We think we may have had a data breach
Treat it as a breach until proven otherwise. The 60-day clock is running.
- 1
Contain the incident immediately
Stop the bleeding first. If systems are compromised, disconnect affected devices. If it was a misdisclosure, document what was shared and with whom.
- 2
Assemble your response team
Notify your privacy officer, IT support, and consider engaging a HIPAA attorney immediately for attorney-client privilege over the investigation.
- 3
Conduct the four-factor risk assessment
HIPAA requires a specific four-factor analysis to determine if this is a reportable breach. Use our Breach Notification Checker tool to walk through this.
- 4
Notify your cyber insurance carrier
If you have cyber insurance, notify them now. Many policies have strict notice requirements and they can provide breach response resources.
- 5
Prepare for notification if required
If the breach is reportable, you must notify affected individuals, HHS, and potentially the media within 60 days of discovery.
Important
The 60-day notification clock runs from the date of discovery, not the date you finish your investigation. Do not delay.
Related
Still unsure? Ask AI about this situation →
Not legal advice. Follow your organization's policies and consult counsel for legal questions.