Incident Response Plan for a Small to Medium Sized Hospital

TL;DR

This paper proposes a structured incident response plan for small to medium hospitals, adapting the proven Incident Command System to improve cybersecurity incident handling and compliance.

Contribution

It introduces a standardized incident response framework tailored for healthcare organizations, emphasizing training, staffing, and equipment based on emergency service models.

Findings

Enhanced incident response efficiency

Improved compliance with privacy laws

Reduced data loss during incidents

Abstract

Most small to medium health care organizations do not have the capability to address cyber incidents within the organization. Those that do are poorly trained and ill equipped. These health care organizations are subject to various laws that address privacy concerns, proper handling of financial information, and Personally Identifiable Information. Currently an IT staff handles responses to these incidents in an Ad Hoc manner. A properly trained, staffed, and equipped Cyber Incident Response Team is needed to quickly respond to these incidents to minimize data loss, and provide forensic data for the purpose of notification, disciplinary action, legal action, and to remove the risk vector. This paper will use the proven Incident Command System model used in emergency services to show any sized agency can have an adequate CIRT