The Problem: Why This Matters Now
You've got a cybersecurity incident. Maybe your SIEM flagged unusual network activity, a vendor called with bad news, or your forensic team just confirmed unauthorized access to systems storing Protected Health Information (PHI).
What happens in the next 90 days determines whether you face a manageable regulatory response or a multi-plaintiff class action lawsuit with $5,000-per-claimant exposure. Wayne Memorial Hospital discovered unauthorized access on June 3, 2024, but didn't mail notification letters until late August 2025. That 14-month gap became ammunition for plaintiffs. Regional Urology moved faster after their October 2025 incident but still faced litigation alleging inadequate cybersecurity controls.
The pattern is clear: slow response and weak pre-breach security lead to expensive settlements and years of legal exposure. This playbook guides you through the technical and procedural steps to reduce both.
What You Need Before Starting
Incident Response Retainer. Have a forensic firm on retainer before a breach occurs. Establish attorney-client privilege through counsel-retained forensics to protect your investigation findings. Budget $50K-$150K for initial response.
Current Asset Inventory. You can't secure what you don't know exists. Maintain an up-to-date inventory of all systems that store, process, or transmit ePHI, including:
- Database servers and file shares
- Backup systems and archives
- Cloud storage buckets
- Workstations with local PHI copies
- Business Associate systems with access
Notification Templates. Pre-draft your breach notification letter template with legal counsel. Include placeholders for incident dates, data elements, and remediation steps. Don't start from scratch at 2 AM on day three of an incident.
Decision Matrix. Document your breach determination criteria now. What evidence threshold triggers a full investigation? Who makes the notification decision? At what point do you engage outside counsel? Write it down while you're calm.
Step-by-Step Implementation
Days 1-3: Containment and Privilege
Engage outside counsel first, then have counsel retain your forensic team. This preserves attorney work-product privilege over investigation findings.
Isolate affected systems without destroying evidence. If you're dealing with ransomware or active intrusion, segment the network but preserve logs and memory dumps. Your forensic team needs:
- Full packet captures if available
- Windows Event Logs (Security, System, Application)
- Authentication logs from Active Directory or identity providers
- Firewall and VPN logs covering the suspected access window
- Database query logs if PHI databases were accessed
Days 4-14: Scoping the Exposure
Your forensic investigation must answer four questions:
- What systems did the attacker access?
- What data elements were exposed?
- When did access begin and end?
- Was data exfiltrated or just accessed?
Run queries against your audit logs to identify every file, database table, or record the attacker touched. If you're using SQL Server, review the default trace and extended events. For file servers, parse NTFS access logs. For cloud storage, pull CloudTrail or Azure Activity logs.
Map accessed files to patient identifiers. If the attacker accessed a folder containing 50,000 patient records, identify those 50,000 individuals. Build a database linking filenames or record IDs to patient demographics.
Days 15-30: Risk Assessment and Determination
Conduct your HIPAA Breach Notification Rule risk assessment. The four-factor test requires you to evaluate:
- Nature and extent of PHI involved (names + Social Security numbers is higher risk than medical record numbers alone)
- Unauthorized person who accessed PHI (sophisticated attacker vs. accidental employee access)
- Whether PHI was actually acquired or viewed
- Extent to which risk has been mitigated
Document your analysis in writing. If you determine notification isn't required, your written risk assessment is your defense if OCR disagrees later.
If notification is required, start building your notification list. Scrub for duplicates and validate addresses. A 5% return rate on mailings looks bad to plaintiffs' attorneys and suggests sloppy data stewardship.
Days 31-60: Notification Execution
Mail individual notifications within 60 days of discovery. The Breach Notification Rule requires:
- Brief description of the breach
- Types of PHI involved
- Steps individuals should take
- What you're doing to investigate and prevent recurrence
- Contact information for questions
Submit your breach report to OCR through the portal within 60 days if the breach affects 500 or more individuals. For smaller breaches, you've got until your annual report, but consider reporting immediately anyway. It demonstrates transparency.
If the breach affects 500+ individuals, notify media outlets serving your state or jurisdiction. One press release to a wire service typically satisfies this requirement.
Days 61-90: Remediation and Documentation
Fix the security gaps the forensic investigation identified. If the attacker exploited unpatched vulnerabilities, patch them. If weak passwords were the entry point, implement multi-factor authentication. If a Business Associate was compromised, audit their security controls.
Document every remediation step. Plaintiffs' attorneys will ask what you did after the breach. "We implemented MFA on all remote access within 30 days and deployed EDR to 100% of endpoints within 60 days" is a strong answer.
Update your Security Rule risk analysis to reflect the incident and remediation. This isn't optional. Your next OCR audit will ask whether you updated your risk analysis after the breach.
Validation: How to Verify It Works
Test Your Notification List. Before you mail 50,000 letters, send 100 test letters to internal addresses and verify they arrive correctly formatted.
Verify Remediation Controls. If you implemented MFA, attempt to authenticate without it and confirm access is blocked. If you deployed endpoint detection, trigger a test alert and verify your SOC receives it.
Run a Tabletop Exercise. Three months after the incident, gather your response team and walk through a similar scenario. Identify gaps in your playbook and update it.
Check Your OCR Filing. Log into the OCR portal 30 days after submission and verify your breach report shows as received and complete.
Maintenance: Ongoing Tasks
Quarterly: Review and Update Your Asset Inventory. New systems appear constantly. If you don't know they exist, you can't protect them.
Annually: Refresh Your IR Retainer. Forensic firms update their rates and scope. Review your agreement each year and adjust your budget.
After Every Incident: Update Your Playbook. What worked? What didn't? What took longer than expected? Revise your timeline and decision criteria based on real experience.
Continuously: Monitor Class Action Filings. Track settlements in your sector. When you see $5,000-per-claimant exposure becoming standard, that's your budget justification for stronger preventive controls. The cost of two-factor authentication is trivial compared to the cost of reimbursing 10,000 patients for documented losses.
The healthcare sector averaged 809 data breaches per year between 2020 and 2024. You're not immune. The question isn't whether you'll face an incident, but whether you'll respond fast enough and thoroughly enough to avoid the legal exposure that follows slow, incomplete responses.
