HIPAA Security Incident Response Action Plan

Practice Name:	HIPAA Security Officer:
Effective Date:	Next Review Date:

Immediate action on a suspected breach

If you suspect a ransomware infection, unauthorized account access, or exposure of patient information: do NOT turn the computer off. Disconnect the network cable or switch off Wi-Fi, then call Comodo immediately: (916) 740-1407. If you cannot reach anyone, tell your office manager and email hipaa@comodotechnology.com. Powering down destroys the forensic evidence needed to determine whether patient data was actually accessed.

1 · Incident Severity Classification & Triage

Severity	Examples	Comodo Action	HIPAA Escalation
SEV-1 Critical	Ransomware, active practice-management or EHR breach, lost or stolen unencrypted laptop or drive containing patient data, widespread phishing.	Isolate the network, revoke Microsoft 365 sessions, preserve memory and logs, begin forensic capture.	Trigger the 4-Factor Risk Assessment. Notify practice leadership and legal counsel within 2 hours.
SEV-2 High	Targeted credential theft (password entered on a phishing page), lost encrypted laptop or tablet, a fax or email of multiple charts sent to the wrong recipient.	Reset credentials, remote-wipe the device, run a deep audit-log review.	Document containment and assess whether patient data was actually accessed or viewed.
SEV-3 Moderate	One patient's record faxed or emailed to the wrong patient or provider; a phishing click with no credentials entered; malware blocked before it ran.	Run an endpoint scan, re-verify the user's multi-factor setup, review endpoint telemetry.	Log it in the incident register. For a misdirected record, get written confirmation it was destroyed and document the 4-factor assessment.

2 · The 6-Phase Incident Response Workflow

Identification & Intake. Staff notices something wrong — locked files, an unexpected login prompt, a misdirected chart — and alerts the HIPAA Security Officer and Comodo within 15 minutes.
Containment. Disconnect affected workstations from the network to stop ransomware spreading; revoke active Microsoft 365 sessions and reset affected passwords; suspend the compromised user inside the practice-management or EHR system.
Eradication & Forensic Logging. Comodo engineers pull endpoint and Microsoft 365 audit logs, remove malware artifacts, and verify backup integrity before anything is restored.
Recovery. Restore from a verified clean backup. Validate clinical workflows, imaging, and e-prescribing before any device returns to patient-facing service.
4-Factor Breach Risk Assessment. Leadership and counsel evaluate: (1) the nature and extent of the information involved; (2) who the unauthorized person was; (3) whether the information was actually acquired or viewed; and (4) the extent to which the risk has been mitigated.
Notification & Documentation. If the assessment concludes a reportable breach occurred, follow Section 3 below — then file the full incident record for the required retention period.

Breach risk assessment factors per 45 CFR § 164.402. Incident response procedures required under 45 CFR § 164.308(a)(6).

3 · Breach Notification Requirements

Scenario	What Must Happen
Affected individuals	Written notice to each affected individual without unreasonable delay and no later than 60 calendar days from discovery of the breach.
500 or more individuals	Notify HHS/OCR at the same time as individual notice. Prominent media notification is also required if more than 500 residents of a single state or jurisdiction are affected.
Fewer than 500 individuals	Log in the practice's internal incident register and submit to HHS/OCR within 60 days of the end of the calendar year in which the breach was discovered.
California practices	California's Confidentiality of Medical Information Act imposes its own notification duties that can be stricter and faster than federal HIPAA rules. Confirm state obligations with counsel alongside the federal timeline.

Federal breach notification timelines per 45 CFR §§ 164.404–164.408. State obligations vary — this document does not constitute legal advice.

4 · Emergency Contact Matrix

Role	Contact Name	Phone	Email
Comodo Technology IT SUPPORT	Call first on any suspected breach · Mon–Fri 8am–6pm Pacific	(916) 740-1407	hipaa@comodotechnology.com
Comodo Technology Email	Outside business hours — email; replies Mon–Fri. IT clients’ systems are monitored 24/7.	—	hipaa@comodotechnology.com
Practice HIPAA Security Officer
Practice Owner / Managing Doctor
HIPAA / Breach Legal Counsel
Cyber Insurance Carrier	Policy #:

5 · Annual Maintenance Checklist

Review and re-date this plan at least once per year.
Confirm every contact above is current — especially after staff turnover.
Verify all staff completed security awareness training this year.

Confirm backups have been test-restored, not just reported as successful.
Re-confirm your cyber insurance policy limits and notification deadlines.
Retain this plan and all incident records for 6 years.

Retention requirement: HIPAA requires Security Rule documentation — including this plan, incident records, and staff training completion records — to be retained for six years from the date of creation or the date it was last in effect, whichever is later. 45 CFR §164.316(b)(2)(i) and §164.530(j).

Comodo IT Support · Mon–Fri 8am–6pm Pacific

(916) 740-1407

HIPAA training line · (916) 770-4050

hipaa@comodotechnology.com