When Change Healthcare was disrupted by a ransomware attack in February 2024, the effects were felt far beyond a single company. Claims processing stalled, pharmacies struggled to verify coverage, and many small practices discovered that a system they had never thought of as their own was, in practice, essential to getting paid. It has been observed that the most damaging healthcare incidents often begin not inside a practice's own network but with a vendor on which daily operations quietly depend.
Why Vendor Dependence Is the Quiet Risk
Most small healthcare organizations rely on many outside services, including electronic health record platforms, billing clearinghouses, e-prescribing tools, patient portals, and cloud storage. Each is typically governed by a business associate agreement, and that agreement is often considered proof that the risk has been handled. However, a signed agreement describes who is responsible for a breach; it does not describe how a clinic will continue to see patients when the vendor is unavailable. As was discussed in our earlier article on HIPAA risk analysis enforcement, a thorough risk analysis is expected to account for every system that touches patient information, and vendors belong in that inventory.
A practical review begins with a simple question asked of each vendor: what would the practice do tomorrow morning if this service were unavailable for a week? In my experience, the answers are often uncomfortable, since paper downtime forms are outdated, front-desk staff have never rehearsed manual check-in, and the vendor's incident contact is stored only in the failed system. Documenting these answers, assigning an owner to each, and revisiting them annually is generally regarded as a reasonable standard of care.
Building Readiness Before an Incident
Recovery planning is the second half of the picture. Backups are often assumed to be protective, yet ransomware operators increasingly target backup repositories first, and a copy that cannot be restored within a clinically acceptable window offers little comfort. The difference between having backups and being able to recover was explored in our comparison of backup and disaster recovery, and restoration time should likewise be tested, recorded, and measured against how long a practice can operate without scheduling, charting, and billing. Critical data should also be stored in immutable form.
Guidance from the U.S. Department of Health and Human Services on the HIPAA Security Rule remains the most reliable starting point for aligning these efforts with regulatory expectations, and proposed updates to that rule have signaled that stronger expectations around asset inventories and recovery timelines may follow. Because the rule is still evolving, practices are advised to confirm current requirements. Personally, I believe the most valuable step is also the least technical: a short tabletop exercise in which a clinic's leaders talk through a vendor outage from the first phone call to final recovery. The gaps that emerge on paper are far cheaper to correct than those discovered during a live incident. A practice that knows its dependencies, has rehearsed its downtime procedures, and has tested its restores will not avoid every disruption, but it will be able to keep caring for patients.
