The First 72 Hours After a Cyberattack: What Every Medical and Dental Practice Needs to Know Before It’s Too Late

Many physicians, dentists, and practice managers assume that recovering from a cyberattack simply means restoring computers and getting back to work.

Unfortunately, the reality is far more complicated.

Within hours of a ransomware attack or data breach, patient care can be disrupted, appointments canceled, revenue lost, and HIPAA compliance concerns can quickly emerge. The first 72 hours often determine how much damage your practice experiences—and how quickly you recover.

Whether you operate a single-provider office or a large multi-location practice, understanding what happens during those critical first three days can help you prepare before disaster strikes.

Hour 1: Your Practice Discovers the Cyberattack

The first signs often appear without warning.

Employees begin reporting strange computer behavior. Patient records suddenly become inaccessible. Staff members cannot log in. Computer screens may display ransomware demands, and phone calls may begin coming in from patients wondering why appointments are delayed.

At this stage, every minute matters.

Your Immediate Priorities

• Disconnect affected computers and devices from the network.
• Contact your IT provider.
• Preserve evidence for digital forensic investigators.
• Activate your cyber incident response plan.
• Notify your cyber liability insurance carrier.

The sooner qualified professionals become involved, the better your chances may be of containing the attack and limiting further damage.

This is also when having a well-designed medical and dental cyber liability insurance policy can become critically important.

Hours 2–6: Daily Operations Begin to Break Down

As systems remain offline, everyday tasks become increasingly difficult—or impossible.

Staff may lose access to:

• Electronic Health Records
• Appointment schedules
• Insurance verification systems
• Patient medical histories
• Electronic prescribing systems
• Claims-processing platforms
• Billing software

Without these systems, productivity can slow dramatically while stress and uncertainty increase throughout the office.

Even when an IT provider is working quickly to restore access, the practice must still determine how it will operate, communicate with patients, document care, protect sensitive information, and maintain revenue.

Hours 6–12: Patient Care Starts Suffering

Technology problems can quickly become patient-care problems.

Many practices may be forced to:

• Cancel appointments.
• Delay procedures.
• Reschedule patients.
• Switch to handwritten documentation.
• Turn away new patients.
• Delay prescription processing.
• Operate with limited access to patient histories.

Patients may become frustrated. Phone lines can become overloaded, and staff members may struggle to answer questions while working without their normal systems.

At the same time, the practice’s reputation may begin to suffer—especially if patients believe their personal or medical information could be at risk.

Hours 12–24: Financial Losses Begin Adding Up

While revenue may slow—or stop entirely—most business expenses continue.

Your practice may still be responsible for:

• Employee payroll
• Office rent or mortgage payments
• Medical and dental equipment leases
• Insurance premiums
• Software subscriptions
• Utility expenses
• Vendor invoices
• Business loan payments

Even one day of downtime can create financial strain, particularly for practices that depend on a steady schedule of appointments and procedures.

For many healthcare providers, cyber business interruption coverage for medical and dental practices may be one of the most valuable components of a comprehensive cyber liability policy.

Coverage varies by policy, carrier, waiting period, exclusions, and the cause of the interruption. That is why reviewing the details before an incident occurs is so important.

Day 2: Cybersecurity Experts Take Over

Once the immediate crisis is contained, the investigation and recovery process intensifies.

Cybersecurity professionals may begin determining:

• How the attackers entered the network.
• Whether patient information was accessed or stolen.
• Which computers, servers, and systems were compromised.
• Whether data backups remain usable.
• Whether malicious software is still active.
• Whether other connected systems or vendors are at risk.

Depending on the incident, your medical or dental practice may also need to work with:

• Digital forensic investigators
• Cybersecurity consultants
• HIPAA compliance specialists
• IT recovery teams
• Privacy and breach-response attorneys
• Public relations professionals
• Patient-notification vendors

These professionals may coordinate with the practice’s IT provider, legal counsel, management team, and cyber insurance carrier to help investigate the attack and support recovery.

A properly structured cyber liability and data breach insurance policy may provide access to experienced vendors who regularly respond to cyber incidents.

Day 3: HIPAA and Legal Responsibilities Expand

If Protected Health Information may have been exposed, additional legal, regulatory, and communication responsibilities may arise.

Your practice may need to:

• Determine whether a reportable data breach occurred.
• Evaluate applicable HIPAA notification requirements.
• Identify which patients may have been affected.
• Prepare patient communications.
• Coordinate with privacy and breach-response counsel.
• Respond to regulatory agencies.
• Document the practice’s investigation and response.
• Continue working with the cyber insurance carrier.

Meanwhile, your team may still be attempting to restore systems, answer patient questions, manage appointments, process claims, and resume normal operations.

