What to Do After a Potential HIPAA Incident

A misdirected fax, a stolen laptop, a staff member viewing a neighbor's chart, a phishing email that compromised an account. Potential HIPAA incidents take many forms. How an organization responds in the first days shapes both the outcome and its ability to show it acted appropriately.

This article describes a general sequence. Specific situations, especially those involving cyberattacks, large numbers of patients, or possible law enforcement involvement, may call for legal counsel and specialized technical help early.

1. Report and escalate

Staff should know exactly who to tell and should feel able to report mistakes without fear. The privacy or security official should be notified promptly. Notification deadlines under HIPAA are measured from when a breach is discovered, which includes when it would have been known with reasonable diligence, so delays inside the organization can matter.

2. Contain

Stop ongoing exposure where you can:

• Recall or request return of misdirected information
• Disable compromised accounts and reset credentials
• Remove access that should not exist
• Isolate affected systems, with guidance from your IT or security provider
• Secure physical records or devices

3. Preserve information

Record what is known: what happened, when, who was involved, what information was affected, and how it was discovered. For technical incidents, avoid steps that destroy logs or evidence. Your IT provider or a forensic firm may need them.

4. Assess whether a breach occurred

Under the HIPAA Breach Notification Rule, an acquisition, access, use, or disclosure of PHI not permitted by the Privacy Rule is presumed to be a breach unless the organization demonstrates a low probability that the PHI has been compromised (45 CFR 164.402). That demonstration requires a risk assessment considering at least:

• The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification
• The unauthorized person who used the PHI or to whom it was disclosed
• Whether the PHI was actually acquired or viewed
• The extent to which the risk to the PHI has been mitigated

There are narrow exceptions, and information encrypted in line with HHS guidance is not considered unsecured PHI. The assessment and its conclusion should be documented either way.

5. Notify when required

If a breach of unsecured PHI occurred, notification obligations apply (45 CFR 164.404 to 164.410):

• Affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery.
• HHS must be notified. For breaches affecting 500 or more individuals, notice is due within the same 60-day timeframe. Smaller breaches may be reported to HHS within 60 days after the end of the calendar year in which they were discovered.
• Prominent media outlets must be notified when a breach affects more than 500 residents of a state or jurisdiction.
• Business associates must notify the covered entity of breaches they discover.

State breach notification laws may impose additional or different requirements. HHS posts breaches affecting 500 or more individuals on its public breach portal. See HHS's Breach Notification Rule overview for details.

6. Correct and follow up

Identify why the incident happened and what would prevent a repeat: a workflow change, retraining, an access restriction, a technical control, or a sanctions decision. Assign owners and dates, and record when each action is completed.

7. Document everything

Keep a record of the report, investigation, risk assessment, notifications, and corrective actions. Incidents that turn out not to be reportable breaches still belong in the incident log. A consistent record shows that the organization takes incidents seriously and follows its own procedures.

Prepare before it happens

The best time to define this process is before you need it. A written incident response procedure, a known reporting path, a contact list that includes IT, counsel, and insurance, and periodic practice make the first hours of a real incident far more manageable.