HIPAA Incident Response and Breach Management
When a security incident or potential breach occurs, your response must be fast, documented, and compliant. The incident management system gives your team one place to report, investigate, and document incidents, and the Full-Scope plan also includes incident response guidance as needed.
Required under 45 CFR 164.308(a)(6) and 45 CFR 164.400 to 164.414
What Is HIPAA Incident Management?
HIPAA incident management covers the detection, assessment, containment, notice, and record-keeping for security events and breaches involving protected health information (PHI: individually identifiable health information in any form or medium, per 45 CFR 160.103). It is not just a checklist. It is a set response program that must be in place before something goes wrong.
Key regulatory requirements include Security Incident Procedures at §164.308(a)(6), the Breach definition at §164.402, Individual notification at §164.404, and HHS notification at §164.408. See the HHS breach notification guidance and the full text of Subpart D for the full regulatory framework.
The required implementation specification under the security incident standard reads:
“Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.”
45 CFR 164.308(a)(6)(ii), eCFR
HHS requires notification to affected individuals within 60 days of discovering a breach. The clock starts at discovery, not at the conclusion of the investigation.
A HIPAA breach is defined under 45 CFR 164.402 as the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI.
When a potential breach is identified, the covered entity must apply the four-factor breach risk assessment required under 45 CFR 164.402 to determine whether notification is required:
- The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the PHI or to whom the disclosure was made.
- Whether the PHI was actually acquired or viewed.
- The extent to which the risk to the PHI has been mitigated.
A security incident is not automatically a breach. The four-factor risk assessment determines whether notification is required. Every incident must still be documented under the Security Incident Procedures at 45 CFR 164.308(a)(6), but only events that meet the breach threshold under 45 CFR 164.402 trigger notification obligations.
Who Needs This
- Groups that have had or suspect a security event or wrongful PHI sharing
- Practices without a written incident response plan or breach notice steps
- Teams that want to establish anonymous reporting channels for staff
- Groups that had an event but are unsure if it meets the breach notice threshold
- Business associates required to report incidents to their covered entity clients
Key Incident-Response Terms Defined
The distinctions that decide how you respond: not every security incident is a breach, and only a breach of unsecured PHI triggers notification.
- Security incident
- The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations. 45 CFR 164.304
- Breach
- An impermissible use or disclosure of PHI that compromises the security or privacy of the information. 45 CFR 164.402
- Unsecured PHI
- PHI that has not been made unusable, unreadable, or indecipherable to unauthorized persons, for example through encryption or destruction. 45 CFR 164.402
- Electronic PHI (ePHI)
- PHI created, received, maintained, or transmitted in electronic form. 45 CFR 160.103
Six-Step Incident Response Process
This structure ensures every event is handled the same way, fully recorded, and resolved within required time limits.
- 01
Detection & Reporting
Establish clear channels for staff to report suspected incidents, including anonymous reporting options.
- 02
Initial Assessment
Find out if the event counts as a security incident and whether PHI was involved, exposed, or at risk.
- 03
Containment
Stop the incident from spreading, secure affected systems, and preserve evidence for investigation.
- 04
Risk Assessment
Apply the four-factor breach review to find out if notice duties are triggered under §164.402.
- 05
Notification & Documentation
If a breach is confirmed, send notice to affected persons, HHS, and media if required.
- 06
Post-Incident Review
Record lessons learned, update steps, and put safeguards in place to reduce future risk.
Breach notice deadlines at a glance
| Who is notified | When it applies | Deadline | 45 CFR |
|---|---|---|---|
| Affected individuals | Every breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery | 164.404(b) |
| Prominent media outlets | More than 500 residents of a State or jurisdiction | Without unreasonable delay, no later than 60 calendar days after discovery | 164.406(b) |
| HHS (the Secretary) | 500 or more individuals | At the same time as the notice to individuals | 164.408(b) |
| HHS (the Secretary) | Fewer than 500 individuals | Keep a log; report no later than 60 days after the end of the calendar year | 164.408(c) |
| The covered entity (sent by a business associate) | Every breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery | 164.410(b) |
Case 01: Audit-Ready in Under a Week
A mental health franchise office in Florida, part of a group of more than 100 offices, had a state auditor due in days, with its license at stake. Policies were never written, records had holes, and staff training was half done.
Chuck ran a fast gap analysis to find the highest-risk holes, then built a ranked plan around what the auditor would ask for. Staff got clear jobs and due dates, with a short check-in each day.
The office was audit-ready in under a week. It passed its state audit and kept seeing patients.
Case 01 was not an incident response engagement. It shows the approach behind this one: find the highest-risk gaps first, rank the work, and give each person a clear job and a due date. Read Case 01
Setup Timeline
A basic incident response program can be running in weeks, not months. Groups with active events get instant response support.
- Current IR capability assessment
- Gap identification
- Team alignment
- IR plan development
- Reporting channel setup
- Response workflow design
- Staff training on spotting events
- Record templates
- Incident response guidance as needed (Full-Scope)
- Incident management system
Incident Patterns by Healthcare Specialty
Incident patterns vary by specialty. Response steps and training differ by how each type of practice actually works.
Medical Practices
Multi-user EHR access creates snooping risk, referral workflows expose PHI to being sent to the wrong place, and high patient volume raises the chance of events.
