News
Aesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data BreachAesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data Breach
Beginnerfront deskpractice managerprovidervendor

What should I do if I think something went wrong?

Wrong fax, strange email, lost phone, or coworker snooping, here's how to respond without making it worse.

TL;DR

Stop, tell your privacy officer or supervisor right away, and document facts. Do not try to cover it up or decide on your own if it is a 'real' breach. That is leadership's job with legal help.

Updated 2026-04-21

Most HIPAA problems are not movie-style hacker attacks. They are human moments: a fax to the wrong clinic, an email auto-filled to the wrong person, a tablet left in a coffee shop, or a curious employee opening a celebrity chart.

Your job is not to be the lawyer. Your job is to report quickly and preserve the story.

Step 1: Pause the harm if you can

If you just sent something to the wrong place, tell your supervisor immediately, sometimes IT or the recipient can contain the message before it spreads.

If a device is missing, report it so remote wipe or password rotation can start.

Step 2: Tell the right person today

Your practice should name a privacy officer or escalation path. Use it even if you feel embarrassed. Early reporting is what turns an "oops" into a managed incident instead of a cover-up.

Step 3: Write down plain facts

Note what happened, when, whose information was involved (best estimate), what systems were used, and what you already did. Screenshots and fax logs help.

Common situations

Wrong fax number. Notify supervisor; your office may call the recipient to request destruction; leadership decides if breach analysis is needed.

Email to the wrong address, IT may recall messages in some systems; if not, document and escalate.

Lost phone or laptop. Report immediately; encryption status matters a lot for next steps.

Coworker browsing charts with no work reason, Do not confront; report to the privacy officer for investigation.

What not to do

  • Don't delete evidence.
  • Don't promise a patient that "nothing will happen" until the facts are reviewed.
  • Don't decide on your own that it was "too small" to mention.

Keep reading

Next in your reading path → HIPAA compliance checklist

Not legal advice. Educational overview only; consult qualified counsel for your situation.