HIPAA Breach Response Plan: First 24 Hours to 60 Days

It's Tuesday morning. The front desk can't open the schedule. Every file on the server has a strange new extension, and there's a text file on the desktop demanding payment in cryptocurrency. Or it's quieter than that: a hygienist emailed a patient's treatment plan to the wrong address, or the office manager's laptop was stolen from her car. Each of these is a security incident — and some of them are HIPAA breaches with legal deadlines attached.

What you do in the first 24 hours shapes everything that follows: how fast patients get care again, how much data you lose, whether evidence survives, and whether you can prove to the HHS Office for Civil Rights (OCR) that you handled it properly. What you do over the next 60 days determines whether you meet HIPAA's notification rules.

This guide is the plan we'd want any practice to have on file before something happens. It covers how to tell an incident from a breach, an hour-by-hour checklist for the first day, the four-factor risk assessment that decides whether you must notify, who to notify and when (including the 500-person threshold), how HHS treats ransomware, and a fill-in-the-blanks plan template. It's practical guidance from the IT side, not legal advice — your attorney should be on your call list.

What's the difference between a security incident and a breach?

A security incident is any attempted or successful unauthorized access to, or interference with, your information or systems. A breach is an impermissible use or disclosure of PHI that compromises its security or privacy. All breaches start as incidents; most incidents never become breaches.

The legal definitions:

• Security incident (45 CFR 164.304): "the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system." A blocked phishing email, a malware alert, a lost phone and a ransomware attack all qualify.
• Breach (45 CFR 164.402): "the acquisition, access, use, or disclosure of protected health information in a manner not permitted under [the Privacy Rule] which compromises the security or privacy of the protected health information."
• Unsecured PHI (164.402): PHI that hasn't been rendered "unusable, unreadable, or indecipherable to unauthorized persons" using a technology or method specified in HHS guidance — in practice, encryption that meets HHS's guidance, or proper destruction. Breach notification only applies to breaches of unsecured PHI.

The three exceptions

The definition of breach excludes three situations (164.402):

1. Unintentional, good-faith access by a workforce member acting within the scope of their authority, if it isn't further used or disclosed improperly. Example: a billing clerk opens the wrong patient's account, realizes it, and closes it.
2. Inadvertent disclosure between authorized people at the same covered entity, business associate or organized health care arrangement, with no further improper use. Example: a nurse sends a chart note to the wrong physician in the same practice.
3. A good-faith belief the recipient couldn't reasonably have retained the information. Example: a statement mailed to the wrong address is returned unopened by the post office.

The key point: you're required to respond to and document every incident, not just breaches. A log of incidents that turned out to be nothing is evidence of a working security program.

What should you do in the first 24 hours?

In the first day, focus on four things: contain the damage, preserve evidence, get the right people involved, and keep patient care going. Notification decisions come later; destroying evidence or making a bad call in a panic can't be undone.

Hour 0–1: Recognize and contain

1. Don't panic, and don't go it alone. Whoever spots the problem tells the security official (usually the practice manager) immediately.
2. Disconnect, don't power off. For suspected malware or ransomware, unplug the network cable or turn off Wi-Fi on affected computers. Leave them powered on if you can — memory contents can help investigators. If your IT provider can isolate devices remotely (Microsoft Defender for Business can isolate a PC from the network with one click), let them do it.
3. Stop the spread. If ransomware is spreading, your IT provider may need to disconnect the server or shut down the internet connection entirely.
4. For a compromised email account: reset the password, revoke all active sessions, confirm MFA is enforced, and check for malicious inbox rules (attackers often create rules that forward or hide email).
5. For a lost or stolen device: report it to IT so they can lock or wipe it remotely, and check whether it was encrypted.
6. For a misdirected email or fax: contact the recipient, ask them to delete it and confirm in writing.

Hour 1–4: Get the right people involved

Call, in roughly this order:

1. Your IT provider — for containment, assessment and recovery.
2. Your cyber insurance carrier's breach hotline — many policies require prompt notice and may require you to use their approved forensic firms and attorneys. Calling a different vendor first can complicate coverage. Check your policy now, before you need it; our cyber insurance requirements checklist explains what carriers typically expect.
3. A healthcare privacy attorney (often called "breach coach") — usually provided through your insurer. Having counsel direct the investigation can help protect privileged communications.
4. The practice owner or managing physician.
5. Law enforcement, for ransomware, extortion or theft — the FBI through its Internet Crime Complaint Center (IC3) or local field office, and optionally CISA. For stolen devices, file a police report.

