By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Ransomware
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Ransomware is malicious software that encrypts an organization’s files and systems so they can no longer be used, after which the attackers demand payment in exchange for the key to unlock them. The HIMSS Dictionary describes it as a constantly changing form of malware whose purpose is to make files, and every system that depends on them, unusable until a ransom is paid.
Modern ransomware rarely stops at encryption. Many attackers copy data out of the network first and then threaten to publish it, a tactic known as double extortion. That means an organization can restore from backups and still face a data breach.
A typical attack unfolds in stages:
| Stage | What Happens |
|---|---|
| Initial Access | Attackers get in through a phishing email, stolen credentials, an exposed remote-access service, or an unpatched system |
| Expansion | They move laterally, escalate privileges, and map the network, often for days or weeks before anyone notices |
| Data Theft | Sensitive data, including PHI, is copied out to support extortion |
| Encryption | Servers and workstations are encrypted, often with backups targeted first |
| Extortion | A ransom note demands payment for decryption keys and for not leaking the stolen data |
| Recovery | The organization contains the attack, restores systems, investigates, and meets notification obligations |
⚠️ Exam Alert: Ransomware is a type of malware, and phishing is one of its most common entry points, so the terms are related but not interchangeable. Under HIPAA, HHS guidance states that when ransomware encrypts ePHI, a breach is presumed to have occurred unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised. Also distinguish the business continuity plan (keeping operations going during the outage) from the disaster recovery plan (restoring systems and data afterward).
🌐 Why It Matters: Real-World Healthcare IT Context
Healthcare is an attractive target because downtime is intolerable. A retailer can close for a day; a hospital cannot stop caring for patients, and attackers know that pressure makes payment more likely.
The February 2024 attack on Change Healthcare showed how far the damage can reach. Because the company processes claims and pharmacy transactions for a large share of the U.S. healthcare system, the attack disrupted billing, prior authorizations, and prescription processing for providers and pharmacies nationwide. According to the HHS Office for Civil Rights, Change Healthcare ultimately reported that approximately 192.7 million individuals were affected, the largest healthcare breach on record.
The federal response emphasizes shared defenses. The HHS 405(d) program publishes the Health Industry Cybersecurity Practices (HICP) guidance for organizations of every size, and HHS has issued voluntary cybersecurity performance goals for the health sector. HHS’s ransomware fact sheet ties the threat directly to HIPAA obligations for risk analysis, security incident procedures, contingency planning, and breach notification.
Common weaknesses that ransomware exploits:
- Missing multi-factor authentication on email, remote access, and privileged accounts
- Unpatched internet-facing systems and end-of-life software
- Flat networks that let attackers move freely once inside
- Backups that are online, untested, or reachable from the compromised network
- Third-party vendors with broad access and weak controls
- Downtime procedures that exist on paper but have never been practiced
Strengths of resilient organizations:
- Multi-factor authentication, least-privilege access, and prompt patching
- Network segmentation that separates clinical, administrative, and device networks
- Offline or immutable backups that are tested by actually restoring them
- An incident response plan with clear roles, legal counsel, and communication steps
- Regular downtime drills that include clinical units, not just IT
- Vendor risk management that reviews business associates’ security, not just their contracts
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
When ransomware takes the EHR offline, nurses carry the organization through the outage on paper and memory.
At the Bedside
Downtime changes everything at once. Medication administration moves to paper MARs printed from the last downtime report, barcode scanning stops, monitors may still display but no longer flow into the chart, and lab and imaging results arrive by phone or courier. Nurses become the human interface between disconnected systems.
The safety risks are real: missed or duplicated doses, transcription errors, lost results, and delays in care. Calm, practiced downtime routines, including clear documentation of what was given and when, are what keep a cyberattack from becoming a patient harm event.
In Clinical Workflow
Downtime kits, business continuity access reports, and paper forms only help if nurses know where they are and how to use them. Units that drill downtime regularly recover faster and make fewer errors than units that see the forms for the first time during a real event.
Recovery is its own workflow. When systems return, paper documentation must be reconciled into the EHR, orders must be re-verified, and medication records must be checked against what was actually given. Nurses are central to that back-entry, which can take days after a long outage.
Nurses are also part of prevention. Phishing emails, suspicious links, and unexpected requests for credentials often reach clinical staff first, and reporting them quickly gives security teams a chance to stop an attack before it spreads.
In EHR Implementation (Go-Live Perspective)
Downtime readiness is built during an Epic implementation, not improvised later. Build teams configure business continuity access devices and downtime reports, decide what prints automatically on each unit, and design how charting will be reconciled after recovery. Go-Live readiness checklists include downtime procedures and training.
End-user support analysts often help test those procedures in dress rehearsals and planned downtimes. Confirming that each unit’s downtime device works, that reports print with current data, and that staff can find the paper forms is unglamorous work that pays off on the worst day the organization will ever have.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Ransomware appears in CAHIMS questions about security, continuity, and risk:
| CAHIMS Domain | How Ransomware Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule and breach presumption; federal cybersecurity guidance; third-party and supply chain risk |
| Clinical Informatics | Downtime procedures; patient safety during outages; reconciliation after recovery |
| Healthcare Information & Systems Management | Backups, segmentation, multi-factor authentication, patching, and incident response |
| Management & Leadership | Business continuity and disaster recovery planning; risk management; communication during a crisis |
Key Terms to Know Alongside Ransomware
- Malware — any software designed to damage, disrupt, or gain unauthorized access to systems
- Phishing — deceptive messages that trick users into revealing credentials or opening malicious content
- Business Continuity Plan (BCP) — the plan for keeping critical operations running during a disruption
- Disaster Recovery Plan (DRP) — the plan for restoring systems and data after a disruption
- Incident Response — the coordinated process of detecting, containing, investigating, and recovering from a security event
- Breach Notification — the HIPAA requirement to notify individuals, HHS, and sometimes the media after a breach of unsecured PHI
HIMSS Organizational Position
HIMSS addresses ransomware through its Healthcare Cybersecurity Community, its long-running Healthcare Cybersecurity Survey, and public policy advocacy on healthcare cybersecurity. Members can find incident response and resilience guidance through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — Fact Sheet: Ransomware and HIPAA https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/ransomware-fact-sheet/index.html
- HHS OCR — Change Healthcare Cybersecurity Incident Frequently Asked Questions https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
- HHS 405(d) — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HHS — Cyber Security Guidance Material https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html
- NIST SP 800-66 Rev. 2 — Implementing the HIPAA Security Rule https://csrc.nist.gov/pubs/sp/800/66/r2/final
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply