What Counts as an Incident?

Not every security event is a breach, and not every breach triggers notification obligations. But every suspected incident must be evaluated using a documented process. Under HIPAA, an incident is any actual or suspected unauthorized access, use, disclosure, modification, or destruction of PHI. This includes:

Lost or stolen devices containing ePHI
Phishing emails that may have resulted in account compromise
Ransomware or malware infections on clinical systems
Unauthorized access to patient records by staff
Misdirected faxes or emails containing PHI
PHI disclosed to the wrong patient or family member
Vendor or business associate security incidents

Reporting an Incident in the Portal

Any user — employee or Privacy Officer — can report an incident. Employees report through Report an Incident in their dashboard. Privacy Officers have full access to the incident management system through the Incidents section.

When creating an incident report, document:

Date and time discovered (not when it occurred — when you found out)
Type of incident — lost device, unauthorized access, misdirected disclosure, etc.
PHI involved — what types of information, how many individuals affected
How it was discovered
Immediate actions taken
Who else knows — internal staff, vendors, law enforcement

The Breach Risk Assessment

Once an incident is reported, your Privacy Officer must conduct a four-factor risk assessment to determine whether it constitutes a reportable breach. HIPAA's Breach Notification Rule presumes every unauthorized PHI disclosure is a breach unless a risk assessment shows a low probability of compromise. The four factors are:

The nature and extent of the PHI involved
Who accessed or could have accessed the PHI
Whether the PHI was actually acquired or viewed
The extent to which the risk has been mitigated

The portal walks you through these four factors with structured questions and generates a documented risk assessment finding: Breach or Not a Breach. Both findings must be documented and retained.

Important: If your assessment concludes this is NOT a breach, that conclusion and your reasoning must still be documented in writing. "We investigated and determined no breach occurred" without documentation is not defensible to OCR.

Breach Notification Timelines

If the incident is determined to be a reportable breach, strict notification timelines apply:

Affected individuals: Written notification within 60 days of discovering the breach
HHS/OCR: Within 60 days if 500+ individuals affected; annual log submission if fewer than 500
Media: If 500+ individuals in a single state are affected, prominent media notice is required in addition to individual notice
Business associates: Must notify covered entities without unreasonable delay and within 60 days of discovering the breach

Tip: The 60-day clock starts when you discover the breach — not when the breach occurred. Investigate quickly and document your investigation timeline. Waiting to report "until we know more" is a common mistake that turns a manageable incident into a compliance violation.

Anonymous Incident Reporting

The portal supports anonymous incident reporting for employees who are concerned about retaliation. Anonymous reports are delivered to the Privacy Officer without identifying the reporter. Encourage your staff to report concerns — early incident detection almost always leads to better outcomes than late discovery.

Closing the Loop

After an incident is resolved, document the final outcome in the portal: what was determined, what notifications were sent (and when), what corrective actions were taken to prevent recurrence, and the incident closure date. This creates a complete, auditable incident record that demonstrates your organization's compliance with the Breach Notification Rule.

Incident Management