MMHA 6300 Week 5 HIPAA Breach Memo Example

Memorandum

To: Managing Partner, Harbor Point Family Physicians

From: Practice Administrator (MMHA student)

Date: Month Day, Year

Re: The scheduling and billing servers were encrypted: we should treat it as a breach unless forensics shows otherwise

Incident Summary

On a Monday morning, staff at Harbor Point Family Physicians, a fictional five-physician group, found that the practice's scheduling and billing servers had been encrypted and that a ransom note was displayed on every workstation. The group's IT contractor traced the entry point to a phishing email opened the previous Thursday by a front-desk employee, whose password was then used to sign in remotely. The encrypted servers hold records for roughly 9,400 current and former patients: names, dates of birth, addresses, insurance numbers, appointment histories and the diagnosis and procedure codes attached to each claim. Clinical notes are kept in a separate hosted electronic health record that was not affected.

Backups from the previous Wednesday were intact, and the practice restored scheduling by Tuesday afternoon. What we do not yet know is whether the attackers copied any files out of the network before encrypting them. The contractor has preserved the firewall logs, and a forensic firm can review them within two weeks. That single unknown drives most of the analysis below.

Is This Protected Health Information?

Yes. The billing records link names and insurance numbers to diagnosis and procedure codes, which is individually identifiable information about a person's health care and payment for it, held by a covered entity (45 C.F.R. § 164.402). Even the scheduling records alone, which show that a named person saw a family physician on a given date, identify the person as a patient of the practice.

The Presumption of Breach

The notification rule starts from a broad definition: a use or disclosure outside what the Privacy Rule permits, which exposes the records to compromise, is a breach. The rule then shifts the burden: an impermissible event is treated as a breach unless the practice can document, in a written risk assessment, that compromise of the records is improbable (45 C.F.R. § 164.402). The Office for Civil Rights has said that when ransomware encrypts protected health information, the encryption itself is an unauthorized acquisition, because the attacker has taken control of the data, so the presumption applies (U.S. Department of Health and Human Services, 2016).

The practical meaning is that Harbor Point does not get to wait for proof that harm occurred. The question is not whether the attackers read patient files but whether the practice can show, on the evidence it has, that they probably did not. If the practice cannot make that showing, it must notify.

Applying the Four Factors

What kind of data, and how much. The records contain direct identifiers and insurance numbers, which can be used for medical identity theft, together with diagnosis codes that can reveal sensitive conditions. This factor weighs against a low-probability finding. A record set limited to appointment times would have been a different case.

The unauthorized person. The information was acquired by an unknown criminal group whose business is extortion. When protected information goes by mistake to another covered entity bound by HIPAA, this factor can favor the practice. Here it weighs heavily the other way, because nothing constrains what the recipient does with data it holds.

Whether anyone took or looked at the records. Here the evidence runs out. Many ransomware groups now copy data before encrypting it so that they can threaten publication as well as lockout, and attacks on health care organizations of this kind rose sharply in recent years (Neprash et al., 2022). If the forensic review finds no outbound transfer of any size during the attack window, the practice will have real evidence on this factor. If the logs are incomplete or show a large transfer, the factor will weigh against it. Silence in the evidence is not the same as a favorable finding.

Mitigation. Restoring from backups mitigates the loss of access but does nothing for confidentiality. Paying a ransom in exchange for a promise to delete copies would not be credible mitigation, since the practice would have no way to verify deletion. This factor is neutral at best.

Conclusion on the Risk Assessment

On the current evidence, Harbor Point cannot show a low probability of compromise. Three of four factors weigh against it and the fourth is unresolved. Unless the forensic review produces affirmative evidence that no data left the network, the practice should treat the incident as a breach. The risk assessment itself, with the forensic findings attached, should be written down and kept for six years, because the practice bears the burden of showing it was done.

Notification Duties and Timing

If the incident is a breach, each affected patient must be told in writing promptly, and in any event within 60 calendar days of discovery, which here was the Monday the servers were found encrypted (45 C.F.R. § 164.404). The letter has to explain the incident, list which kinds of data were exposed, suggest protective steps patients can take, describe Harbor Point's response and give a way to contact the practice. Because more than 500 residents of our state are affected, Harbor Point must also alert major news outlets in the state inside that same 60-day window (45 C.F.R. § 164.406) and file a report with the HHS Secretary alongside the patient letters (45 C.F.R. § 164.408). The 60 days are an outer limit, not a target; waiting for the forensic report is reasonable, but waiting past it is not. State breach laws may add requirements, and outside counsel should confirm them.

What the Security Rule Asks of the Practice

The breach analysis looks backward at one event. The Security Rule describes a continuing duty: covered entities must conduct an accurate and thorough risk analysis of threats to electronic protected health information, implement measures to reduce those risks, train their workforce in security awareness and maintain incident procedures and a contingency plan (45 C.F.R. § 164.308). Harbor Point's last written risk analysis is three years old and predates its move to remote sign-in. Phishing training was given once, at hire, to the employee whose credentials were used. Remote access did not require a second authentication factor.

None of these facts makes the practice liable for the attack, and this memo does not reach that conclusion. They are, however, exactly what the Office for Civil Rights asks to see when it reviews a breach report, and they are what the practice should fix first. The intact backups show the contingency planning worked; that point deserves to be recorded too.

Candor With Patients

The rule sets a floor. Patients trusted the practice with their information, and respect for persons suggests telling them plainly what happened even if the legal analysis were closer. A letter that an average reader can follow on the first pass, a staffed phone line rather than a voicemail box, and an offer of credit monitoring cost the practice relatively little and show that it takes the loss of trust seriously. A practice that does the minimum, late, will lose more patients than one that explains early what it knows and what it is still finding out.

Recommendations

1. Retain the forensic firm this week and ask it specifically whether data left the network between Thursday and Monday.

2. Draft patient, media and HHS notices now so they can go out promptly if the forensic findings do not support a low-probability conclusion.

3. Require multifactor authentication for all remote access within 30 days.

4. Commission an updated Security Rule risk analysis and schedule quarterly phishing training with simulated tests.

5. Document every decision in this process, including this memo, in the privacy officer's breach file.

References

Administrative safeguards, 45 C.F.R. § 164.308 (2024).

Definitions, 45 C.F.R. § 164.402 (2024).

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

Notification to individuals, 45 C.F.R. § 164.404 (2024).

Notification to the media, 45 C.F.R. § 164.406 (2024).

Notification to the Secretary, 45 C.F.R. § 164.408 (2024).

U.S. Department of Health and Human Services. (2016). Fact sheet: Ransomware and HIPAA. Office for Civil Rights.