Breach Notification Procedures

Breach Notification Procedures

Template. These procedures operationalize the Breach Notification Policy. Replace [bracketed] items with your specifics and adjust steps to match your tools and team size. The letter templates are starting points. Have counsel review notification content before it is sent.

Purpose

To provide repeatable, auditable steps for determining whether an impermissible use or disclosure of unsecured protected health information (PHI) is a reportable breach, for notifying affected individuals, the media, the HHS Secretary, and (where [Organization] is a business associate) the covered entity, and for documenting the breach to meet [Organization]'s burden of proof, implementing the Breach Notification Policy.

1. Intake and breach-discovery clock (164.402, 164.414(b))

1. A suspected impermissible use or disclosure of PHI enters through the Security Incident Response process (workforce report, automated alert, or third-party/business-associate report) and is logged in the [ticketing system].
2. The [Security Official] records the discovery date: the first day the event was known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who caused it. All notification deadlines run from this date. Compute and record the 60-day deadline on intake.
3. The [Security Official], with the [Privacy Officer], names a breach investigator to own the risk assessment and the notification package.

2. Four-factor breach risk assessment (164.402, 164.414(b))

Complete the worksheet below for every impermissible use or disclosure of unsecured PHI. First confirm the threshold question; if any exclusion in Policy §1 applies, document it and stop. Otherwise the incident is presumed a breach and notification proceeds unless all four factors together establish a low probability that the PHI was compromised.

Breach Risk Assessment Worksheet

- Incident ID / discovery date: [id] / [date] - Threshold: is this PHI, and was the use/disclosure impermissible under the Privacy Rule? [Y/N + basis] - Was the PHI _unsecured_ (not encrypted/destroyed to HHS standard)? [Y/N] (if secured → no notification; document and close) - Does an exclusion apply (good-faith internal access / inadvertent authorized-to-authorized / unable-to-retain)? [Y/N + basis] - Factor 1 (Nature & extent of PHI): identifiers involved, sensitivity, re-identification likelihood → [low/med/high + notes] - Factor 2 (Unauthorized recipient): who received/used it; are they HIPAA-obligated? → [low/med/high + notes] - Factor 3: Was the PHI actually acquired or viewed (vs. merely exposed)? → [low/med/high + notes] - Factor 4 (Mitigation): recovery, attestations of destruction, other risk reduction → [low/med/high + notes] - Number of individuals affected / states or jurisdictions: [n] / [list] - Determination: ☐ Low probability of compromise: not a reportable breach ☐ Reportable breach - Assessor / date / [Privacy Officer] approval: [name/date]

1. The investigator completes the worksheet using facts from the incident investigation.
2. The [Privacy Officer] reviews and records the final determination. A "not a reportable breach" outcome must rest on the documented low-probability finding (this is the burden-of-proof record).
3. The completed worksheet is stored in the [ticketing system] and the [compliance tracking system].

3. Determine required notifications and deadlines (164.404, 164.406, 164.408, 164.410)

Using the affected count and residency from §2, select the obligations (all measured from the discovery date):

Before sending, check §8 (law-enforcement delay) and any state breach-notification laws, which may impose shorter deadlines or additional recipients (e.g., state attorney general); counsel confirms.

4. Notify affected individuals (164.404)

1. The investigator drafts the individual notice from the template below; [Privacy Officer] and counsel approve.
2. Send by first-class mail to the last known address (or email if the individual agreed to electronic notice); for a known-deceased individual, notify next of kin or personal representative.
3. Insufficient/out-of-date contact info: for < 10 individuals use substitute notice (e.g., telephone); for ≥ 10 post a conspicuous notice for 90 days on the [Organization] website home page or in major print/broadcast media serving the area, with a toll-free number live ≥ 90 days.
4. For risk of imminent misuse, also notify urgently by telephone or other appropriate means.
5. Record send dates, method, and recipient counts in the breach record.

Template: Individual Notification Letter

[Date] [Individual Name] · [Address]

Dear [Individual Name],

We are writing to inform you of a recent incident that may have involved some of your protected health information. We discovered this incident on [discovery date]; it is believed to have occurred on or about [breach date].

What happened. [Brief, plain-language description.]

Information involved. The information that may have been involved included [types of PHI, e.g., name, date of birth, Social Security number, account number, diagnosis].

What you can do. [Steps the individual should take, e.g., monitor statements, place a fraud alert, review the enclosed guidance.]

What we are doing. [Investigation, mitigation, and steps to prevent recurrence.]

For more information. Call [toll-free number], email [contact email], or write to [postal address]. [Website.]

Sincerely, [Name], [Privacy Officer], [Organization]

5. Notify the media (> 500 in one state/jurisdiction) (164.406)

1. Identify prominent media outlets serving each affected state or jurisdiction.
2. Issue a press release / statement carrying the same content elements as the individual notice (§4), approved by [Privacy Officer] and counsel, within the 60-day deadline.
3. Retain the release, the distribution list, and proof of issuance in the breach record.

6. Notify the HHS Secretary: HHS-portal submission SOP (164.408)

1. Go to the HHS Office for Civil Rights Breach Portal ([HHS breach portal URL]) and open the electronic breach-report form.
2. Complete the form: covered-entity/business-associate details, breach dates (discovery and occurrence), type of breach, type of PHI, number of individuals affected, safeguards in place, and the notification and mitigation actions taken.
3. Routing by size:
   • ≥ 500 individuals: submit ≤ 60 days after discovery, concurrently with individual notice.
   • < 500 individuals: log throughout the year (§7) and submit one entry per breach ≤ 60 days after the end of the calendar year of discovery.
4. Save the submission confirmation (ID/receipt) to the breach record. File any required addendum when new facts emerge.

7. Maintain the breach log (164.408(c), 164.414(b))

Record every reportable breach (regardless of size) in the breach log at determination, then update it through closure. The log drives the annual HHS submission for sub-500 breaches and is part of the burden-of-proof record.

Breach Log: columns

Incident ID · discovery date · breach date(s) · description · type(s) of PHI · # individuals affected · state(s)/jurisdiction(s) · risk-assessment outcome · individual-notice date & method · media-notice date (if applicable) · HHS-notice date & confirmation ID · BA/CE-notice date (if applicable) · mitigation & resolution · annual-submission year · record location.

8. Law-enforcement delay (164.412)

1. On any law-enforcement request to delay, capture it in the breach record.
2. Written request specifying a period → delay the affected notification/posting for that period.
3. Oral request → document it (including the official's identity and date) and delay for no more than 30 days, unless a qualifying written request arrives within that window.
4. Resume and complete notifications immediately when the delay period ends.

9. Close-out, retention, and burden of proof (164.414(a), 164.414(b))

1. Confirm all required notifications were sent within deadline (or that a documented low-probability determination made the incident non-reportable).
2. Verify the breach record is complete: risk-assessment worksheet, notification copies and proofs of delivery, HHS confirmation, media release, BA/CE notice, law-enforcement delay documentation, and mitigation steps.
3. Retain the full record for 6 years. Feed root cause and corrective actions back into the Security Incident Response review.

Records produced (evidence)

Breach risk-assessment worksheets · breach determinations & [Privacy Officer] approvals · individual notification letters and proofs of delivery · media releases & distribution proof · HHS portal submission confirmations · business-associate/covered-entity breach notices · law-enforcement delay documentation · the breach log. These are the artifacts an auditor will request to confirm the controls operate.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Privacy Officer] and after any breach. v1.0.