CDMP Fundamentals • 100 Questions • 90 Minutes
← Back to HIPAA Compliance

🚨 HIPAA Breach Response Playbook

This section provides a step-by-step guide for handling a data breach involving unsecured PHI. Speed and accuracy are critical: you have a maximum of 60 days from discovery to notify affected individuals and HHS. This guide walks you through discovery, investigation, breach determination, notification, and post-incident review. Have this plan ready BEFORE a breach occurs — you do not want to be figuring out the process while under the pressure of an active incident.

1

Discover & Contain

Immediately (within hours of detection)

Responsible: Security Officer leads containment; Privacy Officer is notified; Incident Response Team activated; Executive sponsor notified within 4 hours of confirmed incident

  • ● Activate the incident response team and notify the Security Officer and Privacy Officer
  • ● Contain the incident to prevent further unauthorized access or disclosure (disable compromised accounts, isolate affected systems, change passwords, revoke vendor access if applicable)
  • ● Preserve all evidence: do NOT modify, delete, or power off affected systems until forensic evidence is preserved
  • ● Begin an incident timeline log documenting every action taken, by whom, and when
  • ● If the incident involves a crime (theft, hacking, extortion), notify law enforcement as appropriate
  • ● Activate outside resources if needed: forensics firm, outside legal counsel, public relations firm

Documentation Needed

  • ☐ Incident timeline log (all actions with timestamps and responsible parties)
  • ☐ Initial incident report (what happened, when discovered, how discovered, initial scope assessment)
  • ☐ Evidence preservation log (what evidence was secured, where it is stored, chain of custody)
  • ☐ System and network logs from affected systems
  • ☐ Communication log (who was notified, when, how)
2

Investigate & Assess Scope

Days 1-14 (begin immediately, complete as quickly as possible)

Responsible: Security Officer leads investigation; IT security team or external forensics firm conducts technical analysis; Privacy Officer assesses PHI scope; Legal counsel advises throughout

  • ● Conduct a thorough investigation to determine: what happened, when it happened, what PHI was involved, how many individuals were affected, who had unauthorized access, and whether PHI was actually viewed or acquired
  • ● Identify all affected systems and data repositories
  • ● Determine the types of PHI involved (names, SSNs, diagnoses, financial information, etc.)
  • ● Determine the number of affected individuals (this determines notification obligations)
  • ● Interview relevant personnel and review access logs, system logs, and security camera footage
  • ● Engage digital forensics experts for complex incidents (ransomware, sophisticated hacking, unknown attack vectors)
  • ● Determine if the PHI was encrypted or otherwise unsecured (if encrypted per HHS guidance, it is NOT a breach)

Documentation Needed

  • ☐ Detailed investigation report (methodology, findings, evidence analyzed)
  • ☐ PHI scope assessment (types of PHI, number of affected individuals, systems involved)
  • ☐ Forensic analysis report (if external forensics engaged)
  • ☐ Interview notes and witness statements
  • ☐ Timeline of the breach (when it started, when it was discovered, how long PHI was exposed)
3

Conduct 4-Factor Breach Risk Assessment

Days 7-21 (as soon as sufficient investigation data is available)

Responsible: Privacy Officer leads the risk assessment with input from Security Officer, legal counsel, and investigation team; Compliance Committee or executive leadership reviews and approves the determination

  • ● Conduct the HIPAA 4-factor risk assessment to determine if the impermissible use or disclosure constitutes a breach requiring notification
  • ● Factor 1: Assess the nature and extent of the PHI involved — what types of identifiers and clinical information were exposed? Highly sensitive data (SSNs, financial data, HIV status, mental health) increases risk.
  • ● Factor 2: Assess who the unauthorized person was — was it an internal workforce member, a Business Associate, an unknown external party, or a known criminal organization? An internal person may be lower risk than an unknown external party.
  • ● Factor 3: Assess whether the PHI was actually acquired or viewed — was there evidence of actual access, or was the data merely exposed? Did the unauthorized party have the means and motive to use the data?
  • ● Factor 4: Assess the extent to which the risk has been mitigated — has the PHI been recovered? Has the unauthorized party provided assurances of destruction? Has the compromised system been secured?
  • ● Document the risk assessment with detailed analysis of each factor and the overall determination
  • ● If the assessment demonstrates a low probability that the PHI was compromised, the incident is NOT a breach and notification is not required (but document the determination thoroughly)
  • ● If the assessment cannot demonstrate low probability of compromise, treat it as a breach and proceed to notification

Documentation Needed

  • ☐ Completed 4-factor risk assessment form with detailed analysis of each factor
  • ☐ Supporting evidence for each factor (investigation findings, log data, forensic results)
  • ☐ Final breach determination (breach or not-a-breach) with rationale
  • ☐ Approval signatures from Privacy Officer, Security Officer, and executive sponsor
  • ☐ If determined not a breach: detailed documentation of why low probability was demonstrated
4

Notify Affected Individuals

Within 60 days of discovering the breach (sooner is better — best practice is 30 days or less)

Responsible: Privacy Officer drafts notifications; Legal counsel reviews; Communications team coordinates mailing; Executive sponsor approves

  • ● Prepare individual notification letters containing all required elements (see notification_requirements below)
  • ● Send notifications via first-class mail to the last known address of each affected individual
  • ● If the individual has agreed to receive electronic notices, email notification may be used instead of or in addition to mail
  • ● If contact information is insufficient or outdated for 10 or more individuals, post a conspicuous notice on the organization's website for 90 days AND provide a toll-free number for 90 days
  • ● If contact information is insufficient for fewer than 10 individuals, use alternative written notice, telephone, or other means
  • ● If urgency warrants, supplement written notice with telephone or other outreach
  • ● Consider offering credit monitoring and identity theft protection services if SSNs or financial information were involved

