Contain ransomware fast and keep the evidence your breach assessment needs.
Under HIPAA, ransomware that encrypts electronic protected health information (ePHI) is presumed to be a reportable breach, unless you can show a low probability that the data was compromised. That puts two things on the line at once, patient care and the evidence behind your breach assessment. Helm contains ransomware at the data layer, verifies recovery and records every step, giving you the facts HIPAA asks for.
Large healthcare data breaches reported to the HHS Office for Civil Rights (OCR) affected more than 35 million people in 2025, and most were caused by hacking or IT incidents. The ransomware attack on Change Healthcare in February 2024 alone affected around 190 million people.
HHS guidance sets the terms. When ransomware encrypts ePHI, a breach is presumed, and it is up to you to show otherwise through a documented risk assessment. Without a clear record of what the attack touched and how fast it was contained, the safest answer is often to notify, at a cost to patients, reputation and trust.
Helm changes that. It contains ransomware in seconds, so the clinical and administrative systems care depends on stay available and clinicians keep working. It brings systems back only once they are verified clean, so recovery does not reopen the incident. And it records every step, so your breach assessment rests on facts rather than assumptions. See how Helm keeps hospitals and health systems running.
HIPAA applies to covered entities, which are healthcare providers, health plans and healthcare clearinghouses, and to the business associates that handle ePHI for them, such as billing, IT and cloud providers.
The HIPAA Security Rule asks for safeguards that matter directly in an attack. Security incident procedures to identify, respond to and document incidents. A contingency plan with data backup, disaster recovery and emergency mode operations, so critical processes keep running. Audit controls that record activity in systems holding ePHI. A proposed update would add a 72-hour restore requirement, with final action delayed until at least July 2027.
When ransomware encrypts ePHI, HHS presumes a breach unless a risk assessment of four factors shows a low probability of compromise. The factors are the nature and extent of the ePHI, who had access to it, whether it was actually acquired or viewed, and how far the risk was mitigated.
If a breach stands, HIPAA breach notification applies. Affected individuals must be told within 60 days of discovery, and breaches affecting 500 or more people go to HHS in the same period, and to the media where more than 500 residents of a state are affected. Organisations that also hold EU data face GDPR’s 72-hour rule too.
Every one of these requirements asks for the same thing, accurate facts gathered fast. That is where Helm comes in.
Helm gives your privacy and compliance officers the evidence for each of the four factors, from the first second of an attack, while they stay in charge of the assessment and what is reported.
Nature and extent. Helm records which files, folders and systems were touched, with a timestamp for each, so you can see what ePHI was in scope.
Who was involved. The record names the accounts and devices behind the encryption.
Acquired or viewed. Helm’s logs can show whether ePHI was accessed or copied out, which is central to the low-probability question. [TBC]
Mitigation. Helm detects active encryption in under a second and isolates the compromised accounts and devices on fixed, readable rules, with no AI in containment. It verifies systems are clean before they return, in support of your contingency plan. The same timestamped record serves your audit controls and incident documentation. A contained, well-documented incident can support a low-probability-of-compromise finding. [TBC]
HIPAA asks healthcare organisations to keep ePHI available and intact, and to account for every incident that touches it. Helm keeps the attack small and recovery clean, and gives your team a record that stands up to an OCR review.
Read how Helm supports hospitals and health systems, or talk to us about your environment.
