  Most small to medium health care organizations do not have the capability to
address cyber incidents within the organization. Those that do are poorly
trained and ill equipped. These health care organizations are subject to
various laws that address privacy concerns, proper handling of financial
information, and Personally Identifiable Information. Currently an IT staff
handles responses to these incidents in an Ad Hoc manner. A properly trained,
staffed, and equipped Cyber Incident Response Team is needed to quickly respond
to these incidents to minimize data loss, and provide forensic data for the
purpose of notification, disciplinary action, legal action, and to remove the
risk vector. This paper will use the proven Incident Command System model used
in emergency services to show any sized agency can have an adequate CIRT
