse
After the incident, update the plan with what actually happened. Include the front desk in the review. The team can identify the first visible sign, the slowest part of the downtime process, and the patient questions that were hardest to answer.
Run a short tabletop exercise at least once a year. Practice a phone outage, a lost schedule, and a suspicious email. The goal is not to make the front desk into a security team. It is to make sure the first hour is calm, documented, and safe.
If your practice needs help maintaining patient communication during a system disruption, talk with us about front-office continuity.
Sources and verification notes
- CISA StopRansomware: Provides federal guidance on ransomware prevention, response, and reporting. It does not replace the practice's incident response plan or legal counsel.
- HHS HIPAA Security Rule: Describes administrative, physical, and technical safeguards for electronic protected health information.
- NIST Cybersecurity Framework: Provides a risk-management framework for identifying, protecting, detecting, responding to, and recovering from incidents.
Sources support the specific guidance identified above. Policies, prices, and service scope can change; verify current details before relying on them.
Common questions
Should the front desk turn off a computer that may be infected?
Follow the practice's incident response plan and the instruction of the designated IT or security contact. Do not power equipment off, wipe it, or delete messages unless instructed.
Can reception tell patients whether their data was breached?
No. The privacy officer and legal counsel determine notification obligations. Reception should use approved holding language and route patient questions.
What should the front desk do first?
Stop the spread if instructed, preserve evidence, notify the incident lead, and move to the approved downtime process for scheduling and patient communication.