← All guides

Playbook

A patient says their data leaked

4 min read

A patient calls or writes to say their information was exposed. How you respond in the first conversation matters, and HIPAA sets deadlines once a breach is discovered.

In the conversation

1. Listen and write it down: what they saw, where, and when. Ask for any copy or screenshot.
2. Do not confirm or deny a breach on the spot. Thank them, say you take it seriously, and promise a follow-up by a specific date.
3. Do not email details around the office. Keep notes in one place.

Right after

1. Tell your privacy officer. Every practice must name one under HIPAA.
2. Look for the source: a misdirected email, fax, or letter; the patient portal; a staff account; or a vendor. Check whether your EHR, billing company, or another vendor has announced a breach.
3. Call your cyber insurer and your attorney. Many policies cover legal and notification costs, but only if you report early.
4. Complete a written risk assessment. Under HIPAA, an incident is presumed to be a breach unless a documented assessment shows a low probability the information was compromised.

The HIPAA deadlines

• Patients: notified without unreasonable delay, and no later than 60 days after the breach is discovered.
• 500 or more people: HHS and prominent local media are also notified within 60 days.
• Fewer than 500: log it, and report it to HHS within 60 days after the end of the calendar year.

New York and other states have their own notification rules, which can be stricter. Your attorney will confirm what applies.

Afterwards

• Follow up with the patient in writing, as promised.
• Fix the cause, and record what you changed.
• Keep every document for at least six years.

This guide is general information, not legal advice.

How we keep our own data footprint small →