A breach rarely announces itself politely. It’s a ransomware note on the front desk screen. A patient calling to ask why they received a bill for a visit that never happened. A staff member who can log in but suddenly has access to records they shouldn’t.
However it starts, what happens in the first 24 hours shapes everything that follows – both for patient care and for how the incident is judged under HIPAA’s breach notification requirements.
Contain First, Investigate Second
The instinct to immediately understand what happened is natural, but containment comes first. Isolate affected systems from the network, preserve logs rather than rebooting devices, and get eyes on the problem – ideally from an incident response team that has handled healthcare breaches before.
Rebooting a compromised system to “fix” it is one of the most common mistakes in the first hour – it can destroy the exact evidence needed to determine what was actually accessed.
The HIPAA Clock Starts Immediately
Under the HIPAA Breach Notification Rule, covered entities generally have 60 days from discovery to notify affected patients, and breaches affecting 500 or more individuals must also be reported to HHS and, in many cases, local media, within that same window. “Discovery” is defined broadly – the clock often starts well before an investigation confirms exactly what happened.
- Document everything from the first moment, including when the incident was discovered and by whom
- Loop in legal counsel early, since breach notification obligations and attorney-client privilege considerations both start immediately
- Determine what data was involved as quickly as the investigation allows – PHI, payment data, and employee data each carry different notification obligations
- Check your cybersecurity insurance policy for required notification timelines to the insurer, which are often shorter than HIPAA’s own deadlines
Keep Patient Care Running Where Possible
Alongside containment and compliance, someone needs to be thinking about continuity of care – whether that means falling back to paper charting temporarily, rescheduling non-urgent visits, or activating a documented downtime procedure. A practice that has rehearsed this in advance loses far less time than one improvising for the first time during an actual incident.
Does Your Practice Have an Incident Response Plan?
Schedule a complimentary consultation and get a clear, no-pressure look at how prepared your practice really is for a breach.