Hour 4–12: Preserve evidence and start documenting

1. Don't wipe and rebuild yet. It's tempting to restore from backup immediately, but wiping infected systems destroys the evidence needed to work out what the attackers accessed — which you need for the breach risk assessment.
2. Preserve logs. Have IT export Microsoft 365 audit logs, Entra sign-in logs, firewall logs, EHR access logs and endpoint protection alerts before they roll over. Microsoft 365 Audit (Standard) logs are retained for 180 days by default, and other systems may keep far less.
3. Start the incident log. Write down what happened, when it was discovered, who discovered it, who was notified and when, and every action taken. Use times. This becomes your evidence.
4. Don't communicate with attackers without guidance from counsel and your insurer.
5. Don't delete the ransom note. Photograph it.

Hour 12–24: Keep patient care going

1. Activate downtime procedures. Printed schedules, paper encounter forms, a paper sign-in sheet, phone numbers for pharmacies and labs. If you don't have these, our EHR downtime and internet failover plan shows how to build them.
2. Decide which patients to reschedule. Emergencies and urgent care come first.
3. Brief staff with a short script: what to tell patients ("we're experiencing a technical problem and are working on it") and what not to say (don't speculate about hackers or patient data).
4. Check backups. Have IT confirm your backups are intact and weren't reached by the attackers. This is where immutable backups and an off-site copy earn their keep.
5. Set a meeting rhythm — for example, an 8 a.m. and 4 p.m. check-in with IT, counsel and the owner until things are stable.

The first-24-hours checklist

• Security official notified; incident log started with discovery date and time
• Affected devices isolated (not powered off) or accounts locked
• IT provider engaged
• Cyber insurer notified; claim number recorded
• Attorney/breach coach engaged
• Law enforcement contacted if criminal activity
• Logs exported and preserved
• Ransom note or evidence photographed; nothing wiped
• Downtime procedures activated
• Backups verified safe
• Staff briefed with a patient-facing script
• Owner briefed; next check-in scheduled

Days 2–14: Investigate and scope the incident

Once things are contained, the goal is to find out exactly what happened: how the attacker got in, what systems and data were involved, whether data was taken, and which patients are affected. These facts drive the breach decision and the notification list.

Questions the investigation should answer:

1. How did it start? Phishing email, stolen password, unpatched server, exposed Remote Desktop, compromised vendor?
2. When did it start? Attackers are often inside for days or weeks before anyone notices. IBM's 2026 Cost of a Data Breach report again found healthcare breaches among the slowest to identify and contain, and healthcare remained the costliest industry, averaging $6.64 million per breach.
3. Which systems were accessed? EHR, imaging, email, file shares, backups?
4. Was data exfiltrated (copied out)? Many ransomware groups steal data before encrypting it and threaten to publish it ("double extortion"). Firewall logs, cloud logs and forensic analysis can help.
5. Which patients' data was involved, and what types — names, dates of birth, Social Security numbers, diagnoses, insurance IDs, treatment details?
6. Was the data encrypted in a way that meets HHS guidance at the time it was accessed?
7. Is the attacker fully out? Passwords reset, back doors removed, vulnerabilities patched?

Meanwhile, recovery runs in parallel: restoring systems from clean backups, rebuilding infected computers, and bringing the EHR back online in a controlled order. Our backup and disaster recovery guide covers recovery planning and our ransomware protection guide covers prevention.

How does the four-factor breach risk assessment work?

An impermissible use or disclosure of PHI is presumed to be a breach unless you demonstrate, through a documented risk assessment of at least four factors, that there's a low probability the PHI has been compromised. You don't need to do this if you decide to notify anyway; you must do it if you decide not to notify.

