Technical decision log
- Systems, accounts, indicators, and time range
- Containment action and operational effect
- Evidence acquired, gaps, and chain of custody
- Recovery criteria, tests, and return-to-service approval
Incident response for PHI and ePHI
Coordinate Patient Care, Forensics, and Breach Decisions Before an Incident
A healthcare incident becomes more dangerous when no one knows who decides, who investigates, who contacts vendors, who preserves evidence, and who handles regulatory or patient notification decisions.
Stabilize care and preserve evidence before conclusions.
Run technical response and HIPAA analysis in parallel.
Use one decision log with facts, owners, deadlines, and authority.
First 72 hours
Coordinate Patient Care, Technical Containment, and HIPAA Decision-Making
A security event is not automatically a reportable breach, and a quick restoration is not automatically a complete response. The organization needs reliable facts, preserved evidence, safe clinical operations, and a documented breach-risk analysis performed with appropriate legal and privacy guidance.
First hour
Declare, protect, and preserve
Activate the incident lead, protect patient-safety functions, preserve volatile and durable evidence, record the initial report, restrict unsafe access, identify affected systems and vendors, and avoid uncoordinated deletion or reimaging. Start an immutable timeline with times, actors, facts, actions, and evidence locations.
Hours 1–8
Run two connected workstreams
Technical: determine entry path, identity use, affected assets, malware behavior, persistence, data access or exfiltration indicators, encryption, containment, logging limits, and recovery options. Privacy/legal: identify PHI categories, individuals, unauthorized persons, permitted-use questions, contract obligations, law enforcement considerations, insurance notice, and facts needed for the required risk assessment.
Hours 8–24
Control dependencies and communications
Validate vendor facts and notification duties, coordinate forensic access, maintain chain of custody, approve internal and patient-care messages, track downtime workarounds, prepare alternate communications, and establish leadership decision points. Do not state that no data was accessed merely because logs are incomplete.
Hours 24–72
Move from emergency action to documented decisions
Refine scope, reconcile affected records, document assumptions and uncertainty, complete or advance the breach-risk assessment, determine notification responsibilities and deadlines, validate restoration, monitor for recurrence, and assign corrective actions. Preserve the reasoning behind each conclusion and who approved it.
HIPAA decision log
- Nature and extent of PHI involved
- Unauthorized person who used or received it
- Whether PHI was actually acquired or viewed
- Extent to which the risk was mitigated
- Notification conclusion, authority, and approval
Ransomware requires disciplined analysis
Do not assume encryption by malware proves acquisition, and do not assume lack of observed exfiltration proves no breach. Evaluate the specific evidence, the HHS breach standard, system behavior, available logs, attacker access, PHI scope, and mitigation with qualified legal and privacy guidance.
Preparedness details
Pre-Stage the Information and Authority an Incident Team Will Need
Contact and authority matrix
Maintain current internal leaders, privacy and security roles, counsel, cyber insurer, forensic provider, IT support, hosting, EHR, critical vendors, law enforcement channel, communications, and executive approvers. Record who may isolate systems, engage vendors, spend emergency funds, approve downtime, and communicate externally.
Evidence map
Identify available logs for identity, endpoints, email, cloud, EHR, VPN, firewall, remote support, servers, backups, physical access, and vendors; retention periods; time synchronization; export procedure; and who can retrieve them. Note known blind spots before an incident.
PHI and patient index
Prepare methods to determine affected data categories and individuals across the EHR, imaging, documents, billing, messages, portals, archives, and vendors. A forensic system list may not directly identify every patient represented in the data.
Downtime and restoration criteria
Define minimum safe clinical functions, alternate communication, manual records, medication and result access, billing capture, reconciliation, system recovery order, integrity checks, security validation, and authority to return to service.
Notification production
Prepare secure methods for identity and address reconciliation, duplicate removal, deceased or minor handling, translation, letter review, mailing, call-center preparation, substitute notice, website content, and tracking. Legal guidance should direct applicable requirements.
