In the first hours, containment beats reporting; our first-hour playbook covers that. Once the incident is contained, the notification list for a Texas practice looks like this:
- Your cyber insurer, immediately. Most policies require notice before you spend money on recovery, and the carrier's panel (forensics, counsel) is usually the path to coverage. Late notice is a common reason claims get contested.
- Breach counsel. Whether notifications are legally required depends on facts counsel helps establish; involving them early also protects the investigation.
- The FBI. Report through IC3 (ic3.gov) or the Dallas or Houston field office. The FBI does not shut your practice down; they sometimes have decryption keys or intelligence on the group, and a report number helps with the insurer and regulators.
- OCR, if PHI was involved. Ransomware that encrypted systems containing PHI is presumed a reportable breach unless your forensic analysis demonstrates a low probability of compromise. Breaches affecting 500 or more people must be reported to OCR within 60 days of discovery; smaller ones by 60 days after year-end.
- The Texas Attorney General, within 30 days, if 250 or more Texas residents are affected. The AG posts reported breaches publicly.
- Affected individuals, within 60 days under Texas law (and HIPAA's own 60-day clock when PHI is involved).
The thing that determines how this goes is evidence: EDR timelines and logs that show what was and was not touched. Without them, you notify for the worst case.