The four factors from 45 CFR 164.402:

1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification. A list of appointment times with first names is less sensitive than full names with Social Security numbers, diagnoses and insurance IDs. Mental health, substance use, HIV status and similar sensitive information weighs heavily.
2. The unauthorized person who used the PHI or to whom the disclosure was made. A physician's office that received a misdirected referral (and is itself bound by HIPAA) is very different from an unknown criminal group.
3. Whether the PHI was actually acquired or viewed. Forensic evidence that a stolen laptop was never powered on, or that an email was deleted unopened, supports a low probability. Evidence of exfiltration points the other way.
4. The extent to which the risk to the PHI has been mitigated. Written assurance from a trustworthy recipient that the data was deleted, remote wiping of a device, or quickly recovered paperwork all count.

Evaluate all four together and document your reasoning. Under 45 CFR 164.414, you carry the burden of proof: if you decide notification isn't required, you must be able to show that the risk assessment supported that decision (or that an exception applied).

Worked examples

These are typical outcomes, not rules — every case depends on its facts. Your attorney should review any decision not to notify.

Who do you have to notify, and when?

You must notify affected individuals in every reportable breach, HHS in every reportable breach (on a timeline that depends on size), and the media when more than 500 residents of a state or jurisdiction are affected. The clock starts on the date of discovery.

When is a breach "discovered"?

Under 45 CFR 164.404(a)(2), a breach is treated as discovered on the first day it's known to your practice — or the first day it would have been known by exercising reasonable diligence. Knowledge of any workforce member (other than the person who committed the breach) or agent counts as the practice's knowledge. You can't run out the clock by not looking.

Notification rules at a glance

Two important nuances:

• 60 days is a ceiling, not a target. HHS has said that waiting until day 60 without a good reason can itself be an "unreasonable delay." Notify as soon as you've confirmed the facts you need.
• Large breaches go public. Breaches affecting 500 or more individuals are posted on HHS's breach portal, searchable by anyone, and HHS reviews every one.

What must the notice to individuals say?

Under 164.404(c), the notice must be in plain language and include, to the extent possible:

1. A brief description of what happened, including the date of the breach and the date of discovery, if known.
2. The types of PHI involved (for example, name, date of birth, Social Security number, diagnosis, insurance information).
3. Steps individuals should take to protect themselves.
4. A brief description of what you're doing to investigate, mitigate harm and prevent a recurrence.
5. Contact procedures for questions, which must include a toll-free number, an email address, a website or a postal address.

Substitute notice and urgent situations

• If contact information is insufficient or out of date for fewer than 10 people, you can use an alternative written notice, a phone call or other means.
• For 10 or more, substitute notice means either a conspicuous posting on your website's home page for 90 days or notice in major print or broadcast media where they likely live — plus a toll-free number active for at least 90 days.
• If there's a risk of imminent misuse, you may also call affected individuals in addition to sending written notice.
• If the patient is deceased, notice goes to next of kin or personal representative if you have their address.

Law enforcement delay

If a law enforcement official says notification would impede a criminal investigation or damage national security, you must delay (45 CFR 164.412). A written statement specifying the time is honored for that period; an oral statement must be documented (including the official's identity) and delays notice no more than 30 days unless a written statement follows.

Florida and other state laws

State breach laws can apply alongside HIPAA. Florida's Information Protection Act (Fla. Stat. 501.171) covers medical information combined with a name, requires notice to individuals within 30 days of determining a breach, and requires notice to the Florida Department of Legal Affairs within 30 days for breaches affecting 500 or more Floridians. Florida treats notice given under the rules of your primary federal regulator — HIPAA for a practice — as compliant with its individual-notice requirement, but the state notice requirement for large breaches may still apply. If you have patients who live in other states, their states' laws may apply too. This is a key reason to involve counsel early.

Is ransomware a HIPAA breach?

Yes, by default. HHS's ransomware guidance says that when ransomware encrypts ePHI, the data has been "acquired" by unauthorized individuals, so a breach is presumed unless you can demonstrate a low probability of compromise. "We got our data back from backup" doesn't change that.

