When attackers steal 6 terabytes of patient records, your legal team will spend weeks figuring out what was taken. Your patients need to hear from you now.
AnMed's July cyberattack illustrates the gap between what you know immediately (systems are down, data was accessed) and what you can confirm later (whose records, which fields, how much exposure). The nonprofit health system is conducting a "resource-intensive" analysis to determine exactly what The Gentlemen ransomware gang exfiltrated. Meanwhile, CEO William Kenley had to address patients without a complete picture, warning them about scams while the forensic review continues.
You need a notification framework that works in this gap. This template gives you language for the initial acknowledgment, the interim updates, and the final determination notice. It balances your HIPAA Breach Notification Rule obligations with the operational reality that confirming affected individuals takes time.
What This Template Is For
This is a three-stage notification framework for covered entities and business associates responding to a confirmed data theft where the scope is still under investigation. It addresses:
- Initial public acknowledgment (within 72 hours of discovery)
- Interim status updates (weekly or bi-weekly while investigation proceeds)
- Final breach notification (once you've completed the individual-level determination)
The template assumes you've already activated your Computer Security Incident Response Team, engaged forensic investigators, and reported to HHS and law enforcement as required.
Prerequisites
Before you use this template, confirm:
- Incident containment is complete. Don't notify until you've stopped the bleeding. If attackers still have access, your notification becomes their roadmap.
- You have legal and forensic counsel engaged. This template provides structure, not legal advice. Your attorneys should review every word before publication.
- You've identified your regulatory notification triggers. HIPAA requires notification within 60 days of discovery for breaches affecting 500+ individuals. State laws may impose shorter windows.
- You have a dedicated response webpage. Don't bury updates in press releases. Create a persistent URL (yourdomain.com/incident-response) where patients can find current information.
The Template
Stage 1: Initial Public Acknowledgment
Subject: [Organization Name] Security Incident Notification
On [DATE], [Organization Name] detected unauthorized access to our IT systems. We immediately activated our incident response protocols, engaged cybersecurity experts, and notified law enforcement.
Our investigation has confirmed that an unauthorized party accessed systems containing patient information. We are conducting a comprehensive forensic review to determine what specific information was involved and whose records may be affected.
What we know:
- The incident was detected on [DATE]
- We have contained the unauthorized access
- Patient information was present in the affected systems
- We are working with [forensic firm name if disclosing] to analyze the scope
What we are doing:
- Conducting a detailed forensic investigation
- Restoring systems with enhanced security controls
- Preparing to notify affected individuals once our review is complete
- Coordinating with federal and state regulators
What you should do:
- Monitor your accounts for unusual activity
- Do not respond to unexpected communications claiming to be from [Organization Name] or referencing this incident
- Report suspicious contacts to [dedicated email/phone]
- Watch [response webpage URL] for updates
We will provide additional information as our investigation progresses. We expect to complete the initial phase of our review by [realistic timeframe].
If you have questions, contact [dedicated response line] between [hours].
[CEO/CISO Name]
[Title]
Stage 2: Interim Status Update
Subject: [Organization Name] Incident Investigation Update
We are providing an update on the security incident we disclosed on [DATE].
Investigation progress: Our forensic review is ongoing. We are analyzing [general system description, e.g., "several years of electronic health records"] to determine which specific data fields were accessed and which patients' information may be involved. This process requires examining [scale indicator if you can provide one, e.g., "millions of records"] to ensure accuracy.
Timeline: We expect to complete this review and begin individual notifications by [updated timeframe]. We will not rely on claims made by the unauthorized party about what they accessed. We are conducting an independent, file-by-file analysis.
Services restored: [List what's back online, e.g., "Patient portal access, appointment scheduling, and electronic health record access have been restored with additional security monitoring in place."]
Scam warning: The individuals responsible for this incident may attempt to contact patients directly, publish information online, or make public claims. If you receive unexpected communication:
- Do not click links or open attachments
- Do not provide personal information or payment
- Do not respond to threats or demands
- Report direct threats to local law enforcement
- Forward suspicious emails to [dedicated address]
We will never ask you to verify personal information via email or text message related to this incident.
Updated information is available at [response webpage URL].
[CEO/CISO Name]
[Title]
Stage 3: Final Breach Determination Notice
Subject: Important Information About Your [Organization Name] Records
Our investigation into the [DATE] security incident has determined that your information was involved. This letter explains what happened, what information was affected, and what we are doing in response.
What happened: On [DATE], we detected that an unauthorized party accessed our systems between [DATE RANGE if known]. We immediately contained the incident and began a comprehensive forensic investigation.
What information was involved: Our review determined that the following categories of your information were accessed: [Itemized list: name, date of birth, Social Security number, medical record number, diagnosis codes, treatment information, insurance details, etc.]
What information was NOT involved: [If you can definitively exclude categories, list them: financial account numbers, credit card information, etc.]
What we are doing:
- We have implemented [specific controls: enhanced access monitoring, mandatory multi-factor authentication, network segmentation, etc.]
- We are offering [credit monitoring/identity theft protection] services at no cost for [duration]
- We have reported this incident to the Department of Health and Human Services and [state regulators]
What you should do:
- Enroll in the complimentary services at [enrollment URL] by [deadline]
- Review your Explanation of Benefits statements for services you did not receive
- Place a fraud alert or credit freeze if you are concerned about identity theft
- Report suspected medical identity theft to [Organization Name] at [dedicated line]
Resources:
- Credit monitoring enrollment: [URL]
- Frequently asked questions: [URL]
- Federal Trade Commission identity theft guidance
- Dedicated response line: [phone] ([hours])
We deeply regret this incident and the concern it may cause. Protecting your information is a responsibility we take seriously.
[CEO/CISO Name]
[Title]
How to Customize It
Adjust the tone for your patient population. Academic medical centers can use more technical language. Community hospitals should simplify further.
Match your legal obligations to your timeline promises. Don't commit to a 30-day investigation timeline if your forensic team says 60 days is realistic. Under-promise and over-deliver.
Tailor the scam warning to observed threat actor behavior. AnMed warned patients specifically because The Gentlemen had already hijacked the organization's Facebook account. If your attacker is conducting extortion attempts, be explicit about what those look like.
Specify what you're offering based on the data types involved. Social Security numbers warrant credit monitoring. Medical records alone may not. Don't over-offer services that don't match the risk.
Translate the technical scope into patient-relevant categories. "6 terabytes" means nothing to patients. "Records from patients seen between 2020 and 2024" does.
Validation Steps
Before you publish any stage of this notification:
Run it through your breach notification checklist. Confirm you're meeting HIPAA Breach Notification Rule requirements for content: description of the breach, types of information involved, steps individuals should take, what you're doing, and contact information.
Verify you're not making claims you can't support. If you say "no financial information was accessed," your forensic report must explicitly confirm that. Hedge if you're uncertain.
Test the response infrastructure. Call the dedicated hotline. Try to enroll in the credit monitoring. Click the FAQ link. If patients can't actually use the resources you're offering, you're creating more frustration.
Check for consistency across channels. Your website, call center script, and written notice should tell the same story. Contradictions erode trust faster than delayed disclosure.
Confirm regulatory filings are complete before going public. HHS, state attorneys general, and potentially the FBI should hear from you before your patients do.
The hardest part of breach notification isn't writing the letter. It's deciding how much uncertainty to acknowledge. AnMed's approach demonstrates the value of transparency about what you don't yet know, paired with clear guidance on what patients should do while you figure it out.
