It's the documented process a practice follows the moment a security incident is discovered — ransomware, unauthorized access, a lost device, a compromised email account — covering technical containment, patient notification, and regulatory reporting in one coordinated sequence rather than three separate scrambles.

Unlike a generic business incident response plan, a healthcare-specific plan has to account for HIPAA's Breach Notification Rule from the first minute — the notification clock can start running before the technical investigation is even finished.

The Breach Notification Rule requires covered entities to notify affected individuals following discovery of a breach involving unsecured protected health information, and — depending on the number of individuals affected — to notify the Department of Health and Human Services and, for larger breaches, the media as well.

The rule also requires the practice to document its risk assessment of whether the incident actually constitutes a notifiable breach in the first place, which is why fast, accurate scoping during the incident matters so much.

A security incident is any event that could compromise systems or data — not every incident rises to the level of a reportable breach. A breach specifically means unsecured protected health information was accessed, used, or disclosed in a way that compromises its security or privacy, unless a documented risk assessment demonstrates a low probability the information was actually compromised.

Making that determination correctly — and documenting the reasoning — is itself part of the incident response process, and getting it wrong in either direction carries risk: under-reporting is a compliance violation, while over-reporting creates unnecessary patient alarm and administrative burden.

A designated incident commander (often the practice's HIPAA Privacy or Security Officer), technical responders (in-house IT or an outsourced provider), a clinical lead who can assess patient safety impact if care systems are affected, and — for anything beyond a minor incident — outside counsel who can advise on the breach determination and notification requirements in real time.

Cyber insurance and malpractice carrier contacts should be identified and current in the plan as well, since many carriers require notification within specific timeframes to preserve coverage.

HIPAA generally requires notifying affected individuals without unreasonable delay, and the rule sets an outer limit measured in weeks from discovery — with additional requirements for notifying HHS and, for larger breaches, the media, on a related but distinct timeline. Smaller breaches can be reported to HHS on an annual basis rather than immediately.

Because specific day counts and thresholds are set in the regulation and can be subject to interpretation or updates, a practice should confirm exact current timelines with legal counsel or the HHS Office for Civil Rights rather than relying on an approximate memory of the rule.

When an incident affects clinical systems — scheduling, e-prescribing, lab result delivery, imaging access — the impact goes beyond data confidentiality into whether patients can actually receive timely care. A ransomware attack that locks an EHR doesn't just risk a HIPAA violation; it can directly disrupt appointments, medication management, and clinical decision-making.

Example: A dental practice in the Florida Panhandle lost access to its scheduling and imaging systems during a ransomware event, forcing same-day cancellations and rescheduling for dozens of patients — a downstream patient-care impact that a documented response plan, including manual fallback procedures, would have reduced significantly.

Affected systems are isolated to stop further spread, while the response team works to determine which patient records and clinical systems were affected. In parallel, the designated Privacy or Security Officer begins the breach risk assessment required to determine notification obligations, and a clinical lead assesses whether patient care needs manual fallback procedures while systems are down.

Patient communication is coordinated to be accurate and timely without creating unnecessary alarm — a rehearsed plan makes this far easier to get right than improvising language during the incident itself.

Cost depends on practice size, number of clinical systems in scope, and whether a co-managed relationship with outside counsel is already in place. Many practices fold ongoing incident response planning into a broader managed cybersecurity or compliance relationship rather than treating it as a standalone expense.

The relevant comparison isn't just breach cost — it's planning investment versus the cost of a delayed or mishandled notification, which can compound regulatory penalties on top of the breach itself.

Most cyber insurance policies require notification to the carrier within a specific window after discovering an incident, and often specify approved forensic investigators, legal counsel, and notification vendors that must be used for the claim to be honored — requirements that can conflict with a practice's own instincts to just start fixing the problem immediately.

Reviewing your policy's specific requirements before an incident — and building them directly into the response plan — avoids discovering a coverage gap or vendor conflict at the worst possible time.

Multi-provider and multi-location practices face higher stakes simply from scale — more systems, more staff, more opportunity for a gap. Practices relying heavily on connected clinical systems (e-prescribing, imaging, remote monitoring) face greater patient-care disruption risk if those systems go down. Specialty practices handling especially sensitive records, such as behavioral health, may carry heightened obligations under overlapping privacy laws beyond HIPAA alone.

Example: A multi-location medical group in Alabama built its incident response plan around a "assume clinical impact" default — every incident triggers an immediate clinical-lead assessment of patient care impact, regardless of how the incident initially appears, rather than waiting to confirm severity before involving clinical staff.

Look for a provider with direct healthcare or dental experience — not just general small business IT — who understands HIPAA's breach determination and notification requirements, can move fast enough to matter against the notification clock, and will coordinate directly with your legal counsel and insurance carriers rather than working in isolation from them.

• Do they have direct experience with healthcare or dental practice clients?
• Can they explain how they support a HIPAA breach risk assessment during an incident?
• What's their guaranteed response time, in writing?
• Will they coordinate directly with your legal counsel and insurance carriers?