When cybercriminals access patient data and a class action lawsuit follows, your legal team needs documentation proving you implemented "necessary data security safeguards." This phrase appears in the proposed federal lawsuit against Abbott Laboratories and its Exact Sciences business after a ShinyHunters data theft. The plaintiff's attorney didn't need technical forensics, the absence of documented safeguards made the case.
This template provides a structured response framework that meets HIPAA Security Rule requirements and evidentiary standards courts use to evaluate if your organization acted reasonably.
Purpose of This Template
This breach response documentation template creates a defensible record of your containment, investigation, and remediation actions. It's designed for healthcare organizations managing incidents involving unauthorized access to protected health information, but it applies to any regulated entity handling sensitive data.
Use this template to:
- Document your incident timeline with the specificity regulators and plaintiffs' attorneys demand
- Demonstrate compliance with the HIPAA Breach Notification Rule's risk assessment requirements
- Create evidence that your response followed your Computer Security Incident Response Team procedures
- Establish a foundation for the notification letters, regulatory filings, and potential litigation that follow
The template addresses the gap that often leads to lawsuits: the difference between having an incident response plan and proving you followed it with appropriate safeguards in place.
Prerequisites
Before using this template effectively, ensure:
Documented baseline security controls. You can't demonstrate that safeguards failed or held without documenting what you implemented. Maintain a current Statement of Applicability mapping your controls to HIPAA Security Rule requirements (45 CFR § 164.308-312).
Defined incident response procedures. Your Computer Security Incident Response Team structure, escalation paths, and decision authority must exist in writing before the breach. The template documents execution of those procedures; it doesn't create them retroactively.
Access to technical logs. You'll need authentication logs, system access records, data flow documentation, and network monitoring data. If you discover during the incident that you lack logging for critical systems, document that gap immediately as a control deficiency requiring remediation.
Legal and privacy officer involvement from hour one. This template creates privileged attorney work product when completed under legal counsel's direction. Involve your legal team before you start filling it out.
The Template
Section 1: Incident Identification and Initial Assessment
Date and time of discovery: [Timestamp]
Discovery method: [Alert source: SIEM, third-party notification, user report, threat actor claim]
Initial scope assessment: [Affected systems, data categories, user populations]
HIPAA trigger determination: [Does this constitute access, acquisition, use, or disclosure? Document reasoning]
Immediate containment actions taken:
- [Timestamp] [Action: credential revocation, system isolation, access restriction]
- [Timestamp] [Action]
- [Timestamp] [Action]
Initial risk classification: [Low/Medium/High based on data sensitivity, volume, likelihood of harm]
Section 2: Investigation and Root Cause Analysis
Systems and data involved:
- System name: [Name]
- Data elements: [Specific PHI categories: names, SSNs, diagnosis codes, etc.]
