"Urgent: Linux Server Malware/Rootkit Incident Response — Active Compromise"

I run a medical clinic patient portal on a Linode VPS (Ubuntu 24.04). The server has had repeated malware compromises over the past month — a backdoor SSH key, a crypto-mining/SSH-brute-forcing process disguised as a system process (running as /usr/sbin/httpd .rsync/c/kthreadadd64), and persistence via cron jobs in a hidden directory (~/.configrc7). It has survived at least two prior cleanup attempts and reappeared after being killed again today. I've now isolated the server from the network (interface down) but have not rebuilt or wiped anything. I need: (1) a forensic assessment of how the attacker got in and how deep the compromise goes, (2) confirmation of whether two other servers I operate, connected via SSH trust relationships, are also affected, and (3) a clean remediation plan. The server holds patient medical data, so I also need guidance on any breach-notification obligations