Understanding the Fundamentals of IRE

Every organization is asking the question how we can protect ourselves from all of these ransomware attacks that are impacting our industry. The CIO, the CTO, the CISO is explaining this is how we’re protecting ourselves from ransomware. Not only are IT departments getting pressure from their executive teams, but the increasing number of ransomware attacks in the United States has nearly changed the question from ‘what if we get attacked’ to ‘what do we do when we get attacked.’

According to research from The HIPAA Journal, there were 181 confirmed ransomware attacks on healthcare providers in 2024 involving 25.6 million healthcare records. There were also a further 42 confirmed attacks on healthcare organizations that do not provide direct care, involving 115,640,362 compromised records.

Organizations need to add an extra layer into their cybersecurity playbook that includes what to do when a ransomware attack happens. In the past, there have been Cloud Read-Only solutions of EMRs that allow for some data protections and operational grace. And health IT professionals have been stressing how important it is for healthcare organizations to solidify their disaster recovery infrastructure.

Recently, Epic has announced a new ransomware prevention solution called Isolated Recovery Environment, or IRE. Here are three ways Epic’s IRE can help your healthcare organization build ransomware resilience.

When a ransomware attack strikes, healthcare providers need instant access to patient records. IRE ensures that a fully isolated, read-and-write version of Epic is always available, allowing clinicians to continue care even while the primary system is down. How it works: IRE maintains a fully operational, air-gapped copy of Epic to prevent ransomware from corrupting recovery data. Unlike standard disaster recovery solutions that store backups in network-connected environments, IRE remains untouched and accessible in AWS and Azure. Rather than shutting down operations, providers can immediately access and log patient data on desktop or mobile devices, all from a ransomware-proof environment. This keeps patient care uninterrupted while IT teams work on full recovery.

A backup is only as useful as its ability to be deployed quickly. IRE is more than just a storage solution — it allows hospitals to test and validate full Epic workflows in an isolated recovery environment, ensuring they can restore operations in minutes, not days. How it works: With IRE, IT teams can conduct real-time failover testing without disrupting live operations. They can verify that logins, role-based access, and application dependencies function correctly before an attack happens. Instead of discovering weaknesses during a crisis, organizations can proactively test their Epic failover capabilities, ensuring IT teams and cyber insurance partners have confidence in their recovery strategy.

Ransomware recovery isn’t just about restoring data — it often requires rebuilding an entire IT environment from scratch. IRE gives healthcare IT teams a safe, separate environment to rebuild Epic, so they can restore systems quickly without worrying about network contamination. How it works: Serving a fully functional replica of Epic in the cloud, IRE provides a secure location to rebuild primary systems without reintroducing malware. Since IRE connects to cloud platforms like AWS and Azure that provide on-demand, scalable infrastructure, hospitals can avoid the time-consuming process of setting up new physical servers. When most healthcare organizations spend weeks or months manually rebuilding a ransomware-crippled system, IT teams can recover Epic environments within hours using IRE and significantly reduce downtime and reconstruction time.

Interested in learning more about IRE? Click here to watch the episode of Healthy as Tech Talk where Curtis Hendrick, Senior Vice President of Cloud & Digital Transformation at Optimum Healthcare IT, sat down with Matt Dinger from AWS to discuss why Epic is urging healthcare organizations to adopt an IRE to fight ransomware.