When your organization detects unauthorized email access, the next three days determine whether you contain the incident or face a compliance crisis. This checklist provides a structured response framework aligned with HIPAA Breach Notification Rule requirements and NIST SP 800-61 incident handling guidance.
Purpose of This Template
This checklist structures your initial response to email account compromises. It's designed for healthcare organizations under the Health Insurance Portability and Accountability Act, but it applies to any regulated entity handling sensitive data through email systems.
Use this when:
- Phishing attacks compromise employee credentials
- Anomalous login patterns suggest account takeover
- Users report suspicious email activity from internal accounts
- Automated monitoring flags unauthorized access to mailboxes
The template helps you meet three critical obligations: technical containment, forensic preservation, and regulatory notification preparation.
Prerequisites
Before executing this checklist, ensure you have:
Technical access: Administrative credentials for your email platform (Microsoft 365, Google Workspace, or on-premises Exchange), logging systems, and authentication infrastructure.
Team availability: Contact information for your Computer Security Incident Response Team, legal counsel, privacy officer, and third-party forensics firm (if you don't maintain in-house capabilities).
Documentation baseline: Current email retention policy, data classification inventory showing what types of protected health information typically flow through email, and your breach notification procedure.
Authority: Pre-approved incident response authority so you can disable accounts, preserve evidence, and engage external experts without waiting for executive sign-off during an active compromise.
The Template
Copy this into your incident management system. Customize the bracketed items before an incident occurs.
INCIDENT ID: [Auto-generated or manual tracking number]
DETECTION TIME: [Timestamp]
INCIDENT LEAD: [Name and contact]
Hour 0-4: Immediate Containment
- Disable compromised account(s); do NOT delete
- Reset password and revoke all active sessions
- Document current mailbox rules, forwarding settings, delegates
- Preserve authentication logs covering [retention period, typically 90 days]
- Capture mailbox access logs showing login IP addresses and timestamps
- Notify [Privacy Officer name] and [Legal Counsel name]
- Engage [Forensics Firm name] if breach scope unclear
Hour 4-24: Scope Determination
Review compromised account(s) for PHI content types:
- Names and dates of birth
- Social Security numbers
- Medical record numbers
- Diagnosis/treatment information
- Insurance details
- Other identifiers: [customize based on your data types]
Determine unauthorized access window using:
- First anomalous login timestamp
- Last known legitimate user activity
- Email send/receive patterns during compromise
Check for data exfiltration indicators:
- Unusual attachment downloads
- Bulk email exports
- Forwarding rules to external domains
- Messages sent to external addresses
Count affected individuals (conservative estimate if exact count unknown)
Hour 24-48: Regulatory Assessment
Apply HIPAA breach risk assessment (45 CFR § 164.402):
- Nature and extent of PHI involved
- Unauthorized person who accessed PHI (known threat actor vs. opportunistic)
- Was PHI actually acquired or viewed?
- Extent to which risk has been mitigated
Determine breach notification requirements:
- If 500+ individuals: HHS OCR notification within 60 days, media notification
- If fewer than 500: annual notification to HHS, individual notification within 60 days
- State-specific requirements: [list applicable state breach laws]
Document low probability of compromise justification if claiming exception
Hour 48-72: Remediation and Communication
Implement technical controls:
- Multi-factor authentication on all accounts (if not already deployed)
- Conditional access policies blocking [specify regions/risk conditions]
- Enhanced monitoring on accounts with similar access patterns
- Update email retention policy to [specify retention period]
Conduct targeted security awareness training:
- Phishing recognition for affected department
- Credential hygiene review
- Reporting procedures for suspicious activity
Prepare breach notification letters (if threshold met):
- Individual notification describing incident, data types, remediation
- Credit monitoring offer (if SSNs involved): [specify provider and duration]
- HHS OCR breach portal submission
- Media notification (if 500+ in same state/jurisdiction)
Update incident response plan based on lessons learned
Customization Guidance
Retention period: Replace the bracketed retention periods with your actual email retention policy. If you currently retain email indefinitely, this incident should prompt you to establish a defensible retention schedule. Aitkin County Health and Human Services updated their email retention policy following their breach affecting over 83,000 individuals.
PHI content types: Your data classification inventory should tell you what protected health information typically appears in email. Customize the checklist items to reflect your specific workflows. If your organization doesn't send Social Security numbers via email, remove that item. If you routinely email lab results, add that category.
Forensics engagement threshold: Define when you'll engage external digital forensics experts. If your IT team can definitively determine access scope within four hours, you may not need external support. If you're uncertain whether data was exfiltrated, bring in specialists immediately.
Notification thresholds: Add any state-specific breach notification requirements that apply to your organization. Some states have shorter notification windows or lower individual count thresholds than HIPAA.
Credit monitoring criteria: Establish clear criteria for when you'll offer credit monitoring. If the breach involves Social Security numbers or financial information, offering monitoring is standard practice. The Decatur Diagnostic Laboratory breach notice mentioned affected individuals should remain vigilant for 24 months.
Validation Steps
Before you file this template and forget about it, validate it works:
Tabletop exercise: Walk your incident response team through a scenario where three email accounts are compromised overnight. Can each person execute their assigned checklist items? Do you actually have the technical access and authority documented in prerequisites?
Log availability check: Verify you can actually retrieve the authentication logs and mailbox access logs the template requires. If your email platform only retains logs for 30 days, you need to either extend retention or acknowledge that gap in your incident response capability.
Contact verification: Confirm the names and contact information in your customized template are current. Incident response fails when you're searching for phone numbers at 2 AM.
Legal review: Have your legal counsel review your breach risk assessment criteria and notification letter templates before an incident occurs. You don't want to debate legal strategy while the 72-hour notification clock is running.
Regulatory alignment: Map each checklist item to the specific regulatory requirement it satisfies. This creates an audit trail showing you followed a documented, compliant process rather than improvising under pressure.
The difference between a contained email breach and a compliance crisis isn't the attack itself. It's whether you have a tested, specific response plan ready to execute. Customize this template now, before you're making decisions with incomplete information and a notification deadline approaching.