From the HHS Office for Civil Rights Fact Sheet: Ransomware and HIPAA:

• Encryption by ransomware is a disclosure. When ransomware encrypts ePHI, unauthorized individuals have taken possession or control of the information, which is a disclosure not permitted under the Privacy Rule.
• Breach is presumed. Unless you demonstrate a low probability that the PHI has been compromised, based on at least the four factors, it's a reportable breach.
• The investigation matters. HHS suggests the risk assessment consider, among other things, the exact type and variant of malware, the algorithmic steps it took, whether data was exfiltrated, and whether the malware propagated to other systems. Evidence that the attacker also stole data almost certainly means notification.
• Full-disk encryption may not save you. If a laptop protected with full-disk encryption (like BitLocker) is powered on and a signed-in user triggers ransomware, the files are transparently decrypted for that user's session — so the data was "unsecured" when the ransomware accessed it. Encryption protects devices that are lost or stolen while off or locked; it doesn't stop ransomware running as the logged-in user.
• The incident itself triggers your security incident procedures, and the attack may reveal failures in your risk analysis and safeguards that OCR will look at.

What can support a low-probability finding? Credible forensic evidence about what the malware did and didn't touch, strong logs showing no exfiltration, and ePHI that was separately encrypted at the file or database level in a way the ransomware couldn't access. Without that kind of evidence, plan to notify.

Should you pay?

That's a business and legal decision for the owner with counsel and your insurer. Things to know: the FBI does not encourage paying ransoms; payment doesn't guarantee working decryption keys or that stolen data will be deleted; payment doesn't change the HIPAA breach presumption; and paying certain sanctioned groups can raise separate legal problems. The best answer is to never be in a position where you must consider it — which means tested, immutable, off-site backups.

The 60-day timeline

Here's how the first 60 days typically unfold for a reportable breach. Aim to finish well inside the deadline.

Note that the Florida 30-day deadline for individual notice is shorter than HIPAA's 60 days. Even with Florida's deemed-compliance provision for HIPAA-regulated entities, plan to move fast.

HIPAA breach response plan template

Copy this outline into a document, fill in every bracket, print a copy, and keep it somewhere you can reach when your computers are down. Review it every year and after every incident.

1. Purpose and scope

"This plan describes how [Practice Name] identifies, responds to, documents and reports security incidents and breaches of protected health information, as required by 45 CFR 164.308(a)(6) and 45 CFR 164.400–414. It applies to all workforce members, systems and business associates."

2. Roles and contacts

3. How to report an incident (for all staff)

• Report anything suspicious — strange emails you clicked, pop-ups, lost devices, misdirected messages, files you can't open — immediately to [security official] by phone, not email.
• Don't turn off an infected computer; unplug its network cable.
• Don't try to fix it yourself or delete anything.
• You won't be punished for reporting a mistake promptly. Hiding one is a policy violation.

4. Severity levels

• Level 1 — Low: blocked phishing, malware quarantined automatically, lost encrypted device. Log and review.
• Level 2 — Moderate: account compromise, misdirected PHI, unencrypted device lost, single-system malware. Full response and risk assessment.
• Level 3 — Critical: ransomware, multiple systems down, confirmed data theft. Full response, insurer and counsel within hours, downtime procedures.

5. Response steps

1. Contain (see first-24-hours checklist above)
2. Notify internal and external contacts per severity
3. Preserve evidence and logs
4. Investigate and determine scope
5. Recover systems from clean backups
6. Complete and document the four-factor risk assessment
7. Decide on notification with counsel
8. Notify individuals, HHS, media and states as required
9. Post-incident review and risk analysis update

6. Notification procedures

• Individual notice template (pre-drafted, reviewed by counsel): [location]
• Who approves notices: [owner + counsel]
• Mail vendor / call center (via insurer): [ ]
• HHS breach portal submission owner: [ ]
• Under-500 breach log location and annual report reminder: [calendar date, e.g., by end of February]
• State notices (Florida and others): [counsel]

7. Downtime procedures

Printed schedule location, paper forms, how to reach labs and pharmacies, how charts get reconciled when systems return: [ ]

8. Documentation

Incident log, risk assessments, copies of notices, correspondence with HHS, and post-incident reviews are kept in [location] for at least six years (45 CFR 164.316 and 164.530(j)).

9. Testing and review

A tabletop exercise at least annually; plan reviewed annually and after every Level 2 or 3 incident. Last reviewed: [date] by [name].

