Ransomware Prevention for Medical and Legal Practices

Why ransomware crews prefer medical and legal practices, the prevention stack that actually works, the double-extortion breach trap, and the first 24 hours.

By Scott McAuley · Aug 4, 2026 · 10 min read

Ransomware crews don't pick victims the way most practice owners imagine. There's no one scanning the Houston market for your firm by name. But the criminal economics have a clear shape, and they run straight through medical and legal practices: concentrated confidential data, professionals who bill by the hour, patients and clients who cannot wait, and a duty of confidentiality that makes the threat of publication as coercive as the encryption itself.

This guide is the practice-specific treatment of a topic we cover broadly in our [small business cybersecurity guide](/resources/small-business-cybersecurity-guide): what makes practices preferred targets, the prevention stack mapped to how a practice actually operates, why "we have backups" is only half an answer now, and what the first 24 hours should look like if the bad day arrives.

Why Practices Are Preferred Targets

Three structural facts make a medical or legal practice a better ransomware victim than an ordinary business of the same size:

The data is maximally sensitive. Patient charts, case files, privileged communications, financial records — information protected not just by preference but by law and professional duty. That sensitivity is leverage: the attacker isn't just holding your operations hostage, they're holding your obligations.

Downtime tolerance is near zero. A 12-attorney firm that can't reach its document management system is paying twelve professionals to not bill. A practice with a full waiting room and no schedule, no charts, and no billing sees revenue stop within the hour. Attackers understand that a victim losing five figures a day negotiates differently than one who can limp along on paper for a month.

Extortion now comes in pairs. Modern ransomware operations steal a copy of your data *before* encrypting it — in recent cyber-insurance claims data, double extortion appears in roughly 88% of ransomware cases. For a regulated practice, that changes everything, and we'll come back to it, because it's the single most misunderstood fact in practice security.

None of this requires the attacker to know you exist beforehand. The overwhelming majority of intrusions begin with automation — mass phishing, credential lists tried against every login page, scanners hunting unpatched remote access. Practices get selected *after* the automated foothold, when a human looks at what they've caught and recognizes a victim with maximum pressure to pay. "Too small to target" is exactly backwards: practices are small enough to be under-defended and valuable enough to be worked hard.

The Prevention Stack, Mapped to Practice Reality

The controls that stop ransomware are not exotic. What matters is completeness — every control below, not a favorite three — because attackers only need the one door you left open.

| Control | What it means in a practice |

|---|---|

| MFA everywhere | A second factor on email, remote access, the EHR or practice management platform, and every admin account. Stolen passwords are the number-one way in; MFA defeats most of them outright. |

| EDR on every device | Endpoint detection and response — behavior-based protection that recognizes encryption behavior and isolates the machine, including the front-desk PC and the partner's home laptop. Traditional antivirus watches for yesterday's files; EDR watches for today's behavior. |

| Backups attackers can't reach | The 3-2-1 pattern with at least one copy offline, off-site, or immutable — storage that stolen admin credentials cannot alter or delete. Attackers hunt backups first, precisely to take recovery off the table. Restore-test on a schedule; an untested backup is a hope. |

| Patching discipline | Automated, tracked updates for operating systems, applications, and — critically — anything internet-facing: VPN appliances, remote access gateways, the practice's firewall. Unpatched edge devices are a top entry vector. |

| Email filtering | Advanced filtering and malicious-link protection in front of every inbox, thinning the phishing flood before humans have to judge it. |

| Phishing training as a professional duty | Short, ongoing training with simulated phishing — framed not as an IT chore but as part of the duty of confidentiality every clinician and attorney already carries. The staff member who reports a suspicious click in minutes is your best control; a blame culture that makes people hide clicks is your worst vulnerability. |

If your practice is missing MFA or reachable-by-attacker backups, fix those two before reading further — they're the difference between an incident and an ending. The deeper how-to for each layer, insurance implications included, is in [the full cybersecurity guide for regulated SMBs](/resources/small-business-cybersecurity-guide).

Two vertical notes. For medical practices, every one of these controls doubles as a HIPAA Security Rule safeguard, and the inventory-and-risk-assessment discipline in our [HIPAA compliance and healthcare IT guide](/resources/hipaa-compliance-healthcare-it-guide) is where a practice discovers which systems the controls must cover. For law firms and other professional offices, the same stack maps onto ABA-grounded confidentiality duties and, increasingly, onto the security questionnaires your own clients send — a dynamic we unpack in our [professional practice IT guide](/resources/professional-practice-it-guide).

The Double-Extortion Twist: Why Perfect Backups Don't End the Problem

Here is the fact that reshapes ransomware planning for every regulated business:

If the attacker exfiltrated a copy of your data, you likely have a reportable breach — even if you restore every system flawlessly by morning.

For a medical practice, patient data in criminal hands generally triggers HIPAA breach notification duties: patients, HHS, and in larger incidents the media, on a regulatory clock. For a law firm, client confidences in criminal hands trigger ethical obligations to inform affected clients, and frequently contractual notification duties to the businesses you represent. The restore fixed your downtime; it did nothing about the copy.

Attackers built their business model on exactly this asymmetry. The encryption extorts your uptime; the stolen copy extorts your obligations. It's also why paying for "deletion" is such a weak position — you're trusting a criminal's word that the copy is gone, while your notification duties may exist regardless.

The planning consequence: prevention and detection deserve equal budget with recovery. A practice that only invests in backups has planned for half the attack.

