Kansas Healthcare Ransomware Risk: What HIPAA Actually Requires After an Attack

Healthcare ransomware in Kansas is no longer hypothetical. Ascension Health, the parent of Ascension Via Christi facilities across Wichita, was hit nationally in May 2024 by Black Basta ransomware. The Change Healthcare attack of February 2024 affected payment and pharmacy claims processing at virtually every healthcare provider in the state. Smaller Kansas clinics and specialty practices have been targeted throughout 2025 and 2026 — most of them quietly, without public disclosure, because the breach reporting threshold under HIPAA leaves room for organizations to handle smaller incidents without notification.

That last point is important and widely misunderstood. This article is for the practice administrator, IT director, or compliance officer at a Wichita-area clinic, specialty practice, ambulatory surgery center, or hospital. We will walk through what HIPAA actually requires when a ransomware event affects ePHI, and the five things you should verify in your environment this quarter regardless of facility size.

The HIPAA breach reporting rule, in plain language

The HHS Office for Civil Rights (OCR) guidance has been clear since 2016: a ransomware event affecting ePHI is presumed to be a breach requiring notification, unless the covered entity can demonstrate through a low-probability-of-compromise risk assessment that there is a low probability the PHI was compromised. The relevant text is 45 CFR 164.402 and the OCR Fact Sheet on Ransomware and HIPAA from July 2016, which remains the authoritative federal guidance.

What the rule actually means in practice:

• You must perform a documented risk assessment of every ransomware event affecting any system that stores or processes ePHI.
• The default assumption is that ePHI was compromised. The burden of proof to demonstrate otherwise rests on the covered entity.
• Encryption of the ePHI by the attacker does not automatically eliminate breach reporting obligations. Modern ransomware exfiltrates before encrypting, and “double extortion” is now standard practice for most major strains.
• If breach notification is required, the deadlines are tight: individuals within 60 days, HHS within 60 days (or annually for breaches under 500 individuals), and prominent media outlets within 60 days if the breach affects more than 500 individuals in a state or jurisdiction.

The single biggest mistake we see clinics make: assuming that because their EHR vendor handles ePHI in the cloud, ransomware on their on-premises network does not trigger HIPAA. It does, if any system on that network can access ePHI — and almost every workstation in a clinic can.

What the risk assessment must actually demonstrate

The OCR Fact Sheet identifies four factors that must be documented in any post-ransomware risk assessment. We see these handled poorly more often than not:

1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom the disclosure was made. For ransomware, this means the threat actor group, with documented evidence of their data-exfiltration patterns.
3. Whether the PHI was actually acquired or viewed. This requires forensic evidence from EDR logs, network flow records, or attacker behavioral data — not guesses.
4. The extent to which the risk to the PHI has been mitigated, which requires demonstrating that data did not leave the environment or, if it did, that it was returned/destroyed verifiably (almost never the case in ransomware).

The forensic evidence to answer factor 3 must exist before the incident. If your EDR is not retaining 90 days of telemetry, your firewall is not logging east-west traffic, and you do not have a SIEM with at least 12 months of retention, you almost certainly cannot demonstrate “low probability of compromise” and the default presumption applies.

Five things every Kansas clinic should verify this quarter

1. Inventory every system that touches ePHI. EHR clients, billing systems, imaging modalities, lab interfaces, fax-to-PDF systems, scanner workstations, backup servers. Most clinics miss at least one category.
2. Verify backup immutability for ePHI systems specifically. Object Lock, WORM, or vaulted with separate credentials. Test restore quarterly. Document the test.
3. Enable EDR with 12-month log retention on every workstation that can access ePHI. Generic antivirus does not satisfy the OCR’s evidence standard.
4. Get your Business Associate Agreements (BAAs) current with every vendor that touches ePHI, including your IT provider, your backup vendor, and your security tool vendors. Verify they have cyber insurance and incident response capability.
5. Run an annual tabletop exercise that includes legal counsel and your Privacy Officer. The decision about whether to notify HHS is best practiced before the incident. The 60-day clock starts on the date of discovery, not the date of mitigation.

If you need a focused readiness audit

Ransom Security is part of Click Techs, a Wichita-headquartered firm that has supported healthcare clients in the Kansas market since 2004. We run focused HIPAA security risk analyses, build documented incident response plans, and produce evidence binders that satisfy OCR audit standards. We are not a HIPAA consulting firm — we are a cybersecurity firm that understands the HIPAA framework and can produce the security controls and documentation that the rule actually requires.

Call 316-712-4006 for a 30-minute conversation, or take the free 2-minute Am I Safe assessment to get a baseline risk score and a follow-up from a senior engineer.

If you are in the middle of an active incident, do not wait. The 60-day notification clock and the operational recovery clock are both running.