We had a security incident (malware, intrusion, or lost device)

1. 1

   Contain and isolate

   Disconnect affected systems if needed. Do not wipe drives until counsel or forensics advises, evidence matters.

2. 2

   Engage counsel and forensics

   Attorney-client privilege can protect parts of the investigation. Forensics helps prove whether PHI was accessed.

3. 3

   Notify insurers and leadership

   Cyber policies often have short notice windows. Brief executives under NDA as appropriate.

4. 4

   Prepare customer and regulatory notifications

   If PHI was involved, your BAA and HIPAA may require customer notice and a breach risk assessment.

Not legal advice. Follow your organization's policies and consult counsel for legal questions.