Three Incidents in One Afternoon: Breach Clocks That Have Already Started
On Friday, June 6, the privacy officer of a 200-provider multi-specialty group learns three things in one afternoon. (1) A physician reported that her unencrypted laptop was stolen from her locked car on May 29; it held a spreadsheet of 3,400 patients with names, dates of birth, diagnoses, and insurance numbers, which she had copied to the desktop to work from home. (2) A staff member emailed a scheduling list to the wrong internal distribution list, exposing 42 patients' names and appointment types; the email was recalled and the sender reports 'no one opened it.' (3) The group's billing vendor disclosed that its ransomware incident, discovered by the vendor on March 20, affected 45,000 of the group's patients; the vendor notified the group today. The business associate agreement requires notice 'promptly.'
1. For each incident, state when the notification clock started, the deadline, and who must notify whom. Explain any imputation of knowledge that changes the answer.
Read the worked answer
Incident 1 - stolen laptop. Encryption was not used, so the safe harbor does not apply and breach is presumed absent a documented low-probability-of-compromise determination. The physician is a member of the workforce acting within the scope of her duties, so her knowledge on May 29 is imputed to the group; the 60-day clock runs from May 29, not from June 6. Deadline: approximately July 28. Because 3,400 affected individuals exceeds 500, the group must notify individuals without unreasonable delay and no later than 60 days, notify HHS contemporaneously through the breach portal, and notify prominent media in each state with more than 500 affected residents.
Incident 2 - misdirected email. Discovery is June 6; if it is determined to be a breach, the deadline is approximately August 5. At 42 individuals, this is a small breach: individuals only, with HHS notice in the annual log within 60 days after the end of the calendar year.
Incident 3 - vendor ransomware. This is the urgent one. Where the business associate acts as the covered entity's agent, the business associate's knowledge is imputed to the covered entity, so the clock started March 20 - the deadline was approximately May 19 and has already passed. The group must notify now, with a candid explanation of the delay. The group, not the vendor, is responsible for individual, HHS, and media notice; the vendor's failure is a contract and vendor-management issue and does not shift the regulatory duty.
2. Apply the four-factor risk assessment to the 42-patient email and state your conclusion and the documentation you would create.
Read the worked answer
Factor 1 - nature and extent of the PHI. Names plus appointment types, with no diagnosis, treatment, financial account, or Social Security data. Sensitivity is low-to-moderate; the appointment type can imply a service line, which is not trivial but is far from a clinical record.
Factor 2 - the unauthorized recipient. The distribution list was internal to the organization. If every recipient is a workforce member bound by the same confidentiality policies, the recipient is not a person who would reasonably be expected to use the information to the patient's detriment.
Factor 3 - whether the information was actually acquired or viewed. 'Recalled and nobody opened it' is an assertion, not a finding. Verify it: check mail-server logs for delivery, open, and forward events on each recipient mailbox, and confirm whether any recipient forwarded the message externally.
Factor 4 - extent of mitigation. Obtain written attestations from recipients that they deleted the message and any copies, and confirm deletion from the recall and from any mobile devices.
Conclusion. If the logs confirm internal-only delivery with no external forwarding, a low-probability-of-compromise determination is defensible and individual notice is not required - but the determination must be documented in writing, signed and dated, with the logs attached, and retained for six years. If any message reached an external address, notify.
Practical note: the same four-factor analysis must be applied to incidents 1 and 2 separately; do not write one combined memo.
3. What are your obligations and options with respect to the billing vendor, and what does this incident tell you about the vendor-management program?
Read the worked answer
Immediate obligations. The group still owes timely notice to individuals, HHS, and the media. Send the vendor a written demand for the forensic report, the affected-patient data elements, the root-cause analysis, and a certification of the number of the group's patients affected - with a deadline measured in days.
Contract posture. Review the business associate agreement's notice, indemnification, cooperation, and audit provisions. The vendor missed any reasonable reading of 'promptly' by 78 days. Preserve the right to recover notification costs, credit monitoring, and call-center expense, and consider whether the breach triggers termination rights or a right to demand a corrective action plan.
Regulatory posture. The group remains responsible for the notification and cannot deflect to the vendor. In the HHS submission, describe what the vendor did and when, what the group did upon notice, and what contractual remedies were invoked; regulators distinguish covered entities that manage a vendor failure from those that simply forward blame.
Program lesson. A 'promptly' standard without a defined number of days, no requirement to notify of a suspected incident within 24–72 hours, no annual security attestation, and no inventory of which vendors touch PHI are the underlying failures. Fix all four: amend every BAA to a 30-day outer limit with a 72-hour suspected-incident trigger, add an annual security questionnaire with evidence, maintain a PHI vendor inventory tied to the risk analysis, and report vendor risk to the compliance committee quarterly. Given the size of this incident, also notify the cyber insurer immediately and confirm whether the group's own incident response retainer can supply the forensics.