Post-incident corrective action
Separate immediate containment from root-cause remediation. Assign owners, due dates, validation, and residual-risk decisions for technical, vendor, policy, training, and governance issues. Retest the scenario after material improvements.
Tabletop exercises should inject uncertainty: incomplete logs, a critical vendor that cannot respond, conflicting evidence about exfiltration, a long outage, media inquiry, affected executives, and a simultaneous patient-safety issue. Record decisions and gaps instead of treating attendance as success. The exercise should also test after-hours activation, access to counsel and insurance requirements, secure sharing of sensitive evidence, handoff between internal staff and outside responders, patient identification methods, executive approval, and the transition from emergency response into tracked corrective action. Repeat the exercise after major system, vendor, leadership, or insurance changes.
What the Breach Notification Rule Requires
Breach presumption and required assessment
HHS explains that covered entities and business associates must provide notification after a breach of unsecured PHI. The assessment considers the nature and extent of PHI, the unauthorized person, whether PHI was actually acquired or viewed, and mitigation. See HHS Breach Notification Rule.
Written response prevents improvisation
The practice should not improvise under pressure. It should have a written process, legal/compliance escalation, cyber insurance contacts, forensic response path, patient notification process, vendor notification expectations, and evidence preservation steps.
Ransomware and System Downtime
Clinical downtime and compliance occur together
Ransomware can disrupt appointments, imaging, billing, prescriptions, claims, phones, email, and patient communication. The compliance issue and the business continuity issue happen at the same time.
Continuity and recovery decisions
A resilient practice needs tested backups, downtime procedures, emergency access, printed critical contacts, offline recovery steps, and leadership decision criteria.
Evidence to Preserve
Logs and artifacts to preserve
Preserve alert logs, endpoint evidence, firewall logs, email headers, affected user accounts, timeline notes, vendor communications, backup status, screenshots, file samples, access logs, and decisions made during containment.
Avoid destroying evidence during restoration
Do not wipe or rebuild systems before preserving the evidence needed for investigation unless containment and patient safety require immediate action.
Run Two Coordinated Workstreams
Technical incident response
Establish scope, contain safely, preserve evidence, eradicate persistence, restore clean services, monitor recurrence, and record decisions. Protect patient safety and continuity while avoiding premature wiping that destroys investigative evidence.
Privacy and breach response
Engage privacy, legal, insurance, communications, and leadership; identify PHI and individuals; apply the documented four-factor assessment; manage business associate notices; meet notification obligations; and retain proof of the conclusion.
Prepare a Decision Log Before the Crisis
Record discovery time, reporter, systems, containment authority, evidence custodian, counsel direction, insurer notice, vendor actions, PHI analysis, affected population estimate, notification decisions, regulatory submissions, patient communications, recovery validation, and corrective actions. Time-stamped facts and decisions are more defensible than a retrospective narrative assembled weeks later.
Use the Current Breach Standard and Preserve the Analysis
Notification duties depend on facts and legal analysis. Engage appropriate counsel and insurance contacts early when a material incident occurs.
HHS Breach Notification Rule
HHS explains the breach presumption, risk-assessment factors, notification duties, and timing. Review HHS breach guidance
HHS Security Rule
The Security Rule framework informs incident procedures, contingency planning, safeguards, and documentation. Review Security Rule guidance
Breach and Incident-Response Decision Questions
Is every security incident a HIPAA breach?
No. A breach analysis is needed to determine whether an impermissible use or disclosure compromised PHI under the rule.
Should the practice call IT first or legal first?
Both technical containment and legal/compliance guidance may be needed quickly. The response plan should define the escalation sequence before an event.
What should be tested before an incident?
Backup restoration, downtime workflow, account disablement, vendor contacts, communication process, and evidence collection should be tested.
Prepare the Decision Process Before an Incident
OC Security Audit can review incident governance, technical readiness, evidence preservation, vendor coordination, breach-analysis inputs, tabletop exercises, and corrective-action tracking.
IT Perfection can support technical preparedness and recovery implementation for identities, endpoints, Microsoft 365, backups, servers, networks, monitoring, patching, and operational continuity.