Quick answer
Prepare an evidence map before an incident: which systems retain useful events, for how long, who can retrieve them and what their gaps mean. During an incident, qualified responders preserve and analyze evidence while clinical continuity proceeds. Recovery confirms service restoration; it does not by itself establish the intrusion’s scope or whether information was acquired.
Plan to answer questions that restoration cannot
After ransomware disrupts a facility, the EHR becomes available again. Leadership still needs to know which identities and systems were affected, how long the activity persisted, what information was accessible and whether the attacker reached connected services. A restored backup answers none of those questions by itself.
NIST SP 800-61 Revision 3 emphasizes preserving investigation records and incident data with integrity and provenance, and validating the incident's magnitude beyond initially known targets. HHS's ransomware guidance discusses the implications for security incidents and breach assessment. Use current legal requirements for the eventual determination rather than historical attack statistics from that guidance.
Build an evidence availability map
This original map turns “we have logs” into answerable questions.
| Evidence source | Question it may help answer | Limitation to document |
|---|---|---|
| Identity-provider events | Which accounts authenticated, from where, and with what result? | Retention, clock basis, missing legacy authentication |
| Endpoint telemetry | What executed or changed on enrolled devices? | Unmanaged or offline devices; collection gaps |
| EHR and export history | Which application actions and exports were recorded? | Actions not logged; supplier-only access to detail |
| Network and remote-access records | Which systems communicated and through what path? | Content visibility, sampling and coverage |
| Cloud storage or archive events | Which objects were accessed or altered? | Disabled auditing or short retention |
| Supplier incident records | What occurred within the contracted service? | Shared-environment boundaries and unverified supplier conclusions |
List the retrieval contact, authorized access route, retention period and expected delivery format for each source. Test access while systems are healthy. A contract promising assistance is less useful if the required telemetry was never enabled.
Make negative findings conditional on coverage
In a fictional exercise, endpoint monitoring covers 38 of 45 relevant computers. Investigators find no malicious activity on the 38. That does not establish the status of the seven uncovered computers. Likewise, a 14-day log window cannot fully answer a suspected 30-day intrusion.
Reports should distinguish observed activity, activity not observed within a defined evidence set, and questions that cannot be resolved. Preserve the denominator: devices, accounts, services and time periods examined. A narrative saying “no evidence of access” needs that context to be meaningful to the privacy reviewer.
Preserve actions and provenance
Qualified responders should direct collection and handling under the organization's approved procedures. Record source, collection time and time zone, collector, method, integrity evidence where appropriate, transfers and access restrictions. Keep the originals or preserved source evidence separate from working interpretations. Investigation material itself may contain resident information and sensitive security details.
Coordinate containment, evidence preservation and recovery rather than requiring frontline clinical staff to choose among them without support. Some actions must occur immediately to protect care or stop harm; document their reasons and effects on available evidence. Do not impose a blanket “never turn off a device” instruction across all circumstances.
Exercise the supplier handoff
Use a synthetic incident with one facility device, a central identity service and the hosted application. Ask the proposed suppliers to demonstrate how they would preserve relevant events, identify affected tenant data, provide timelines and correct an initial incomplete population. Establish which services require an extra forensic engagement and which contacts operate outside ordinary support hours.
Include a changed-facts exercise. The initial investigation identifies one account; later evidence adds a service credential and an archive. The scope record and affected-data assessment should expand without erasing the first version. Notifications and external communications need a controlled route because preliminary findings can change.
Turn findings into purchasing decisions
Compare available evidence, retrieval latency, retained detail, access costs and gaps that the facility must fill. Longer retention may improve investigations but adds cost and privacy responsibilities; select it through the risk and incident-response process rather than inventing a universal number of days for every SNF.
The acceptance output is a tested evidence map and a documented handoff to qualified responders. It gives the organization a stronger basis for containment, scope assessment and legal review when an incident occurs, without claiming that monitoring or backup tools eliminate uncertainty.
Questions & answers
Does no observed exfiltration prove no data left?
No. The conclusion depends on the coverage, retention and reliability of the evidence. Missing telemetry limits what can be established.
Should facility staff improvise forensic imaging during an outage?
Use the authorized response plan and qualified responders. Uncoordinated changes can destroy evidence or interfere with safe restoration.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.