HIPAA Incident Response Plan Template

Plan Outline

1. Purpose & scope: systems with ePHI; CE/BA role
2. Roles: Security Officer, Privacy Officer, IR lead, communications, legal
3. Detection & triage: severity, PHI involvement, ransomware vs misdirected disclosure
4. Containment & eradication: isolate, preserve logs, rotate credentials
5. Risk assessment: four-factor breach assessment for unsecured PHI
6. Notification decision tree: map to 164.404 / 406 / 408 / 410 clocks
7. Recovery & lessons learned: update risk analysis and controls
8. Record retention: keep IR/breach files with Security Rule documentation practices

Notification Clock Checklist

• [ ] Individuals: ≤60 calendar days after discovery (164.404)
• [ ] HHS 500+: ≤60 calendar days after discovery (164.408)
• [ ] HHS <500: ≤60 days after end of calendar year of discovery
• [ ] Media (500+ in a State/jurisdiction): ≤60 days (164.406)
• [ ] BA → CE: ≤60 days after discovery (164.410)

No Word/Excel download is attached. Request facilitation via contact.

How CyberSilo Helps

• ThreatHawk shortens time-to-discovery with correlated alerts
• CSA stores timelines, decisions, and notification packages

Frequently Asked Questions

What is the individual notification deadline?

Without unreasonable delay and in no case later than 60 calendar days after discovery (45 CFR 164.404).

When must HHS be notified for 500+ breaches?

Without unreasonable delay and no later than 60 calendar days after discovery (164.408).

What must business associates do?

Notify the covered entity without unreasonable delay and no later than 60 days after discovery (164.410).

Related HIPAA Resources

HIPAA hub · Breach rule · Audit logs · CSA