Clinical Report: Your Practice Has Fallen Victim to a Cyberattack—Now What?

Overview

This report outlines the response of the Talley Eye Institute to a ransomware attack, detailing the steps taken to recover data and assess the compromise of personal health information (PHI). Key findings include the importance of legal compliance and the implementation of robust cybersecurity measures post-incident.

Background

Cyberattacks on healthcare practices are increasingly common, posing significant risks to patient data and operational integrity. The Talley Eye Institute's experience highlights the critical need for preparedness and effective response strategies in the event of a cyber incident. Understanding the legal and practical implications of such attacks is essential for safeguarding patient information and maintaining trust.

Data Highlights

No numerical data or trial data available in the article.

Key Findings

• The Talley Eye Institute was attacked by Gandcrab V5.2 ransomware, affecting all servers and several workstations.
• Despite the attack, the practice continued to see patients using alternative data sources for historical information.
• PHI was not compromised, although an old account was accessed during the attack.
• The practice incurred significant costs for data recovery and legal compliance, totaling over $200,000, which was covered by cybersecurity insurance.
• Improvements post-attack included hourly backups and enhanced cybersecurity measures.

Clinical Implications

Healthcare providers must have a robust incident response plan in place to address potential cyberattacks. Regular training and updates to cybersecurity protocols are essential to protect patient data and ensure compliance with legal requirements.

Conclusion

The Talley Eye Institute's experience serves as a crucial case study for healthcare practices, emphasizing the importance of preparedness and swift action in the face of cyber threats.

References

1. Ophthalmology Management, 2025 -- Your Practice Has Fallen Victim to a Cyberattack—Now What?
2. ophthalmic professional, 2025 -- What Should You Do If Your Practice Has Fallen Victim to a Cyberattack?
3. Ophthalmology Management, 2025 -- Understanding Today’s Cybercrime
4. ADA News, 2022 -- HHS warns health care providers of new ransomware threat
5. HHS Cyber Gateway -- HPH Cybersecurity Performance Goals
6. Breach Notification Rule | HHS.gov
7. Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals | JAMA
8. HHS Cyber Gateway
9. Breach Notification Rule | HHS.gov
10. Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals | Emergency Medicine | JAMA | JAMA Network