Detection Speed: The Variable You Control on Game Day

Between the phishing click and the encryption there is a window — attackers spend hours to days inside a network first, escalating privileges, finding the backups, staging the attack. Everything about the outcome turns on whether that dwell time ends with detection or with encryption.

This is the practical case for EDR with someone actually watching it — a managed detection setup that isolates one compromised workstation at 2 a.m. has turned a potential practice-ender into a Tuesday. The same logic favors a few unglamorous habits: alerting on new admin accounts, reviewing VPN logins from unexpected places, and treating "the system is acting weird" reports from staff as security signals rather than annoyances.

Speed matters after detection too. The practices that fare best have decided *in advance* who can order systems disconnected — including the EHR, including during clinic hours — because the twenty-minute wait for a partner to get out of a deposition is exactly the window an active attacker needs.

The First 24 Hours: What Good Looks Like

If ransomware detonates anyway, the first day determines most of the damage. The sequence that works:

1. Contain immediately. Disconnect affected systems from the network — pull cables, disable Wi-Fi — but don't power machines off (memory holds forensic evidence) and don't wipe anything.

2. Call the insurer's breach hotline early. Most cyber policies require it before other spending, and the insurer brings the incident response firm and counsel. Calling your IT provider and your carrier are call one and call two.

3. Engage counsel before communicating. Notification duties for practices are real and clock-driven; improvised communication creates liability. One voice, lawyer-reviewed.

4. Preserve evidence. The forensic question — *was data exfiltrated, and which records* — decides your notification obligations. Wiping and reinstalling on day one can destroy the answer and force you to assume the worst-case scope.

5. Operate in downtime mode. Paper intake, phone triage, rescheduling protocols — the same emergency-mode thinking Gulf Coast practices already apply to hurricanes, written down before it's needed.

Every step above should live in a written incident response plan — printed, because it may need to survive your systems being down. The plan template and the annual tabletop exercise that keeps it real are covered in the incident response section of [our cybersecurity guide](/resources/small-business-cybersecurity-guide); recovery-time objectives and tested restore procedures are the domain of our [backup and disaster recovery](/services/backup-disaster-recovery) practice, where we build them with the compliance documentation practices need.

The Insurance Thread Running Through All of It

Cyber insurance now functions as a second regulator for practices, and its requirements are almost a photocopy of the prevention stack above: carriers routinely require MFA on email, remote access, and admin accounts as a condition of coverage, and increasingly expect EDR, segregated and tested backups, training records, and an incident response plan. Applications are binding documents — a "yes, MFA everywhere" that turns out to have excluded the billing manager's remote login is how claims get denied at the worst possible moment.

The productive way to see this: the insurer's checklist, the regulator's expectations, and actual ransomware defense have converged on the same list. Build the stack once, document it, and you've satisfied all three. Before your next renewal, verify every application answer against reality — the current carrier landscape and how to prepare is covered in our guide to [cyber insurance requirements for Houston businesses](/resources/cybersecurity-insurance-requirements-houston-businesses).

Where to Start

For a practice starting from "we have antivirus and a backup drive," the priority order is: MFA everywhere this month; backups verified isolated and restore-tested this month; EDR deployed this quarter; email filtering and training launched this quarter; incident response plan written and insurance answers verified before renewal. None of it requires enterprise budget — it requires follow-through, which is what a managed security relationship exists to provide.

Texas Management Group has been securing Houston-area medical and legal practices since 2014. If you want to know exactly where your practice stands against this list, [contact us](/contact) — we'll assess your environment, benchmark it against what attackers and insurers both check, and give you the findings in writing whether or not you engage us to fix them.

*Scott McAuley is the founder and CEO of Texas Management Group, and founder of Talos Automation and Talk Is Cheap — 25+ years running IT, communications, and automation for Texas businesses.*

Frequently Asked Questions

Why do ransomware attackers target medical and legal practices?

Because practices concentrate highly confidential data, cannot tolerate downtime, and carry professional and regulatory duties that amplify the pressure to pay. Most intrusions begin with automation — phishing and unpatched remote access — so being small offers no protection; practices are selected after the foothold, when attackers recognize a high-pressure victim.

Do backups protect a practice from ransomware?

They solve the downtime half of the problem. Modern ransomware also steals a copy of your data before encrypting — the double-extortion pattern that appears in the large majority of recent ransomware insurance claims — and for a regulated practice that stolen copy is generally a reportable breach even after a perfect restore. Backups must be paired with prevention and fast detection.

What backups actually survive a ransomware attack?

Copies the attacker's stolen admin credentials cannot reach: offline, off-site, or immutable storage layered on the standard 3-2-1 pattern, with restore tests on a schedule. Attackers hunt reachable backups first, specifically to take recovery off the table before triggering encryption.

What should a practice do in the first 24 hours of a ransomware attack?

Contain by disconnecting affected systems (without powering them off or wiping), call the cyber insurer's breach hotline before other spending, engage counsel before any communication, preserve forensic evidence, and shift to written downtime procedures. All of it should already exist in a printed incident response plan.

Should a practice ever pay the ransom?

That decision belongs with your insurer, counsel, and incident response team — never made alone or quickly. Payment doesn't undo notification obligations for regulated data and doesn't guarantee recovery or deletion of the stolen copy. The materially stronger position is backups the attacker couldn't touch and evidence of what was and wasn't taken.