An incident plan can fail on one ambiguous verb: “report.” Staff may think it means tell the office manager, while the privacy lead hears regulatory notice and the IT vendor hears open a ticket. Those are different actions with different owners. A clinic-sized plan should separate them before an event happens.
The operating rule is to run response and breach assessment as linked tracks. Protect care and systems, preserve evidence, and document outcomes. Do not let containment become a premature legal conclusion.
This template supports planning. It does not replace legal advice, a forensic response, cyber-insurance conditions, or local reporting rules.
Two tracks start from the same report
| Response track | Breach-assessment track |
|---|---|
| protect patients and keep essential care running | identify the information and people involved |
| contain accounts, devices, or integrations | test the facts under the applicable risk assessment |
| preserve messages, logs, and system evidence | determine federal, state, contract, and insurance duties |
| document actions and system recovery | document the conclusion and required notices |
The incident lead coordinates the tracks but does not collapse them. An account can require immediate containment even when the privacy assessment is incomplete. A suspected event can close as not reportable only after the designated reviewer records why.
Put decision rights on one card
Fill this block before an incident. If a role is outsourced, name the firm, contact method, backup contact, and contract identifier.
CLINIC INCIDENT RESPONSE CARD
Incident lead: ___________________________________________
Clinical operations lead: ________________________________
Privacy lead: ____________________________________________
IT or security lead: _____________________________________
Legal or compliance contact: ______________________________
Cyber-insurance contact and policy: _______________________
EHR and critical vendor contacts: _________________________
Backup decision-maker: ____________________________________
Approved staff communication channel: _____________________
Evidence location and access owner: ________________________HHS says regulated organizations must identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes. The agency states those duties in its cloud-service-provider FAQ and tests them through the OCR audit protocol.
Sequence the first hour around patient care
| Step | Owner | Record |
|---|---|---|
| Open the incident record | incident lead | discovery time, reporter, initial facts |
| Check immediate patient risk | clinical operations | affected care, devices, medication or scheduling risks |
| Contain through approved controls | IT or security | accounts, sessions, network segments, devices, actions taken |
| Preserve evidence | IT or security | logs, messages, screenshots, system images, custody |
| Identify information and people affected | privacy lead | systems, data types, likely population, uncertainty |
| Contact required vendors and advisers | incident lead | person reached, case number, instruction received |
| Set the next briefing time | incident lead | attendees, open decisions, update channel |
Containment is not the same as erasure. Resetting an account may be sensible. Wiping a device or deleting a suspicious email before the responder captures what is needed can make the investigation harder. The plan should say which actions staff may take alone and which require the incident lead.
Use facts that survive handoffs
INCIDENT ENTRY
Entry time: ______________________________________________
Entered by: ______________________________________________
Source of information: ___________________________________
Observed fact: ____________________________________________
Action or decision: ______________________________________
Owner: ___________________________________________________
Completion time: _________________________________________
Evidence reference: ______________________________________
Uncertainty or follow-up: _________________________________Never rewrite an earlier entry to make the timeline look cleaner. Add a correction with a new timestamp. The untidy sequence is often the evidence.
The HIPAA audit-log review guide explains what to request from an EHR. The EHR downtime plan handles the operational side when containment takes a system offline. The two plans should share contacts and escalation paths, but they solve different problems.
Apply the breach rule without turning it into a timer
A security incident is not automatically a reportable breach. HHS explains that an impermissible use or disclosure of protected health information is presumed to be a breach unless the regulated entity demonstrates a low probability that the information was compromised through the required risk assessment. The Breach Notification Rule page lists the factors and notification duties.
Give the privacy or legal lead a separate worksheet:
- what protected health information was involved and how identifiable it was;
- who used or received the information;
- whether it was actually acquired or viewed;
- how far mitigation reduced the risk;
- what evidence supports each answer;
- which federal, state, contractual, and insurance notices apply.
HHS says individual notice after a breach of unsecured protected health information must occur without unreasonable delay and no later than 60 days after discovery. That ceiling is not permission to wait. Larger events can trigger additional notices, while business associates have their own notice duty to the covered entity.
Test the handoff, not the binder
Use synthetic data and a 30-minute timer. One person plays the reporter. Another plays the EHR vendor. Inject three facts: the recipient says the attachment was deleted, an audit log shows it was downloaded, and the staff member used a shared account.
The exercise passes only if the team preserves both statements, distinguishes containment from breach assessment, identifies the shared-account control failure, and assigns every follow-up. Record the gaps. Retest them.
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot. Its present security posture is described on the security page; your incident plan should still cover every vendor that touches PHI.