When a breach hits, your incident response team doesn't need another policy document. They need answers to the specific questions that come up in the war room, the regulatory filing process, and the board briefing. These questions come from real post-breach debriefs and compliance reviews at healthcare organizations that recently filed HIPAA breach reports.
Real-World Breach Scenarios
Between April and May 2026, three healthcare organizations filed breach notifications with HHS: Ohio Living identified unauthorized network access affecting files containing patient information between April 16 and April 17, 2026; Erlanger Health System disclosed that patient data was inadvertently sent to a billing partner between July 1, 2025, and May 27, 2026, affecting 4,237 patients; and Heart of America Eye Care reported a hacking incident where patient information was viewed or copied between April 1 and April 6, 2026.
Each organization is still conducting data reviews to determine the full scope. The questions below reflect what compliance teams actually ask during this process.
Q1: How long do we have to notify after identifying whose data was involved?
You're working under the Health Insurance Portability and Accountability Act's 60-day notification deadline, but that clock starts when you complete your investigation and know a breach occurred.
The HIPAA Breach Notification Rule requires notification "without unreasonable delay and in no case later than 60 calendar days" after discovery. Discovery means when you have sufficient information to determine that a breach occurred, not when you first see suspicious activity.
If you detect unauthorized access on April 17 (like Ohio Living did), you can't delay notification for months while you review every file. Move the investigation forward with urgency. The forensic review should run in parallel with victim identification. Once you confirm unauthorized access to protected health information, you've discovered a breach. At that point, you have 60 days maximum to notify affected individuals, even if you're still determining the complete list.
The practical approach: file your initial HHS breach report at the 60-day mark with "at least 500 individuals" if you know it exceeds that threshold, then update the count when your data review concludes. That's what both Ohio Living and Heart of America Eye Care did in their regulatory filings.
Q2: Do we report if files were exfiltrated but not opened?
Yes. The HIPAA Breach Notification Rule uses an "acquisition, access, use, or disclosure" standard. Exfiltration meets the "acquisition" test. You don't need proof the attacker read, sold, or used the data.
The burden of proof works against you here. Under the HIPAA Omnibus Rule, you must presume a breach occurred unless you can demonstrate a low probability that protected health information was compromised through a risk assessment examining four factors: the nature and extent of the information involved, the unauthorized person who accessed it, whether the information was actually acquired or viewed, and the extent to which risk has been mitigated.
If files left your network, you can't credibly argue the information wasn't acquired. Focus your investigation on determining what was in those files, not whether the attacker looked at them.
Q3: Is it a breach if patient data was sent to the wrong business associate?
Yes, if the disclosure was impermissible under your business associate agreement and treatment relationship. Erlanger Health System faced this scenario when patient information was sent to a billing partner that provided services for its Tennessee campuses, but the data related to patients who received anesthesia care at its Western California location from a different anesthesia group.
The fact that the recipient was a business associate who understood HIPAA obligations doesn't eliminate the breach. The HIPAA Privacy Rule permits disclosures to business associates only when they're providing services under a valid business associate agreement for the specific patients involved. When you disclose protected health information to a business associate for patients they don't serve, that's an impermissible disclosure.
The disclosure affected 4,237 patients over nearly a year (July 1, 2025, to May 27, 2026). Even though the billing partner likely didn't use the data, the duration and volume make the low-probability-of-compromise argument untenable.
Q4: What data elements trigger different notification requirements?
The HIPAA Security Rule doesn't tier notification requirements based on data sensitivity, but your risk assessment and notification content should. Here's what you're required to disclose in the notification letter:
Describe what happened, the types of information involved, steps individuals should take to protect themselves, what you're doing to investigate and prevent recurrence, and contact information for questions. The Health Information Technology for Economic and Clinical Health Act added the requirement to notify prominent media outlets if the breach affects more than 500 residents of a state or jurisdiction.
The data categories matter for your risk assessment and recommended protective steps. If Social Security numbers or financial account information were involved (as Ohio Living's breach potentially included), you should recommend credit monitoring. If the breach exposed medical histories, diagnostic information, or treatment details without financial identifiers, identity theft risk is lower but privacy harm is still significant.
Don't bury the data categories in vague language. Ohio Living's notification listed specific categories: names, addresses, birth dates, Social Security numbers, medical histories, disability information, diagnostic and treatment information, prescription information, physician information, medical record numbers, health insurance information, and financial account/payment card information. That specificity lets individuals assess their personal risk.
Q5: How do we prevent prolonged "we're still investigating" notifications?
Set internal deadlines that are tighter than regulatory ones. If you're conducting a data review to match exfiltrated files to specific individuals, that process should have a defined timeline with weekly progress checkpoints.
The investigation has two distinct phases: determining whether a breach occurred (forensics and legal analysis) and determining who was affected (data review and victim identification). You can't delay phase one indefinitely. Once you confirm unauthorized access to protected health information, you've discovered a breach. Phase two continues, but notification planning starts immediately.
For the victim identification process, build a sampling methodology if you're dealing with thousands of files. Review a representative sample to understand the data structure, then project timelines for full review. If you're 30 days into the 60-day window and you've reviewed 20% of files, you know you won't finish before the deadline. File your initial notification with the known minimum count and update it.
Q6: What if our vendor didn't notify us of a breach on time?
Your notification deadline runs from when you discovered the breach, not when the vendor should have told you. If you learn about a vendor breach on day 45 of their incident, your 60-day clock starts on day 45.
Document the business associate agreement violation immediately. The HIPAA Omnibus Rule requires you to take action when you know a business associate violated the agreement. Your options include providing an opportunity for the business associate to cure the breach, terminating the agreement if cure isn't possible, or reporting the problem to HHS if termination isn't feasible.
The practical exposure: if HHS investigates your breach notification timeline and discovers you knew about vendor security gaps before the breach, that creates a separate HIPAA Security Rule violation. The administrative safeguards at 45 CFR § 164.308(b) require you to ensure business associates provide satisfactory assurances they'll protect electronic protected health information.
Review your business associate agreements now for notification timelines, audit rights, and termination provisions. If your agreements don't give you the right to audit vendor security controls or require notification within a specific timeframe, you're operating with compliance gaps that will surface during a breach investigation.
Next Steps
Start with HHS's breach notification guidance for detailed information. For forensic investigation standards, reference NIST SP 800-53 controls in the Incident Response (IR) family, particularly IR-4 (Incident Handling) and IR-6 (Incident Reporting). These controls map to what forensic teams should deliver: timeline reconstruction, scope determination, and evidence preservation.
Your incident response plan should include decision trees for the breach/no-breach determination and notification timing. If you don't have documented criteria for when to escalate from "security incident" to "breach requiring notification," build them now. The next incident won't wait for you to figure out the process.
