If we are encrypted on a Monday morning, how long until we are seeing patients?

The honest answer has conditions attached, and any provider giving you a flat number without them is guessing.

If your backups are current, isolated, and tested, the realistic path is containment first, then restoring the practice database and server to clean hardware or a clean rebuild. Same day is achievable and next day is common. Imaging usually follows shortly after, though large volumes take longer to move.

What extends it: backups that were reachable from the encrypted network and got hit too, which is the single biggest factor. No recent restore test, so the backup turns out to be incomplete. Unclear scope, meaning we cannot yet tell which systems are safe to bring back. And your practice software vendor's availability, since a restore frequently needs their involvement to bring the database up correctly.

What runs for days afterward regardless: rebuilding workstations, forcing credential resets, determining what data was accessed, and your breach notification analysis. Being able to see patients and being finished are different milestones.

For clients where this matters most, we measure it rather than estimate. A scenario test brings your critical system up from backup in an isolated environment and times it, so the number you have been given is a measured one.