This is one reason cyber insurance should be considered as part of a broader commercial insurance and risk management strategy rather than as a stand-alone policy.

Recovery Often Lasts Weeks—or Even Months

Many practice owners are surprised to learn that recovery does not necessarily end after the first three days.

Depending on the severity of the attack, your practice may spend weeks or months addressing:

• Business interruption
• Data and system restoration
• Computer or equipment replacement
• Cyber insurance claims
• Cybersecurity improvements
• Patient notification requirements
• HIPAA investigations
• Reputation management
• Revenue recovery
• Credit or identity monitoring
• Ongoing network monitoring

The attack itself may take only minutes, but the financial, operational, legal, and reputational consequences can continue long after the systems are restored.

The Best Time to Prepare Is Before an Attack Happens

No medical or dental practice expects to become the next cybercrime victim.

However, preparation can help reduce financial losses, operational disruption, confusion, and recovery time.

A Strong Cyber Risk Management Plan Should Include:

• A documented cyber incident response plan
• Employee cybersecurity awareness training
• Multi-factor authentication
• Regular software updates and security patches
• Secure and regularly tested data backups
• Vendor cybersecurity reviews
• Access controls based on employee responsibilities
• Email filtering and phishing protection
• A current HIPAA security risk assessment
• Comprehensive cyber liability insurance

These safeguards work together. No single firewall, backup system, employee policy, IT provider, or insurance policy can eliminate every cyber risk.

The strongest protection comes from combining technology, employee training, documented procedures, experienced advisors, and appropriate insurance coverage.

Cyber Liability Insurance Helps Protect More Than Your Computers

Many business owners assume cyber insurance only pays to repair computers or restore damaged systems.

Depending on the policy, a quality cyber liability policy may help address expenses related to:

• Business interruption
• Lost income
• Data recovery
• Digital forensic investigations
• Legal and breach-response services
• HIPAA response costs
• Patient notification
• Credit or identity monitoring
• Public relations assistance
• Cyber extortion
• Regulatory investigations
• Third-party privacy claims

Choosing the right protection before an incident occurs can make the difference between a manageable interruption and a financially devastating event.

Medical and dental practice owners can explore cyber liability insurance for medical and dental practices to better understand the risks, coverage considerations, and recovery resources available.

The Goal Isn’t Just Recovering—It’s Continuing to Care for Patients

Technology can often be repaired.

Networks can be rebuilt.

Servers can be restored.

But maintaining patient trust while protecting your practice’s financial stability, reputation, and ability to provide care is what matters most.

At McClatchy Insurance, we help medical and dental practices prepare for evolving cyber threats with thoughtful insurance and risk management strategies designed to support business continuity when it matters most.

Because the best time to prepare for a cyberattack is before one ever happens.

To discuss your practice’s current coverage and cyber exposures, request a medical or dental cyber insurance consultation with McClatchy Insurance.

Frequently Asked Questions

Why Should I Work With an Independent Insurance Agency?

An independent insurance agency may provide access to multiple insurance carriers and help practice owners compare coverage options based on their operations, technology, patient information, employees, vendors, and potential cyber exposures.

The objective is not simply finding a policy. It is developing an insurance strategy that supports the practice over the long term.

Medical and dental practice owners can review McClatchy Insurance’s broader commercial insurance solutions for healthcare businesses when evaluating their overall protection.

Does My IT Company Already Handle Cybersecurity?

Your IT provider may manage important cybersecurity tools, backups, updates, access controls, and network monitoring. However, even strong cybersecurity cannot guarantee that a cyberattack or data breach will never occur.

Your IT company helps reduce and manage technical risk. Cyber liability insurance may help address the financial, legal, regulatory, and operational consequences when preventive measures are not enough.

Can Cyber Insurance Help With Lost Income?

Some cyber liability policies include business interruption coverage that may help replace qualifying income lost because of a covered cyber event.

Coverage depends on the policy terms, waiting period, cause of loss, exclusions, and documentation of the practice’s financial loss. Practice owners should review these provisions carefully before an attack occurs.

Why Choose McClatchy Insurance?

At McClatchy Insurance, we believe insurance should be part of a broader business and risk management conversation—not simply another annual renewal.

We take time to understand how your medical or dental practice operates, where it is growing, what information it maintains, and which risks could affect its success.

Rather than focusing solely on policies and premiums, we help practice owners evaluate thoughtful coverage strategies designed to protect their business, employees, patients, reputation, and long-term financial stability.

Whether your practice needs medical and dental cyber liability insurance, professional liability protection, business property coverage, employment-related coverage, or a broader commercial insurance strategy, our team is ready to help you prepare for the unexpected.