Purpose of the Template
When an EHR vendor is compromised, their timeline becomes your timeline. Consider the case of Accumedic Computer Systems. The vendor detected suspicious activity on June 8, 2026, concluded on August 7 that an unauthorized party accessed its network on April 8, and confirmed on September 1 that Protected Health Information (PHI) was exposed. Hispanic Counseling Center began notifying patients on October 30.
That's a long road from first access to patient letters. Your job is to keep your own clock running while the vendor investigates. This template is a Business Associate Incident Response Playbook, a one-document script your team can copy, fill in, and file before an incident happens. It covers vendor questioning, internal decision logging, and patient and regulator communication.
Prerequisites
Before using the template, confirm you have:
- A current inventory of every Business Associate that creates, receives, maintains, or transmits Electronic Protected Health Information (ePHI) for you, with the EHR vendor ranked first.
- A signed Business Associate Agreement (BAA) for each, including breach reporting terms.
- Your Breach Notification Rule procedures, including who decides whether an incident is a reportable breach.
- Named contacts at the vendor (security, legal, account management), not just a support line.
- Your cyber insurance policy and breach counsel contact details.
If your BAA says only "notify without unreasonable delay," fix that first. A defined window, such as a specific number of days from discovery, is something you can enforce. Set the number with counsel.
The Template
Copy everything below into your policy library.
BUSINESS ASSOCIATE INCIDENT RESPONSE PLAYBOOK
Section 1: Trigger
This playbook activates when (a) a Business Associate notifies us of a security incident, (b) we learn of a Business Associate incident through media, regulators, or another customer, or (c) we detect anomalies traceable to a Business Associate connection.
Date/time we learned of the incident: []
Source of notice: []
Logged by: [____]
Section 2: Day-One Vendor Questions (send in writing)
- What happened, and when was suspicious activity first detected?
- When did unauthorized access most likely begin, and what is the confirmed window of potential data access?
- Which of our systems, tenants, or data sets are in scope?
- What data elements are involved (names, dates of birth, Social Security numbers, medical information, insurance information)?
- Has an independent third-party forensic firm been engaged? Name and engagement date.
- Has the intrusion been contained? What technical safeguards have been added?
- Has law enforcement been notified?
- When will you deliver the list of affected individuals, and in what format?
- Who is your single point of contact for our account?
- Do you intend to notify our patients directly? (Our position: you will not, without our written approval of content and timing.)
Section 3: Internal Decision Log
| Date | Decision | Decision-maker | Basis |
|---|---|---|---|
| [__] | Incident confirmed as potential breach of unsecured PHI | HIPAA Compliance Officer | [__] |
| [__] | Four-factor risk assessment completed | Privacy Official | [__] |
| [__] | Counsel engaged | [__] | [__] |
| [__] | Notification approach approved | [__] | [__] |
Section 4: Breach Risk Assessment
Document the four factors required under the Breach Notification Rule: (1) nature and extent of PHI involved, including identifiers and likelihood of re-identification; (2) the unauthorized person who used or received the PHI; (3) whether PHI was actually acquired or viewed; (4) extent to which risk has been mitigated. Conclusion: [____]
Section 5: Notification Plan
Individuals: Letter drafted [date]; approved by [name]; mail date [date]. Letter states what happened, what information was involved, steps individuals should take, what we are doing, and contact methods.
HHS: Submission via OCR breach portal on [date] (or annual log, if fewer than 500 individuals).
State attorneys general: Required states: []. Submitted [date].
Media: Required if more than 500 residents of a state or jurisdiction are affected. Decision: []
Credit monitoring: Offered Y/N; provider []; code distribution method [].
Section 6: Vendor Accountability Follow-Up
Obtain the final forensic summary. Reassess the vendor's risk tier. Review the BAA. Decide: continue, continue with conditions, or transition. Record in the vendor file by [date].
Customizing the Template
Section 1: Add every channel your intake team actually uses, including the compliance hotline and your IT service desk.
Section 2: Tailor the questions to the data you hold. A behavioral health provider should add a question about substance use disorder records and whether 42 CFR Part 2 data is in scope. A multi-site organization should ask which locations share the vendor tenant.
Section 3: Keep the log in a tool with timestamps, not email. If OCR asks why you took the time you took, this is your answer.
Section 4: Have your Privacy Official pre-draft the four-factor worksheet so the first incident is not the first time anyone has seen it.
Section 5: Build a state-by-state notification matrix with counsel. Residency of affected individuals, not your office location, drives state obligations. Note that you may not know the final count when you first notify the attorneys general; plan for supplemental filings.
Section 6: Link this to your annual vendor reassessment. A HITRUST CSF certification or a documented HIPAA Security Rule risk analysis from the vendor gives you something concrete to compare against.
Validation Steps
- Tabletop it. Run a 60-minute exercise using a scenario where your EHR vendor reports a compromise with a multi-month gap between first access and discovery. Time how long it takes to send the Section 2 questions.
- Test the contacts. Call every named vendor contact. Confirm they answer and know your account.
- Check BAA alignment. Compare Section 2 against your BAA. Every question should map to a contractual obligation. Where it doesn't, note the gap for renewal.
- Review with counsel. Confirm Section 5 against current state and federal requirements. Notification rules change.
- Audit the log. After the exercise, ask whether a regulator reading your decision log could reconstruct what you knew and when.
- Schedule the refresh. Review the playbook at least annually and after every real incident, including incidents at other organizations you learn from.
The Accumedic timeline shows how much happens before patients get a letter. This playbook won't speed up a vendor's forensics, but it will ensure your side of the clock is documented, your questions are asked on day one, and your communications are ready when the facts arrive.