- Records affected: [Count or "under investigation"]
- Encryption status: [At rest/in transit/unencrypted, cite specific implementation]
Access pathway:
- Entry point: [Compromised credential, vulnerability, misconfiguration]
- Lateral movement: [Document attacker progression through environment]
- Data exfiltration method: [If confirmed]
- Duration of unauthorized access: [Earliest evidence to containment]
Control failures identified:
- [Control name per HIPAA Security Rule]: [Specific failure mode]
- [Control name]: [Failure mode]
Controls that functioned as designed:
- [Control name]: [How it limited impact]
- [Control name]: [Detection or containment role]
Section 3: Risk Assessment for Breach Determination
Under 45 CFR § 164.402, assess the probability that PHI has been compromised using these factors:
Nature and extent of PHI involved: [Document specific data elements and sensitivity]
Unauthorized person who accessed PHI: [Known threat actor? Insider? Opportunistic attacker? ShinyHunters and similar gangs have documented monetization patterns, if you're dealing with a known criminal group, that context matters for the risk assessment]
Was PHI actually acquired or viewed? [Log evidence of data access, exfiltration indicators, or absence of confirmation]
Extent to which risk has been mitigated: [Technical safeguards that limited exposure, post-incident controls implemented]
Conclusion: [Breach requiring notification / Not a breach / Requires further investigation]
Basis: [Cite specific evidence supporting conclusion]
Section 4: Notification and Regulatory Actions
Individuals affected: [Count or "TBD pending investigation completion"]
Notification timeline:
- Individual notifications: [Must begin within 60 days of discovery per 45 CFR § 164.404]
- Media notification: [Required if affecting 500+ residents of a state]
- HHS notification: [Within 60 days if 500+, annual if fewer]
Notification content prepared: [Date draft completed]
Legal review completed: [Date]
Notifications sent: [Date range]
Section 5: Remediation and Preventive Measures
Immediate remediation:
- [Action taken] [Completion date]
- [Action taken] [Completion date]
Longer-term security enhancements:
- [Control implementation] [Target date]
- [Process change] [Target date]
- [Technology deployment] [Target date]
Monitoring enhancements: [New detection capabilities, log sources, alert rules]
Third-party security assessments scheduled: [Penetration test, control audit, forensic review, with dates]
How to Customize It
Adapt Section 1 for your detection capabilities. If you discovered the breach through a threat actor's public claim rather than internal monitoring, document that honestly and add "Implement advanced threat detection" to your remediation section. The Abbott/Exact Sciences incident involved ShinyHunters posting claims on their dark web site, that's a detection gap, not a containment failure, but you need to document both.
Expand Section 2 based on your environment complexity. If you operate multiple business units with separate systems (like Abbott's acknowledgment that "legacy Exact Sciences systems are separate from Abbott's"), document the segmentation and how it limited impact. If you lack segmentation, document the lateral movement risk and your remediation plan.
Tailor Section 3's risk assessment to your data types. Cancer diagnostics data (as involved in the Exact Sciences incident) includes diagnosis information, genetic markers, and treatment history, all highly sensitive. Financial account numbers and demographic data carry different harm profiles. Be specific about what makes your data sensitive and attractive to criminals.
Adjust Section 4 for your regulatory obligations. Healthcare entities face HIPAA Breach Notification Rule requirements, but you may also have state-specific obligations, contractual notification duties, or industry-specific rules. Map all applicable requirements before you finalize notification timing.
Scale Section 5 to the control failures you identified. If your root cause was a missing Privileged Access Management control, your remediation section should detail the PAM implementation, not generic "improve security" language. Courts and regulators evaluate whether your response addressed the specific deficiency.
Validation Steps
Before you consider this template complete:
Have legal counsel review it under privilege. This document will be requested in discovery if you face litigation. Structure it as attorney work product from the start.
Verify your risk assessment conclusion with your privacy officer. The breach-or-not-breach determination has regulatory and legal consequences. Don't let a technical team make that call unilaterally.
Cross-reference your timeline against system logs. Plaintiffs' attorneys will compare your documented timeline to forensic evidence. If you claim containment at 14:00 but logs show continued access at 16:00, you've created an impeachment document.
Test your notification language with your communications team. The notification letters you send to affected individuals become evidence of what you knew and when. Every statement must be defensible.
Document what you don't know yet. If you're still investigating the full scope, say that explicitly with a date for the next update. "Under investigation as of [date]" is defensible. Silence or vague assurances aren't.
Map your remediation to recognized frameworks. When you document that you're implementing Just-in-Time Access or Zero Trust Architecture, cite the framework. "Improving access controls" is vague; "implementing Just-in-Time Access per NIST SP 800-207 Zero Trust Architecture principles" is specific and defensible.
The proposed lawsuit against Abbott alleges that the companies "failed to implement necessary data security safeguards." Your completed template should make that allegation impossible to sustain, not because you prevented every possible breach, but because you can demonstrate that you implemented reasonable safeguards, detected the incident, contained it appropriately, and remediated the root cause. That's the standard courts actually apply.
