Guide · Healthcare · Breach Response

HIPAA Breach Response: The First 24 Hours

A 60-day notification deadline is an outer limit, not an investigation plan. The first day should preserve evidence, stop ongoing exposure, identify the legal decision-makers, and create a record for the breach-risk assessment and any required notices.

By Lincoln Square Law · 10-minute read

Most healthcare organizations know the headline number: a breach of unsecured protected health information generally has to be reported within sixty days. That number lulls people into believing they have time, and the belief is where breach responses go wrong. Sixty days is the outer limit for notification, not a countdown you can spend deliberating. The work that determines your exposure, stopping the bleeding, preserving the evidence, and figuring out what actually happened, has to begin the moment you discover the incident. This is a guide to that first day, the hours the notification rules assume you are already using well.

The clock starts at discovery, not at certainty

Under the HIPAA Breach Notification Rule, your obligations run from the date the breach is “discovered,” and discovery is not the moment you are sure. It is the moment your organization knew, or reasonably should have known, that an incident occurred. That distinction matters because teams often delay the clock in their own minds until they have confirmed every detail, and by then the outer deadline is closer than they think. Treat the first credible sign of a problem as the start of the timeline, and build your first-day response around the assumption that the clock is already running.

Hour one: contain, do not clean up

The instinct when something looks wrong, a laptop missing, an email sent to the wrong list, ransomware on a workstation, a portal exposing records, is to fix it and move on. Resist the urge to erase your way out. Containment and evidence preservation are the same task done carefully: isolate the affected system or account to stop ongoing exposure, but do not wipe, re-image, or “tidy” anything, because you are about to need to reconstruct exactly what happened and what data was involved. Disable the compromised credential, pull the device off the network, revoke the errant access, and leave the logs, the device, and the trail intact. A responder who destroys the evidence while trying to help turns an answerable incident into an unprovable one.

Hour two: convene the right people

Breach response is a team sport, and the team should be named before you ever need it. In the first hours, bring together whoever owns security or IT, your privacy officer or compliance lead, senior leadership, and counsel. The reason to involve a lawyer early is not formality. It is that much of your investigation can be structured to protect candor, and decisions made in the first day, about preservation, about what to say internally, about whether to involve law enforcement, carry legal consequences that are easier to get right than to unwind. If a vendor or business associate is involved, get them on the phone immediately, because their obligations to you run on the same clock and their information is part of your record.

Hours three to twelve: establish scope

Notification is driven by facts you do not yet have, so the heart of the first day is finding them. What protected health information was involved, whose information was it, how many people, and was the data truly unsecured, or was it encrypted to a standard that may take it outside the breach definition entirely? These questions decide everything downstream: whether notification is required at all, whether the incident reaches 500 or more individuals for contemporaneous HHS reporting and whether it affects more than 500 residents of a State or jurisdiction for the separate media-notice rule, and how large the disclosure will be. Document what you learn as you learn it, with times attached, because the timeline you build now is the record you will rely on later.

The risk assessment that decides whether you notify

Not every impermissible use or disclosure of protected health information is a reportable breach. The rules presume a breach unless you can demonstrate, through a documented risk assessment, that there is a low probability the information was compromised, weighing factors like the nature and extent of the data involved, who received or accessed it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. This assessment is where careful early work pays off: an organization that preserved its evidence and understood its scope can make and defend a low-probability determination, and one that cleaned up first is left guessing. Do this analysis deliberately and write it down, whether it concludes notification is required or not.

What the first day is not: the notification letter

It is tempting to start drafting patient notices in the first hours, both to feel productive and to get ahead of the deadline. That is premature. The content of the notice, what happened, what information was involved, what individuals should do, and what you are doing in response, depends entirely on the facts you are still establishing. A notice sent before the scope is understood either says too little to be useful or commits you to a version of events you may have to correct, which is its own compliance and reputational problem. The first day builds the foundation, and the letters come once you can stand behind every sentence.

Where the deadlines actually land

Once scope is clear, the notification obligations follow a known shape. Affected individuals must be notified without unreasonable delay and no later than sixty calendar days from discovery. If the breach involves five hundred or more individuals, notice to the Secretary of Health and Human Services goes contemporaneously with the individual notices, not saved for later. The separate media rule applies when more than five hundred residents of a State or jurisdiction are affected, in which case prominent media serving that area must be notified on the same timeline. Smaller breaches are logged and reported to HHS annually, within sixty days after the end of the calendar year. And remember that “without unreasonable delay” is the governing standard: sixty days is the ceiling, and a regulator reviewing your response will ask why you took the time you did, not congratulate you for using all of it.

Why the first 24 hours are worth a plan

Every organization that handles protected health information will, eventually, face an incident. The ones that come through it well are not the ones that never have a breach. They are the ones that decided, in advance, who does what in the first day. A short, practiced response plan, who to call, what to preserve, who leads the risk assessment, when counsel steps in, converts panic into procedure. We help healthcare and dental practices build that plan before it is needed and stand with them in the first hours when it is, because the difference between a contained incident and a compounding one is almost always made on the first day, long before the notification clock runs out.

Documentation is the deliverable

The most valuable thing your team produces in the first day is not a fix. It is a record. A regulator’s first request after a breach is almost always the same: show us what happened, when you discovered it, what you did, and how you decided what to do. An organization that kept a contemporaneous log, with timestamps for discovery, containment steps, people notified, and each decision and its basis, can answer that request with confidence. One that responded ably but wrote nothing down is left reconstructing its own actions from memory, and the gaps read as either disorganization or worse. Assign someone to keep the timeline as the incident unfolds, treat the risk assessment as a document rather than a discussion, and preserve the underlying evidence that supports both. The quality of your paper trail often matters as much to the outcome as the quality of your response.

After the first day: root cause and repair

Containment stops the immediate harm. It does not fix what allowed the harm. Once the incident is stable and scope is understood, the work turns to root cause, why the credential was exposed, why the record was accessible, why the email went where it should not have, and to the corrective action that keeps it from recurring. This matters legally as well as operationally, because the risk assessment weighs mitigation, and demonstrated remediation is part of how a regulator evaluates your response. Fold what you learned back into your safeguards: tighten the access that was too broad, add the control that was missing, retrain the workforce on the practice that failed. A breach handled well becomes the reason the next one does not happen, and that improvement is itself evidence of a program taking its obligations seriously.

The avoidable mistakes that make a breach worse

A handful of first-day errors turn manageable incidents into serious ones, and all of them are preventable. Destroying or altering evidence while trying to fix the problem is the most common and the most damaging, because it forecloses the analysis everything else depends on. Delaying the internal escalation, hoping an issue resolves itself before anyone senior has to know, burns the runway you need. Communicating carelessly, in emails or messages that speculate about fault before the facts are in, creates a record you will regret. And notifying too early or too vaguely, out of a desire to look responsive, commits you to a story you may have to walk back. Knowing these traps in advance is half of avoiding them. The other half is a plan that routes the first day through people who have seen an incident before.