HIPAA Incident Response Plan Template
Write the procedure your practice follows when patient data is exposed: who leads, what staff report, how you contain it, how you decide whether it is a breach, and which notification deadlines apply. The Security Rule requires documented incident procedures under 45 CFR 164.308(a)(6); this template gives you a complete, editable first draft.
Pre-filled for a small outpatient practice. Edit every field to match your office, then print and sign it, or copy the text into your policy manual.
HIPAA Security Incident Response Plan
Written under 45 CFR 164.308(a)(6) — review at least yearly and after every major incident
1.Purpose and scope
2.Response team
One person must own the response. In a small office the privacy officer and security officer can be the same person.
3.How staff report an incident
4.Contain and assess
5.Investigate and decide if it is a breach
6.Notify
7.Recover and review
Approved by (owner or CEO)
Date
This plan is a starting template, not legal advice. HIPAA requires documented security incident procedures; the details above are choices your practice makes and should be reviewed by counsel and your IT provider.
What Is a HIPAA Incident Response Plan?
It is the written playbook your practice follows when something goes wrong with patient information. The Security Rule makes it mandatory: 45 CFR 164.308(a)(6) requires policies and procedures to address security incidents, and its one required implementation specification says you must identify and respond to suspected or known incidents, mitigate harmful effects as far as you can, and document each incident and its outcome.
The rule does not dictate a format. What an investigator looks for is evidence that the steps existed before the incident and that staff followed them. A short plan that names real people, real phone numbers, and real deadlines does that better than a long generic policy nobody has read.
Security Incident vs. Breach: Why the Plan Covers Both
The two terms trigger different duties. A security incident is “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system” (45 CFR 164.304). Blocked phishing emails and failed log-in storms count. A breach is narrower: an impermissible use or disclosure of PHI that compromises it, presumed unless a documented risk assessment shows a low probability of compromise (45 CFR 164.402).
| Situation | What the plan does |
|---|---|
| Phishing email reported, nobody clicked | Log it as a security incident; no notification |
| Laptop stolen, disk encrypted to HHS standards | Log it; encrypted PHI is not unsecured PHI, so no breach notice |
| Fax with lab results sent to the wrong clinic | Run the four-factor assessment; notify if compromise cannot be ruled low |
| Ransomware encrypts the EHR server | Treat as a presumed breach; containment, forensics, counsel, notification review |
Every incident ends in the same place: a written record. The HIPAA incident report form captures one event and its risk assessment; this plan is the standing procedure that tells staff when to fill it in.
What a Small-Practice Plan Should Include
- A named response lead and a backup, plus your IT contact, counsel, and cyber insurer, with numbers that work after hours.
- Plain examples of what staff must report, and a reporting deadline measured in hours, not days.
- First-hour containment steps that preserve evidence instead of wiping it.
- The breach risk assessment and who signs off on the result.
- Notification steps and the federal clocks: 60 days for individuals, HHS timing by size, media for more than 500 residents of a state.
- An after-action review that feeds back into your risk analysis and training.
Business associates are part of the plan
How It Fits With Your Other Security Documents
Incident response is one of several plans the Security Rule asks for. The contingency plan standard at 45 CFR 164.308(a)(7) requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan, with periodic testing listed as an addressable specification. In practice, a ransomware event uses both documents at once: this plan runs the investigation while the contingency plan restores the systems.
Testing the plan
A yearly tabletop exercise is the cheapest proof a plan works. Walk the team through one scenario, such as a misdirected fax or a locked EHR, time each step, and write down what was missing. If a breach does happen, the breach notification letter generator and the breach notification guide cover the notice itself.