HIPAA breach at your clinic? What to do in the first 24 hours
A fax went to the wrong number. A laptop was stolen from a car. Someone clicked a link and now the email account is sending spam. What you do in the first day shapes everything that follows.
Hour 1: Contain it
- Hacked account: reset the password, sign out all sessions, and check that MFA is on. Check for new mail-forwarding rules, which attackers often add.
- Ransomware or a strange computer: disconnect it from the network (cable out, Wi-Fi off). Don't power it off unless your IT provider says to.
- Lost or stolen device: remotely lock or wipe it if you can, and change passwords it had saved.
- Misdirected fax, email or mail: contact the recipient, ask them to destroy or return it, and get that confirmation in writing.
- Cyber insurance: many policies require you to call their hotline before hiring outside help. Check yours now.
Hours 2–8: Write everything down
Start an incident record with what happened, when it happened, when it was discovered and by whom, which systems and which patients' information may be involved, and every step taken so far. Preserve evidence. Don't delete emails, logs or files, even embarrassing ones.
Hours 8–24: Assess whether it's a reportable breach
Under HIPAA, an impermissible use or disclosure of PHI is presumed to be a breach unless you can show a low probability that the information was compromised. That assessment looks at four factors:
- What information was involved, and how sensitive or identifying it is
- Who received or used it
- Whether it was actually acquired or viewed
- How much the risk has been mitigated, for example a written confirmation of destruction
Some situations aren't breaches at all, such as a lost laptop that was properly encrypted.
The deadlines
If it is a breach of unsecured PHI:
| Who you notify | Deadline |
|---|---|
| Affected patients | Without unreasonable delay, no later than 60 days after discovery |
| HHS (500+ people) | Within the same 60 days |
| Media (500+ in a state) | Within the same 60 days |
| HHS (fewer than 500) | Within 60 days after the end of the calendar year |
| Your state | Varies by state, and can be shorter |
Discovery is counted from when any workforce member knew, or reasonably should have known, not when the owner found out. That's why staff must report problems immediately.
Afterwards
Fix the cause, update your risk analysis, retrain if needed, and keep all documentation for six years.
Be ready before it happens
Our policy kit includes an Incident Response and Breach Notification policy with the four-factor assessment, a notification table and an incident log. Our staff training teaches every employee to report the same day. For hands-on help after an incident, contact us.
This article is general information, not legal advice. In an active incident, involve your IT provider, your cyber insurer and qualified legal counsel.