Domain D: Security Incident & Breach Response
An incident response plan, the four-factor breach test, and the notification clocks: a business associate reports to its covered entities, a covered entity notifies patients, HHS, and the media.
Some items in this domain are written for one entity type. Items marked Business Associates only or Covered Entities only apply to that type; unmarked items apply to every HIPAA-regulated organization.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Written security incident response plan
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
Incident log maintained with root cause and disposition for each entry
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
Breach risk-assessment procedure applying the four-factor test
45 C.F.R. §164.402 · Source: www.ecfr.gov/current/title-45/section-164.402
Notification procedure meeting the 60-day business-associate-to-covered-entity standard
45 C.F.R. §164.410 · Source: www.ecfr.gov/current/title-45/section-164.410
Current, verified contact list for covered-entity breach notification
45 C.F.R. §164.410 · Source: www.ecfr.gov/current/title-45/section-164.410
Law-enforcement delay provision understood and documented
45 C.F.R. §164.412 · Source: www.ecfr.gov/current/title-45/section-164.412
Breach notification sent to each affected individual without unreasonable delay and no later than 60 calendar days after discovery, with the required content, by first-class mail or agreed e-mail, and by substitute notice where contact information is out of date
45 C.F.R. §164.404 · Source: www.ecfr.gov/current/title-45/section-164.404
Notice to the Secretary of HHS made contemporaneously with individual notice for a breach of 500 or more people, or by annual submission within 60 days after year end for smaller breaches, and notice to prominent media when more than 500 residents of one State are affected
45 C.F.R. §164.406; 164.408 · Source: www.ecfr.gov/current/title-45/section-164.406
Every business associate is contractually required to report security incidents and breaches within a set window, and reports received are logged and handled under this procedure
45 C.F.R. §164.410; 164.504(e)(2)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.410
The incident response capability has documented goals and scope
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
An incident response team, or the alternative structure the organization chose, is named with its roles
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
The incident response plan is tested by an exercise at least annually, with results recorded
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
Post-incident analysis feeds documented updates to the incident response plan
45 C.F.R. §164.308(a)(6)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308