Documentation Needed

  • ☐ Final notification letter (approved by legal counsel)
  • ☐ Mailing list of all affected individuals with addresses
  • ☐ Proof of mailing (certified mail receipts or mailing service confirmation)
  • ☐ Substitute notice documentation (website posting, toll-free number) if used
  • ☐ Records of any additional outreach (phone calls, in-person notification)
5

Notify HHS and Media (if applicable)

Within 60 days of discovery for breaches affecting 500+ individuals; Annual submission by March 1 for breaches affecting fewer than 500

Responsible: Privacy Officer submits HHS notification; Communications team manages media relations; Legal counsel reviews all external communications; Executive spokesperson handles press inquiries

  • ● For breaches affecting 500 or more individuals: submit notification to HHS via the breach portal (ocrportal.hhs.gov) within 60 days of discovery
  • ● The HHS notification will be posted publicly on the 'Wall of Shame' (HHS Breach Portal) — prepare for potential media inquiries
  • ● For breaches affecting fewer than 500 individuals: log the breach and submit to HHS within 60 days after the end of the calendar year in which the breach was discovered
  • ● For breaches affecting 500+ residents of a single state or jurisdiction: notify prominent media outlets serving that state/jurisdiction within 60 days
  • ● Prepare a media statement and FAQ document in advance of any public notification
  • ● Designate a single spokesperson for all media inquiries

Documentation Needed

  • ☐ HHS breach portal submission confirmation
  • ☐ Media notification documentation (outlets notified, dates, content)
  • ☐ Press release or media statement (approved by legal counsel)
  • ☐ Media inquiry log and responses
  • ☐ Breach log entry with all required fields for annual HHS submission
6

Post-Incident Review & Remediation

Within 30 days of incident closure

Responsible: Security Officer leads the post-incident review; Privacy Officer documents lessons learned; Compliance Committee reviews and approves remediation plan; Relevant department heads implement corrective actions

  • ● Conduct a thorough post-incident review (lessons learned) with all incident response team members
  • ● Perform root cause analysis to determine the underlying factors that allowed the breach to occur
  • ● Identify specific remediation actions to prevent recurrence (technical controls, policy changes, training improvements)
  • ● Update the risk analysis and risk management plan to reflect findings from the incident
  • ● Update the incident response plan based on lessons learned (what worked, what did not, what needs to change)
  • ● Provide targeted training to workforce members in the affected area
  • ● Implement additional monitoring or controls as needed
  • ● Report final incident summary and remediation plan to executive leadership and the Compliance Committee
  • ● If required by a corrective action plan from OCR, implement all required actions within specified timelines

Documentation Needed

  • ☐ Post-incident review report (lessons learned, root cause analysis, recommendations)
  • ☐ Remediation action plan (specific actions, owners, timelines, completion status)
  • ☐ Updated risk analysis incorporating incident findings
  • ☐ Updated incident response plan
  • ☐ Training records for any remedial training conducted
  • ☐ Complete incident file (all documentation from Steps 1-6, stored securely for at least 6 years)

📨 Notification Requirements

individual notification

Timeframe: Without unreasonable delay, no later than 60 calendar days from discovery of the breach

Method: Written notification sent via first-class mail to the individual's last known address; or by email if the individual has agreed to electronic notice. If insufficient contact information for 10+ individuals, substitute notice via website posting (90 days) and toll-free phone number (90 days). Urgent situations may warrant telephone notification in addition to written notice.

  • • A brief description of what happened, including the date of the breach and the date of discovery
  • • A description of the types of unsecured PHI that were involved (e.g., names, Social Security numbers, dates of birth, diagnoses, etc.)
  • • Steps the individual should take to protect themselves from potential harm resulting from the breach (e.g., monitor credit reports, place fraud alerts)
  • • A brief description of what the covered entity is doing to investigate the breach, mitigate harm, and prevent future occurrences
  • • Contact procedures including a toll-free telephone number, email address, postal address, or web address where individuals can ask questions or obtain additional information

hhs notification

Timeframe: For breaches affecting 500+ individuals: within 60 days of discovery. For breaches affecting fewer than 500: no later than 60 days after the end of the calendar year in which the breach was discovered (submit annual log).

Threshold: All breaches of unsecured PHI must be reported to HHS, regardless of size. The timing differs: 500+ individuals requires immediate reporting; fewer than 500 can be batched in an annual report.

How: Submit via the HHS breach portal at https://ocrportal.hhs.gov. You will need: covered entity name and contact information, business associate name (if applicable), date of breach, date of discovery, number of individuals affected, type of breach (hacking, theft, loss, unauthorized access, improper disposal, other), location of PHI (laptop, paper, email, EHR, network server, other), types of PHI involved, brief description of the breach, and safeguards in place at the time.

media notification

Timeframe: Without unreasonable delay, no later than 60 calendar days from discovery of the breach

Threshold: Required when a breach affects 500 or more residents of a single state or jurisdiction

  • • Notify prominent media outlets serving the state or jurisdiction where affected individuals reside
  • • The notification must include the same content elements as individual notification
  • • Typically accomplished through a press release distributed to major media outlets in the affected area
  • • Designate a spokesperson and prepare a FAQ document to respond to media inquiries
  • • Coordinate media notification timing with individual notification — ideally, individuals are notified before or simultaneously with media
← Back to HIPAA Compliance