Ransomware in Private Practice: A 7-Step Response Plan for Therapists

A convincing supplier email, an attachment opened between appointments, then a screen demanding payment: ransomware can stop a solo practice in minutes. For a therapist, this is not just a scheduling problem. Client charts, contact details, receipts, and consent forms may all be affected.

This operational guide helps you act in the right order. It is not legal or incident-response advice for your specific situation; consult qualified technical, legal, and professional guidance when an incident occurs.

Start here: do not pay and do not panic

The Canadian Centre for Cyber Security advises against paying a ransom. Payment does not guarantee decryption or prevent disclosure, and it can fund further attacks. Avoid rebooting, deleting files, or trying to “clean” the computer without guidance; those actions can destroy evidence or spread the problem.

Your first objective is to contain the incident, protect people, preserve evidence, and restore care safely.

The 7-step response plan

1. Isolate the affected device immediately

Unplug the network cable and turn off Wi-Fi. Do not connect an external drive or sign back into cloud services from that device. If your phone or tablet shares the same accounts, do not start changing passwords from a device that may also be compromised.

Record the time, the message on screen, affected files, and recent activity. A photo of the screen taken with your phone is useful evidence.

2. Keep care going without creating a new privacy problem

Tell affected clients only what they need to know through the usual channel: a technical issue is temporarily affecting appointments or communications. Do not send clinical details through unsecured email or create a new personal spreadsheet for charts.

Use a documented temporary process: the minimum appointment list, emergency contact information, rescheduling steps, and secure entry of notes once the system is restored.

3. Get technical help and preserve evidence

Contact your IT provider, practice-management platform, or incident-response firm promptly. Ask for an assessment before restoring anything. Retain suspicious emails, available logs, and screenshots; do not circulate them to unauthorized people.

Where criminal activity is suspected, reporting to the Canadian Centre for Cyber Security and local police may support the investigation and your documentation.

4. Secure accounts from a clean device

With technical guidance, reset passwords for affected accounts from a known-clean device. Start with your primary email, software administrator account, cloud storage, and billing accounts. Revoke active sessions and enable multi-factor authentication wherever available.

Then check email forwarding rules, recovery addresses, new administrator users, and unusual payments.

5. Assess whether this is a privacy incident

Ransomware is not automatically a confirmed breach, but you must assess whether personal information was accessed, copied, lost, or made unavailable. Record known facts, unknowns, information categories, potentially affected clients, and mitigation steps.

In Quebec, confidentiality incidents must be entered in the required register; where there is a risk of serious injury, the Commission d’accès à l’information and affected individuals must be notified promptly. Organizations subject to PIPEDA have comparable record-keeping duties and must report and notify when there is a real risk of significant harm. Confirm the rules that apply to your practice with legal counsel or your professional regulator.

6. Restore only from verified backups

Do not restore until the cause is understood. A synchronized folder is not necessarily a backup: encryption or deletion can sync too. First clean or replace the device and fix the entry point; then restore a known-good copy.

Test a small sample of charts, a calendar, and a receipt template before resuming full operations. Confirm that access permissions are still appropriate.

7. Run a blameless review

After recovery, record what happened, response times, costs, decisions, notices, and improvement actions. An incident is also a continuity-of-care test.

The most valuable changes are often straightforward: automatic updates, separate accounts, MFA, versioned or offline backups, phishing awareness, and a quarterly restore test.

Print-ready checklist

Isolate the device; do not pay or destroy evidence.
Record the time, symptoms, and systems involved.
Contact IT support or the vendor from a clean device.
Maintain appointments using the minimum necessary information.
Reset priority credentials and enable MFA.
Assess and document the privacy incident.
Restore only after a known-good backup is verified.
Update the plan and test recovery.

Lower the impact before the next incident

Practice-management software does not replace your professional duties, but it can reduce scattered copies of sensitive information and make access easier to manage. FYL.care brings scheduling, records, notes, and receipts together for private practitioners.

Free. No credit card. Forever.

Try FYL.care for free →

FAQ

Should I pay if ransomware encrypts my client records?

No. Canadian authorities advise against payment because it does not guarantee data recovery or prevent a leak. Isolate the device, contact a qualified responder, and assess available backups.

Do I need to notify every client?

Not automatically. First assess the incident. In Quebec and under PIPEDA, notification depends in part on the risk of serious or significant harm. Keep a record, document the assessment, and obtain advice tailored to your situation.

Is cloud backup enough?

Not always. Synchronization can copy encryption or deletion. Use restorable versions, MFA-protected access, and regular recovery tests.