Open a first-hour HIPAA breach assessment

Practice the sequence you already learned for “Open a first-hour HIPAA breach assessment” until the order feels automatic. Drill the first-hour HIPAA order from privacy training. Containment, evidence, and the incident log start before the 164.402 four-factor assessment. Individual notices wait for the privacy officer.

1. Contain further disclosure of the PHI.
2. Preserve system and physical evidence.
3. Notify the privacy officer immediately.
4. Open the official incident record with times and decisions.
5. Document the nature and extent of the PHI, including identifiers.
6. Document the unauthorized person who used or received it.
7. Determine whether the PHI was actually acquired or viewed.
8. Document the mitigation already taken.
9. Decide whether a low probability of compromise is documented.
10. Do not send individual notices until the privacy officer directs that step.