Scenario: a small dental office loses a laptop

A stolen laptop is one of the most common incidents for small practices — and whether it's a reportable breach usually comes down to one setting: encryption.

What happened: an associate dentist's laptop, used to review X-rays and treatment plans at home, is stolen from a car on a Saturday. She calls the office manager Sunday morning.

If the laptop was encrypted and managed: the office manager calls the IT provider, who confirms in Intune that BitLocker was on and compliant, and sends a remote wipe command. The dentist confirms the laptop was shut down (not just asleep), her password wasn't written on it, and MFA protects her Microsoft 365 account. IT resets her password anyway and revokes sessions. A police report is filed. The office manager logs the incident with the encryption report attached. Because the PHI was encrypted consistent with HHS guidance and the key wasn't compromised, it isn't "unsecured PHI" — no notification required. Total disruption: a morning, plus a replacement laptop.

If the laptop was not encrypted: the same call sets off a very different week. IT works out what was on the device — synced OneDrive folders, cached email, downloaded X-ray exports. The practice notifies its cyber insurer and attorney. The four-factor assessment almost certainly can't show a low probability of compromise for an unencrypted device in a thief's hands. If 300 patients' records were on it, the practice mails 300 notice letters within 60 days (30 under Florida law), logs the breach for HHS's annual under-500 report, and updates its risk analysis to explain why laptops weren't encrypted. All for a setting that takes minutes to turn on.

This is why encryption is near the top of every HIPAA Security Rule checklist and why device management matters — see our dental office IT guide.

Scenario: ransomware at a 20-person medical practice

Ransomware is the incident that tests every part of the plan at once: containment, backups, downtime, investigation and notification.

Day 0, 7:40 a.m.: medical assistants can't open the EHR's local imaging viewer, and file shares show renamed files. The practice administrator calls the IT provider's emergency line. IT isolates affected computers through the endpoint protection console and disconnects the file server. The administrator calls the cyber insurer's breach hotline; the insurer assigns a breach coach and a forensic firm.

Day 0, 9:00 a.m.: the cloud EHR is unaffected (it's hosted by the vendor), so providers chart from two clean laptops kept for downtime, and the front desk uses the printed schedule. Non-urgent appointments for the afternoon are rescheduled. Staff get a script.

Days 1–5: forensics finds the entry point: a phishing email five days earlier that captured a billing employee's password on a system that didn't enforce MFA. Firewall logs show a large upload to an unfamiliar cloud storage service the night before encryption — likely exfiltration. Immutable cloud backups from the night before the attack are clean; IT restores the file server and rebuilds infected PCs.

Days 5–20: the forensic firm identifies which file shares were copied: scanned intake forms and referral letters for about 2,400 patients, with names, dates of birth, insurance IDs and some diagnoses. The four-factor assessment can't show a low probability of compromise — the PHI was sensitive, the recipient was a criminal group, data was exfiltrated, and it can't be retrieved.

Days 20–40: counsel drafts notices. The insurer arranges a mail vendor, call center and credit monitoring. Since more than 500 Florida residents are affected, the practice notifies the Florida Department of Legal Affairs and prominent media outlets serving the area, and submits the HHS breach report.

After: MFA everywhere with Conditional Access, phishing training, and a review of why the billing workstation wasn't protected are added to the risk management plan. The practice updates its risk analysis, and its ransomware protection gets a hard look. Our medical office IT guide covers the setup that prevents this chain of events.

What happens after you report a breach to HHS?

After you report, OCR may simply log the breach — or open an investigation and ask for your documentation. Breaches affecting 500 or more people are posted publicly and reviewed by OCR, and smaller breaches and patient complaints can also lead to inquiries.

If OCR opens an investigation, expect a letter (a "data request") asking for some combination of:

1. Your most recent risk analysis and the ones before it — this is consistently near the top of the list.
2. Your risk management plan and evidence of progress on it.
3. Policies and procedures in effect at the time of the incident: security incident procedures, access control, contingency plan, sanctions.
4. Your incident documentation — timeline, investigation findings, the four-factor risk assessment.
5. Copies of the notices you sent, with dates and the mailing list count.
6. Training records for the workforce members involved.
7. Business associate agreements for any vendor involved.
8. Evidence of what you fixed afterward.

