On February 17, 2026, a ransomware crew that calls itself Nova posted a claim that it had hit Nebraska Health Imaging, an Omaha outpatient diagnostic center, and threatened to leak patient data unless the practice negotiated. The claim was logged by several cybersecurity trackers, including Ransomware.live and RedPacket Security, which reported the group alleged it had taken roughly 250 GB of data and intended to publish it within about a week.

A posting like that is the moment a strong ransomware response in Omaha healthcare gets decided. Not on the day a clinic buys cyber insurance, and not on the day it writes a policy nobody reads, but in the hours after a screen goes dark and a scheduler cannot pull up tomorrow's appointments. This post is a continuity playbook for clinics and medical practices, built around what that scenario actually demands. We are not stating what happened inside any one practice; the details above are attributed to the threat actor's own claims as reported by security researchers, and as of this writing investigators' findings have not been publicly confirmed. We use it only as a verified, attributed hook to walk through the decisions you can make now.

The 72 hours that backups either save or sink

The popular advice tells you to back up your data. The advice that survives a real incident tells you to back up your data in a way that ransomware cannot reach, then prove you can restore it.

Modern crews do not just encrypt files. They hunt for your backups first, because a clinic that can restore in an afternoon has no reason to pay. A single cloud sync or a backup appliance sitting on the same network is not a safety net. It is a second target.

Build to the 3-2-1-1 standard: three copies of your data, on two different media, with one copy off-site and one copy immutable or air-gapped so it cannot be altered or deleted even by an account with full admin rights. Many managed backup services in the Omaha metro now offer immutable retention; if yours does not, that is a conversation to have this month.

Then do the part teams routinely skip. Run a restore test. Pick your practice management system and your imaging archive, and actually rebuild them onto clean hardware on a quiet Saturday. A backup you have never restored is a hypothesis, not a plan. The first time you test restore speed should never be during a live ransomware recovery in Omaha, when every hour of downtime is a waiting room full of rescheduled patients.

Running the clinic when the network is dark

Encryption is loud, but the quiet damage is operational. The day your systems lock, can your front desk still see who is coming in? Can a clinician confirm a medication or a prior result without the EHR?

Write a downtime procedure binder and keep a physical copy at every workstation. It should cover the unglamorous basics:

  • A printed or offline-cached schedule for the next 48 hours, refreshed daily.
  • Paper encounter forms, fax-ready order sheets, and a manual charge log so billing does not vanish into the gap.
  • A phone tree and a single decision-maker named in advance, so nobody loses 30 minutes deciding who is allowed to declare an incident.
  • A pre-written patient message and a front-desk script. "Our systems are temporarily down; we are caring for patients on paper today" calms a lobby far better than improvised silence.

People judge a crisis by how the staff in front of them behave. A practice that switches to a rehearsed manual mode looks in control. A practice that stands around refreshing a frozen screen looks like it lost your records. Same event, very different trust outcome.

Breach notification: the clock you do not control

A ransomware event at a covered entity is presumed to be a reportable breach of protected health information unless a documented risk assessment shows a low probability of compromise. Under the HIPAA Breach Notification Rule, notifications to affected individuals are generally due without unreasonable delay and no later than 60 days from discovery, with media notice and a report to HHS required when a breach affects 500 or more people. Nebraska's own data-breach statute adds a duty to notify affected residents and the state Attorney General.

Slow notice is not just a compliance miss; it can also draw enforcement. In December 2024, the Nebraska Attorney General's office filed suit against Change Healthcare and affiliated companies over a breach the lawsuit alleges affected at least 575,000 Nebraskans, and the office said publicly it was suing in part over how slowly affected people were notified, according to the Nebraska Examiner. Those are the state's allegations in pending litigation, not findings of fact. The lesson for a small practice is still clear: decide now who runs your breach assessment and who drafts notice letters, because that clock starts the moment you discover the intrusion, not the moment you finish cleaning it up.

Should you ever pay?

Treat this as a business decision made before the crisis, not a moral debate during it. Paying does not guarantee a working decryptor, does not stop data that was already exfiltrated from leaking, and may draw regulatory scrutiny. The FBI's standing guidance does not support paying a ransom. If your backups are immutable and tested, the pay-or-not question often answers itself, because you simply restore.

What you cannot restore is stolen data. That is why prevention and segmentation still matter: limit which accounts can touch the imaging archive, require multi-factor authentication on every remote login, and patch the internet-facing systems attackers scan for first.

Your practical next step

Pick one date in the next two weeks and run a 90-minute tabletop. Walk your team through the morning a posting like the Nebraska Health Imaging claim names your clinic. Who calls whom? Where is the binder? Can you restore the schedule? You will find your three biggest gaps in the first hour, and fixing them is cheaper than any ransom.

For medical practices that want vetted local help building backups, downtime plans, and breach-response procedures, our Omaha business continuity directory lists area firms that work with healthcare clients. Start with a tabletop and build from there.