A federal agency informs you that your network was likely breached. Nearly two years later, your patients receive a letter. This was the timeline in a class action settlement involving Hospital Español Auxilio Mutuo de Puerto Rico. It's a valuable lesson for your incident response program.
The Department of Homeland Security (DHS) notified the hospital on September 23, 2023, about a potential breach. Notification letters were sent on April 21, 2025, 575 days later, followed by a $500,000 settlement fund. The hospital denies wrongdoing, but this serves as a cautionary tale. Below are mistakes that lead to such delays.
Why These Mistakes Keep Happening
Breach response often fails due to gaps between teams. IT security investigates, legal reviews, compliance waits, and no one manages the timeline. The desire for certainty ("let's finish the forensics first") contributes to delays that seem justified at each step.
The Breach Notification Rule doesn't support this approach. Covered Entities must notify affected individuals without unreasonable delay, no later than 60 days after discovery. Discovery isn't when the investigation ends. Under 45 CFR 164.404, a breach is considered discovered on the first day it's known or would have been known with reasonable diligence.
Mistake 1: Treating the Outside Alert as a Lead, Not a Trigger
Why it happens: External warnings may lack proof of data loss. In the Hospital Español case, it wasn't clear if patient data was involved. Teams see this ambiguity as a reason to wait.
Consequence: The clock might already be ticking. A credible alert from a government agency is exactly what "reasonable diligence" is meant to capture. Waiting for confirmation can appear as willful avoidance.
Fix: Implement a trigger policy that identifies external alerts (DHS, FBI, law enforcement, a Business Associate, a threat intelligence feed) as incident declaration events. Declaring an incident starts the documented risk assessment, not the notification, but it records when you knew.
Mistake 2: Running the Investigation as One Long, Open-Ended Project
Why it happens: Forensics is challenging. Here, internal and external experts didn't conclude until September 24, 2024, that the network was compromised from August 2022 to September 2023 and that patient data was likely exfiltrated. A year-long investigation seems diligent.
Consequence: Individuals remain unprotected. They can't freeze credit or monitor for fraud on Social Security numbers they don't know were exposed.
Fix: Stage your investigation with decision points. Set a fixed interval (e.g., every 14 days) where the incident team answers three questions: what do we know, what's our reasonable-probability assessment under the four-factor risk assessment at 45 CFR 164.402, and are we obligated to notify now? The Breach Notification Rule allows phased notice. Notify the confirmed population, then supplement.
Mistake 3: Assuming a Gap Between Discovery and Scoping Is Invisible
Why it happens: Teams think the notification clock only matters when a regulator or plaintiff asks. They focus on the final letter, not the paper trail.
Consequence: When the timeline is reconstructed in litigation or an Office for Civil Rights (OCR) inquiry, every unexplained gap becomes evidence. The Hospital Español complaint alleged untimely notification as part of several negligence claims, including inadequate monitoring and training.
Fix: Maintain a contemporaneous incident log: date of alert, date incident declared, scoping milestones, decisions made, and who made them. Document why any delay was necessary, such as a law enforcement request under 45 CFR 164.412. If you can't explain a gap in writing, expect to be questioned.
Mistake 4: Writing a Notice That Softens the Threat
Why it happens: Legal and communications teams aim to avoid alarm. Language drifts toward "may have been accessed" even when exfiltration is likely.
Consequence: Plaintiffs in this case alleged the hospital obscured the breach's nature and threat. Even if you disagree, a vague letter invites such claims and erodes patient trust.
Fix: Follow 45 CFR 164.404(c) precisely: what happened, the types of Protected Health Information (PHI) involved, steps individuals should take, what you're doing in response, and contact procedures. Clearly name the data types. In this incident, those included Social Security numbers, health insurance information, and billing and claims data. Have someone outside the drafting team read it at an eighth-grade level and ask, "Would I know what to do?"
Mistake 5: Treating Detection as a Perimeter Problem
Why it happens: Organizations invest in prevention tools and assume they cover monitoring. The Hospital Español complaint alleged ineffective network monitoring for intrusions. The compromise window spanned from August 2022 to September 2023, and the entity learned of it from DHS, not its own tools.
Consequence: Extended attacker access increases the breach's scope. A year of access means more systems, more records, and a tougher investigation.
Fix: Tie detection to your Security Rule risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and information system activity review (164.308(a)(1)(ii)(D)). Ensure you can answer: which logs are collected, who reviews them, how often, and what triggers escalation? NIST SP 800-66 provides implementation guidance. Also, ensure your Recognized Security Practices are documented well enough to demonstrate them to OCR.
Prevention Checklist
- Incident policy names external alerts as declaration triggers
- Discovery date definition matches 45 CFR 164.404(a)(2)
- A single named owner holds the notification clock
- Investigation reviews occur at fixed intervals with notify/wait decisions logged
- Phased notification is pre-approved in your playbook
- Law enforcement delay requests are documented per 164.412
- Notice templates reviewed against 164.404(c) required elements
- Log review cadence and escalation criteria are written and tested
- Business Associate agreements require prompt incident reporting with a defined timeframe
- Tabletop exercise this year starts with "a federal agency says you were likely breached"
Run that last exercise. If your team's first instinct is to wait for certainty, you've found your gap before a plaintiff does.