Behavioral Health
The sensitive nature of mental health records makes any wrongful access very harmful to patients.
Dental Practices
Shared workstations in treatment rooms and imaging system access create unique risk patterns.
Pharmacies
Controlled substance tracking overlaps with PHI access. High transaction volume widens the risk area.
Business Associates
Contract-based event reporting duties to covered entity clients with set timeline rules.
Telehealth Providers
Session recording incidents, platform access breaches, and remote workforce incident reporting challenges.
What Your Incident Response Program Includes
Every incident response project produces ready-to-use, policy-grade documents that meet the written steps required of 45 CFR §164.308(a)(6) and the notice rules across the Breach Notice Rule at 45 CFR §§164.400 to 414. The following items are included in every standard project:
The reporting mechanism is built into the platform. Staff can file a report in a few lines of text (anonymously if they choose) and your compliance officer is notified automatically the moment it is submitted. A full investigation module then keeps follow-up and risk-mitigation work on track for every reported incident.
Incident Response Plan
Full written steps covering detection, review, containment, notice, and record-keeping.
Breach Assessment Framework
Four-factor review template aligned with §164.402 for finding notice duties.
Anonymous Reporting System
Staff-accessible reporting channel with clear intake workflow and compliance officer routing.
Notification Templates
Pre-built templates for notice letters to persons, HHS reporting, and media notice if required.
Post-Incident Review Process
Structured debrief framework with root cause review and record of steps taken to prevent repeat events.
Part of Full-Scope
Incident management comes with Full-Scope, along with incident response guidance and 4 hours a month of 1:1 implementation calls with Chuck.
See pricing →Incident response is included in Full-Scope.
One plan, three ways to pay. No per-user fees. Every client gets 4 hours a month of 1:1 implementation calls with Chuck.
- The full platform: SRA, gap analysis, remediation plans
- Policy templates and staff training
- Vendor and BAA management
- 4 hours a month of 1:1 implementation calls with Chuck
- Incident response guidance
- CMS audit response support
One payment, two full years of coverage.
Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.
Why This Approach Delivers Better Outcomes
The worst time to build an incident response plan is during an active incident. Recent events like the Vercel security incident in April 2026 demonstrate how fast a vendor-side breach can cascade into HIPAA exposure for healthcare organizations. Prepare procedures, train staff, and set up reporting channels before something happens. When it does happen, your team knows exactly what to do and in what order.
Proper incident handling also shrinks breach scope. Groups that detect and contain events quickly limit the number of affected persons, which directly impacts notice costs and legal exposure.
For groups that work with business associates, 45 CFR 164.314 sets the rules that govern how breach notice duties must flow between covered entities and their business associates through properly signed Business Associate Agreements.
Groups with written incident response steps contain breaches 54% faster on average than those without. Speed matters when the 60-day notice clock is ticking.
Common Pitfalls We Help You Avoid
- No written plan: Without written steps, incident response becomes ad hoc and error-prone under pressure
- Delayed reporting: Staff who do not know what counts as an event cannot report one, so training is essential
- Skipping breach assessment: Not every event is a breach to report, but every event needs a written review
- Missing the 60-day window: HHS notice deadlines are strict. Late notice is itself a violation of the Breach Notification Rule
- No post-incident review: Failing to learn from events means the same weak points create repeat problems
How to Track Incident Response Metrics
Use a steady set of quarterly metrics to gauge your incident response program. Track the number of events reported, average response time from discovery to containment, the share of events that received a full breach review, and staff training pass rates.
Keep a compliance officer-level view that shows trend direction across quarters. Programs that track metrics improve faster because they catch process failures before they become legal ones.
Track incident metrics quarterly. Rising report volume is usually a sign that staff awareness is working, not that problems are increasing. Underreporting is the real risk.
One Guy Consulting in 37 seconds
Frequently Asked Questions
What is the difference between a security incident and a breach?+
When do we have to notify HHS about a breach?+
Can staff report incidents anonymously?+
What is the four-factor breach assessment?+
Do business associates have the same notification obligations?+
HIPAA Standards Addressed by This Service
The following federal rules define the specific needs this service is designed to help covered entities and business associates meet.
Security Incident Steps
Requires covered entities and business associates to put in place written policies and steps to address security events, including responses to and records of events.
Group-Level Rules
Governs Business Associate Agreements and the contract duties that require business associates to report security events and breaches to their covered entity clients.
Breach Notice Rule
Defines what counts as a breach, the four-factor risk assessment, and the notice rules for persons (§164.404), media (§164.406), HHS (§164.408), and business associate duties (§164.410).
About the author
Chuck Weiselberg is the Founder and HIPAA Consultant at One Guy Consulting. He holds the Certified HIPAA Professional (CHP) credential and has been consulting since 2015. He has held roughly 23,000 meetings with more than 3,500 organizations. Zero clients fined. Zero failed audits. Read Chuck's full bio.
Ready to Build Your Incident Response Program?
The Full-Scope plan includes the incident management system and incident response guidance as needed, so events are handled quickly, recorded properly, and reported on time.
Deep-Dive Resources
Use these guides to understand the full compliance picture around incident response and breach notification:
Explore our other HIPAA services
Questions About Incident Response?
Tell us about your situation or question.
Or email us at hello@oneguyconsulting.com
Book Your Free 30-Minute Intro Call