Respond on time and with organized, honest documentation. Many investigations close with technical assistance — guidance on what to fix — rather than a penalty. But the enforcement record OCR publishes shows that when the root cause is a missing or inadequate risk analysis, outcomes can include a payment and a multi-year corrective action plan monitored by HHS. That's why the preparation work in our risk assessment guide matters so much: it's the document that tells OCR whether your breach was bad luck or a predictable result of ignored risks.

How should you talk to patients and staff?

Be prompt, plain and honest — and route every outside question through one person. How you communicate affects patient trust as much as the breach itself.

With patients:

• Use the notice letter as the official message, but prepare a short phone script for the front desk that matches it word for word. Patients will call.
• Explain what happened in plain language, what information was involved, what you're doing about it, and what they can do (for example, review insurance statements, watch for unfamiliar medical bills, use credit monitoring if offered).
• Don't minimize ("it was nothing") or speculate ("we think it was a foreign government").
• Train staff to say "I don't know, but I'll find out" and to pass detailed questions to the designated contact.

With staff:

• Tell them early what happened, in general terms, and what they should and shouldn't say.
• Remind them not to post about it on social media.
• If an employee's mistake caused the incident, handle it privately and consistently with your sanction policy. Public blame discourages the prompt reporting you need next time.

With the media: for breaches requiring media notice, your attorney or a communications adviser (often arranged through your cyber insurer) should prepare the statement. Designate one spokesperson — usually the owner — and stick to the facts in the notice.

Mistakes that make breaches worse

Most of the damage in a breach comes from the response, not the initial attack. These are the errors we see most often.

1. Wiping systems before investigating — destroys the evidence you need to limit notification.
2. Calling your own vendors before your insurer — can complicate coverage.
3. Waiting until day 59 — 60 days is the outer limit; "unreasonable delay" can apply sooner.
4. Deciding it's "not a breach" without a written four-factor assessment.
5. Assuming ransomware isn't a breach because backups worked. HHS presumes otherwise.
6. Forgetting the under-500 annual report to HHS.
7. Ignoring state law — Florida's 30-day timeline is shorter than HIPAA's.
8. No downtime plan, so patient care stops along with the computers.
9. Backups the attacker could reach — connected, writable, same credentials.
10. Not reporting incidents internally because staff fear blame.
11. Not documenting — if it isn't written down, you can't prove you did it.
12. No follow-through — the same gap causes the next incident.

How to prepare before anything happens

The best breach response is decided in advance: the plan, the contacts, the backups and the practice run. An hour of preparation now saves days later.

1. Fill in the template above and print it.
2. Read your cyber insurance policy — what's covered, who to call first, which vendors you must use.
3. Make sure encryption and MFA are on everywhere — they turn many would-be breaches into non-events.
4. Test a backup restore and confirm at least one copy is immutable or offline.
5. Write downtime procedures and keep printed copies.
6. Confirm business associate agreements require prompt incident notice — see our BAA guide.
7. Run a one-hour tabletop exercise once a year: "It's Monday at 8 a.m. and the server is encrypted. What do we do?"
8. Train staff to report quickly and without fear.
9. Check where you stand with our free HIPAA Security Self-Assessment and estimate what an outage would cost with the downtime cost calculator.

The bottom line

When something goes wrong, contain it, preserve the evidence, and get your IT provider, cyber insurer and attorney involved within hours. Keep patients cared for with downtime procedures. Investigate before you rebuild. Then run the four-factor risk assessment: unless it shows a low probability of compromise, it's a breach. Notify patients without unreasonable delay and within 60 days (30 under Florida law), notify HHS (immediately for 500 or more, annually for fewer), and notify the media if more than 500 residents of a state are affected. Treat ransomware as a breach unless you can prove otherwise.

Most importantly, prepare now. A written plan, encryption, MFA, tested immutable backups and a practiced team are what separate a bad week from a catastrophe.

We help medical and dental practices prepare for and respond to security incidents as part of our managed IT services, including 24/7 monitoring and alerts. If you'd like help building or testing your plan, book a free 20-minute call.