HIPAA - Breach Notification

USA Health Insurance Portability and Accountability Act of 1996 (HIPAA) covers organizations that use, store, or process Private Health Information (PHI). The HIPAA Breach Notification Rule requires companies that deal with health information to disclose cybersecurity breaches; the disclosure will include notification to individuals, to the media, and the Secretary of Health and Human Services. This playbook is triggered by a HIPAA breach notification incident and follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. ** Source: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

HIPAA - Breach Notification · 54 tasks · 9 inputs · 0 outputs

Inputs

  • ContactName — In case of a breach, the contact details to send to the Secretary of HHS and the affected individuals.
  • ContactEmailAddress — In case of a breach, the contact details to send to the Secretary of HHS and the affected individuals.
  • ContactTelNumber — In case of a breach, the contact details to send to the Secretary of HHS and the affected individuals.
  • CompanyName — In case of a breach, the company details to display in the breach report.
  • CompanyAddress — In case of a breach, the company details to display in the breach report.
  • CompanyCity — In case of a breach, the company details to display in the breach report.
  • CompanyCountry — In case of a breach, the company details to display in the breach report.
  • AutoNotification — This input determines if the resident notification should be done automatically or manually. True - Automatically False - Manually.
  • ResidentNotification_WhatCanTheyDo — An explanation to the individual's notification email of what can they do.

Commands used

closeInvestigation extractIndicators send-mail setIncident

Flowchart

yes No Yes No Yes yes No Yes No Yes Update grid manually Upload a file yes yes More than 500 Start Start Is breached data encrypted? Is breached data encrypted? Has encryption been compromised? Has encryption been compr... Analyst review Analyst review Is the PHI secure? Is the PHI secure? Close Investigation - closeInvestigation Close Investigation closeInvestigation Notify DPO of suspected PHI data breach Notify DPO of suspected P... Update incident with DPO answersx - setIncident Update incident with DPO ... setIncident DPO confirmed the breach? DPO confirmed the breach? No breach has occurred No breach has occurred PHI breach notification required PHI breach notification r... Notify management with the severity of data breach Notify management with th... Breach documentation process Breach documentation process Generate breach report - GenerateInvestigationSummaryReport Generate breach report GenerateInvestigationSummaryR... Send report for DPO approval - send-mail Send report for DPO approval send-mail Get DPO Approval for the report Get DPO Approval for the ... DPO updates report DPO updates report Get new report from DPO Get new report from DPO PHI Breach Notification Process PHI Breach Notification P... Implement substitute resident notification Implement substitute resi... Individual Notice Individual Notice Is the contact information out-of-date? Is the contact informatio... Send breach notification to affected individual - send-mail Send breach notification ... send-mail Assemble a list of all of the affected individuals Assemble a list of all of... Choose way of update Choose way of update Update the affected individual’s information grid manually Update the affected indiv... Upload a file with the individual's emails Upload a file with the in... Wait for the file to upload - Sleep Wait for the file to upload Sleep Does the file exist? Does the file exist? Extract email addresses - extractIndicators Extract email addresses extractIndicators Add individuals' emails to grid - SetGridField Add individuals' emails t... SetGridField Email Notification to Individuals Email Notification to Ind... Should the notification be sent automatically? Should the notification b... Send notification manually Send notification manually Substitute Notification Substitute Notification Done Done Notice to the Secretary of HHS Notice to the Secretary o... Media Notice Media Notice Prominent media notice Prominent media notice Checks number of affected individuals Checks number of affected... Upload and submit to the Secretary of HHS Upload and submit to the ... Finished the Notification Process Finished the Notification... Updates Secretary notification status to done - setIncident Updates Secretary notific... setIncident Updates individuals notification status to done - setIncident Updates individuals notif... setIncident Updates media notification status to done - setIncident Updates media notificatio... setIncident Close investigation - closeInvestigation Close investigation closeInvestigation Updates Secretary notification status to in progress - setIncident Updates Secretary notific... setIncident Updates media notification status to in progress - setIncident Updates media notificatio... setIncident Updates individuals notification status to in progress - setIncident Updates individuals notif... setIncident Updates DPO notification status to in progress - setIncident Updates DPO notification ... setIncident Updates DPO notification status to done - setIncident Updates DPO notification ... setIncident PHI Breach Confirm PHI Breach Confirm Set breached confirmation flag - setIncident Set breached confirmation... setIncident Set breached not confirmation flag - setIncident Set breached not confirma... setIncident