Emergency Response: Networked Medical Device Malware Containment & Isolation Protocol

Is this incident affecting a single device or multiple devices?

How many devices are affected?

Affected Device Inventory & Network Identifiers

Device primary network connection type

Network topology description - how is this device connected? (e.g., direct VLAN, wireless, via middleware server)

If device is active on patient(s), provide anonymized patient identifier(s) and clinical context

When was the malware infection first detected on this device?

Who initially detected the malware infection?

Device primary clinical function

Malware detection method

Describe the specific malware identified (name, hash, behavior observed)

Has the malware demonstrated capability to affect device clinical functionality?

Select all clinical impacts observed or suspected:

Is there evidence of data exfiltration or unauthorized access to patient health information (PHI)?

Describe the scope of potential PHI exposure (data types, volume, affected patients)

Patient Safety Risk Assessment Matrix - Rate each dimension based on current understanding

Does this incident meet criteria for regulatory notification (e.g., FDA, HIPAA, CE Marking authorities)?

Specify which regulatory bodies must be notified and the timeline requirement

Describe the suspected initial infection vector and propagation path within the network

Overall Incident Severity Rating (1=Minor, 5=Catastrophic)

Is there any threat actor attribution or indication of targeted attack?

Threat intelligence sources consulted and key findings

Has the affected device been physically disconnected from the network?

When was physical disconnection completed?

Explain why physical disconnection was not performed and what alternative containment was implemented

Network isolation methods implemented (select all applicable)

Provide specific technical details of VLAN containment and firewall rules implemented

Has network traffic capture been initiated for forensic analysis?

Specify capture location and file storage path

Have neighboring devices on the same network segment been scanned for infection indicators?

Summarize scan results and any additional devices quarantined

Containment Action Log - Document each step with timestamp and responsible personnel

Is the device completely isolated from all production networks including wireless?

Describe any remaining network connectivity and justification

Has a forensic image of the device storage been created before remediation?

Forensic image hash (MD5/SHA256) and storage location

Have all containment actions been tested and verified effective?

Describe verification failures and corrective actions

Are there patients currently dependent on the affected device for life-support or critical care?

Immediate patient safety measures implemented

Backup Equipment Deployment Log

Has the clinical engineering team verified backup device calibration and safety before deployment?

Explain calibration status and any risks of using backup equipment

Impact on clinical service delivery

Have clinical staff been notified of device unavailability and alternative procedures?

Describe communication method and confirmation of receipt

Is manual backup procedure required due to lack of available backup devices?

Detail manual procedure and additional monitoring requirements

Describe any temporary workflow modifications implemented to maintain patient care standards

Has patient notification been required due to potential data breach or care disruption?

Document patient notification process and timeline

Are there supply chain implications affecting backup equipment availability?

Describe supply chain issues and contingency plans

Has additional staff training been required for backup equipment or manual procedures?

Document training provided and competency verification

Executive Summary of Incident (for leadership review)

Has all evidence been preserved for forensic analysis in accordance with incident response policy?

Explain any deviations from evidence preservation standard

Are there any objections to the containment actions taken from clinical leadership?

Document objections and resolution

Has the device manufacturer been notified of the security incident?

Provide manufacturer case number and response summary

Is there a formal risk acceptance for maintaining the device in quarantine state?

Explain rationale for not obtaining formal risk acceptance

Proposed device reconnection date/time (if applicable)

Reconnection prerequisites and security hardening requirements

Head of Biomedical Engineering - Incident Review & Approval

Biomedical Engineering Sign-off Timestamp

Hospital Chief Information Security Officer (CISO) - Security Review & Approval

CISO Sign-off Timestamp

Does this incident require escalation to hospital executive leadership or board notification?

Document escalation details and executive response

Has cyber insurance carrier been notified of the incident?

Provide insurance claim number and adjuster contact

Are there media or public relations considerations requiring communications department involvement?

Document PR strategy and messaging approval

Lessons Learned & Process Improvement Recommendations

Has this incident been entered into the official hospital risk management system?

Explain why not and provide alternative documentation method