Ransomware encrypts the clinic EHR and may have exposed electronic protected health information. At the HIM/coder awareness level, what is the most appropriate immediate organizational expectation?

Ransomware that encrypts a clinic EHR and may have exposed electronic PHI is a security incident that triggers the organization’s incident-response and breach-evaluation playbook. At the HIM/coder awareness level in a county physician practice, the correct immediate expectation is activation of that process—including leadership, privacy, and IT security notification as defined in policy—so containment, investigation, and any required breach analysis can begin. Coding continuity is secondary to secure handling of the incident and protection of patient information held by a civic outpatient organization.

Recreating claims from memory overnight without involving privacy or IT fails by concept because it substitutes improvisation for incident command and can compound integrity and privacy risk. Taking no action until a patient complains about a reminder fails because breach evaluation does not wait on consumer complaints; suspected ransomware is itself a triggering event. Emailing unencrypted chart PDFs to personal accounts to keep coding going fails because it creates further impermissible disclosures and insecure ePHI repositories during an already active security event.

Exam caveat: whether a particular ransomware event is a reportable breach depends on the risk assessment under the Breach Notification Rule; the coder’s immediate duty is escalation and policy activation, not unilateral determination of reportability. Operational check: know the on-call chain for EHR outages and suspected ransomware, stop insecure workarounds, preserve evidence as directed by IT/privacy, and resume professional-fee coding only through approved continuity channels.