# HIPAA Breach Notification Checklist — Template

## Incident Information

| Field | Value |
|-------|-------|
| Incident ID | [INC-YYYY-####] |
| Discovery Date | [YYYY-MM-DD] |
| 60-Day Notification Deadline | [YYYY-MM-DD] |
| Privacy Officer | [Name] |
| Incident Commander | [Name] |
| Legal Counsel | [Name] |

---

## Four-Factor Risk Assessment (§164.402(2))

### Factor 1: Nature and Extent of PHI Involved
- Types of identifiers: [ ] Names [ ] DOB [ ] SSN [ ] Address [ ] Phone [ ] Email
- Clinical data: [ ] Diagnoses [ ] Medications [ ] Lab results [ ] Mental health [ ] Substance abuse [ ] HIV
- Financial data: [ ] Insurance ID [ ] Account numbers [ ] Credit card
- Number of data elements per individual: ____
- **Risk Level**: [ ] Low [ ] Medium [ ] High

### Factor 2: Unauthorized Person Who Used/Received PHI
- Description: _______________________________________________
- [ ] External attacker [ ] Unauthorized employee [ ] Unintended recipient [ ] Unknown
- HIPAA-covered entity? [ ] Yes [ ] No
- Malicious intent? [ ] Yes [ ] No [ ] Unknown
- **Risk Level**: [ ] Low [ ] Medium [ ] High

### Factor 3: Whether PHI Was Actually Acquired or Viewed
- Was PHI actually viewed/accessed? [ ] Yes [ ] No [ ] Unknown
- Forensic evidence available? [ ] Yes [ ] No
- Was PHI encrypted (NIST-compliant)? [ ] Yes [ ] No
- If encrypted, was encryption key compromised? [ ] Yes [ ] No
- **Risk Level**: [ ] Low [ ] Medium [ ] High

### Factor 4: Extent to Which Risk Has Been Mitigated
- Assurances obtained from recipient? [ ] Yes [ ] No [ ] N/A
- PHI recovered? [ ] Yes [ ] No
- Recipient agreed to destroy? [ ] Yes [ ] No [ ] N/A
- **Risk Level**: [ ] Low [ ] Medium [ ] High

### Determination
- [ ] **Not a breach** — Low probability of compromise demonstrated across all factors
- [ ] **Secured PHI** — Encryption safe harbor applies (no notification required)
- [ ] **Breach confirmed** — Notification required

---

## Notification Requirements

| Notification | Required? | Count | Deadline | Status |
|-------------|-----------|-------|----------|--------|
| Individual notice | [ ] Yes [ ] No | ____ individuals | [YYYY-MM-DD] | |
| HHS (immediate, 500+) | [ ] Yes [ ] No | | [YYYY-MM-DD] | |
| HHS (annual log, <500) | [ ] Yes [ ] No | | Year-end | |
| State AG | [ ] Yes [ ] No | ____ states | [YYYY-MM-DD] | |
| Media | [ ] Yes [ ] No | ____ states | [YYYY-MM-DD] | |

## Individual Notification Letter Checklist (§164.404(c))

- [ ] Brief description of what happened (dates of breach and discovery)
- [ ] Types of unsecured PHI involved (not actual PHI)
- [ ] Steps individuals should take to protect themselves
- [ ] Brief description of entity's investigation and mitigation efforts
- [ ] Contact procedures (toll-free number, email, postal address, website)

## Post-Notification Actions

- [ ] Call center operational and staffed
- [ ] Credit monitoring enrollment available (if applicable)
- [ ] Website notice posted (if substitute notice required)
- [ ] Returned mail processed and alternate contact attempted
- [ ] All notification activities documented
- [ ] Risk analysis updated with incident findings
- [ ] Remediation measures implemented

---

## Approval

| Role | Name | Date |
|------|------|------|
| Privacy Officer | | |
| Legal Counsel | | |
| CISO | | |
| Executive Sponsor | | |