BREACH RESPONSE — IMMEDIATE STEPS
Think You’ve Had a Breach? Take a Breath — Then Take These Steps.
If you’ve discovered a possible breach of protected health information, the next few hours matter — but panic causes mistakes. Work through the steps below in order, and call us. We help independent practices respond correctly and meet their obligations under the HIPAA Breach Notification Rule.
Call ePHIShield now: (256) 750-1045
If we don’t answer right away, leave a message — we’ll get back to you quickly.
Your First Steps, Right Now
- Contain it. Isolate affected systems or accounts to stop further exposure — disconnect a compromised device from the network, disable a breached login. Don’t wipe or rebuild anything yet.
- Preserve everything. Do not delete, alter, or “clean up” anything — not emails, files, logs, or devices. That data is your evidence and your defense. Turning things off to contain them is fine; destroying them is not.
- Write down what you know. Note the moment you discovered it, what happened, what information may be involved, and every action you take from here. The 60-day notification clock starts at discovery — so documenting when and what you found is critical.
- Loop in the right people. Alert whoever handles privacy and security at your practice, and hold off on notifying patients or the public until the situation is assessed — premature or incorrect notice can create its own problems.
- Call us: (256) 750-1045. We’ll help you determine whether this is a reportable breach, run the required four-factor risk assessment, and handle notifications and HHS reporting correctly and on time.
The Clock Has Already Started
Under the HIPAA Breach Notification Rule, the deadline to notify affected individuals — and, for breaches of 500 or more, to report to HHS — is no later than 60 calendar days from discovery, not from when your investigation wraps up. Acting quickly and correctly from the first hour is what protects your practice. (45 CFR §§ 164.400–414.)
What Happens When You Call
If we don’t pick up immediately, don’t worry — leave a message and we’ll get back to you quickly. When we connect, you’ll reach people who do this work: we’ll help you assess what happened, determine your obligations, and — if notification is required — manage the determination, the notification letters, and the HHS reporting so nothing is missed under deadline. You focus on your patients; we’ll manage the response.
Not in an active breach — but want to be ready before one happens?
This page provides general guidance, not legal advice, and does not create a client relationship. Every incident is different; contact a qualified professional about your specific situation.