Ethics & Law · single question
An office experiences an online hack and patient records are compromised. What action should the dental team NOT take?
Show answer and explanation
Correct answer: B. Give the hackers what they are demanding (ransom)
Paying a ransom to hackers is strongly advised against by cybersecurity authorities (FBI, HHS). Never pay the ransom — it does not guarantee data recovery, encourages further attacks, and may be illegal if the hacker is on a sanctions list. Required actions under HIPAA include: notifying affected patients, documenting the breach, reporting to HHS, and implementing remediation. Ransomware attacks involving protected health information (PHI) require breach notification.
- A. ❌ Reporting to authorities (FBI, HHS) is required for breaches of protected health information.
- B. ✅ CORRECT – Do NOT pay the ransom. This is the wrong response — it funds criminal activity, doesn't guarantee data return, and may be illegal.
- C. ❌ Informing patients is required under HIPAA breach notification rules.
- D. ❌ Documenting what files were accessed is essential for breach analysis and legal reporting.