# HIPAA Breach Notification Workflow

## Phase 1: Breach Discovery and Four-Factor Assessment (Days 1-10)

1. **Incident identification**: Security team, workforce member, or business associate reports a potential breach of PHI.
2. **Initial triage**: Privacy Officer determines whether the incident involves PHI and whether it falls under one of the three breach exceptions (45 CFR §164.402(1)).
3. **Four-factor risk assessment**: Apply the four-factor test to determine the probability that PHI has been compromised:
   - Factor 1: Nature and extent of PHI involved
   - Factor 2: Unauthorized person who used or received the PHI
   - Factor 3: Whether PHI was actually acquired or viewed
   - Factor 4: Extent to which risk has been mitigated
4. **Assessment documentation**: Document the four-factor assessment with findings and conclusion. The covered entity bears the burden of proof that an impermissible use or disclosure did not constitute a breach (§164.414(b)).
5. **Breach determination**: If low probability of compromise — document as non-reportable incident. If breach is confirmed or cannot be ruled out — proceed to notification.

## Phase 2: Scope Determination (Days 5-20)

1. **Identify all affected individuals**: Determine the exact identities and last known addresses of all individuals whose PHI was involved.
2. **Geographic analysis**: Determine which states/jurisdictions are affected and how many individuals per state (for media notification threshold).
3. **PHI categorization**: Document the specific types of PHI involved for each individual (names, SSN, diagnoses, treatment records, insurance information).
4. **Business associate coordination**: If the breach occurred at a business associate, obtain the individual identification list and breach details from the BA.

## Phase 3: Notification Preparation (Days 15-40)

### Individual Notification
1. Draft notification letter containing all required elements (§164.404(c)):
   - Description of what happened, including dates
   - Types of PHI involved
   - Steps individual should take (fraud alerts, credit monitoring, monitoring explanation of benefits)
   - What the entity is doing (investigation, mitigation, prevention)
   - Contact information (toll-free number, email, postal address)
2. Review with legal counsel for accuracy and completeness.
3. Prepare notifications in languages spoken by affected populations.
4. For individuals with insufficient contact information (10+), prepare substitute notice (website posting + media notice or toll-free number).

### HHS/OCR Notification
1. If 500+ individuals affected: Prepare HHS breach portal submission (ocrportal.hhs.gov).
2. If fewer than 500: Add to annual breach log for submission by March 1.
3. Gather all required portal fields: entity information, breach details, dates, number affected, type of breach, location of PHI, safeguards, actions taken.

### State AG Notification
1. Identify each state where affected individuals reside.
2. Prepare state-specific AG notification letters.
3. Determine state-specific requirements that exceed HIPAA minimums.

### Media Notification
1. If 500+ individuals affected in a single state: Prepare media release.
2. Identify prominent media outlets serving the affected state/jurisdiction.
3. Coordinate timing with individual notification dispatch.

## Phase 4: Notification Execution (Days 40-60)

1. **Dispatch individual notifications**: Send first-class mail (or agreed electronic format) to all affected individuals. Target: no later than day 55 to allow buffer before the 60-day deadline.
2. **Submit HHS notification**: For 500+ breaches, submit via ocrportal.hhs.gov before or concurrent with individual notification.
3. **Submit state AG notifications**: Send before or concurrent with individual notification.
4. **Issue media notice**: For 500+ in a single state, distribute to prominent media outlets.
5. **Activate substitute notice**: Post website notice (for 90 days minimum) and activate toll-free number.
6. **Document all submissions**: Retain copies of all notifications, delivery confirmations, and submission receipts.

## Phase 5: Post-Notification (Day 60+)

1. **Monitor toll-free line**: Staff the breach response line for 90 days minimum. Track call volume and inquiry types.
2. **Respond to OCR inquiries**: If OCR initiates an investigation, designate a single point of contact and coordinate response with legal counsel.
3. **Remediation**: Implement corrective actions identified during the investigation.
4. **Annual log submission**: For under-500 breaches, ensure inclusion in the annual breach log submitted to HHS by March 1.
5. **Documentation retention**: Retain all breach-related documentation for 6 years per HIPAA administrative requirements (§164.530(j)).

## Timeline Summary

| Activity | Deadline | Regulatory Basis |
|----------|----------|-----------------|
| BA notifies CE of breach | 60 days from BA discovery (or per BAA) | §164.410 |
| Four-factor risk assessment | Promptly after incident identification | §164.402(2) |
| Individual notification | 60 days from CE discovery | §164.404(b) |
| HHS notification (500+) | 60 days from CE discovery | §164.408(b) |
| HHS annual log (under 500) | March 1 following calendar year | §164.408(c) |
| State AG notification | Before or concurrent with individual notice | §164.412 |
| Media notification (500+ in state) | 60 days from CE discovery | §164.406 |
| Substitute notice duration | 90 days minimum | §164.404(d)(2) |