A wrong-recipient PHI email is a privacy incident first, not an invitation to erase the record.
Contain the disclosure, preserve the message and technical evidence, identify exactly what PHI was sent, and document what the unintended recipient did with it.
Then complete the HIPAA four-factor breach risk assessment and follow the notification rules that apply to the facts.
Contain without destroying evidenceAsk the unintended recipient to delete the message and attachments, but preserve the original message, headers, timestamps, delivery status, attachments, and any reply.
A recall attempt can be useful, but clicking recall does not prove the message was never viewed, retained, copied, or forwarded.
HIPAA four-factor breach risk assessment
Build the analysis around the actual facts of the disclosure
The page identifies four areas the practice should document before reaching a breach conclusion.
Factor 1Nature + Extent of the PHI
Document what was actually disclosed, including the type of PHI and identifiers involved.
Factor 2Unauthorized Recipient
Identify who received the information and whether that person or organization has obligations that affect the risk.
Factor 3Acquired or Viewed
Determine whether the PHI was actually acquired or viewed rather than assuming delivery alone answers the question.
Factor 4Extent of Mitigation
Document deletion requests, confirmations, recall results, non-access evidence where available, and any other mitigation.
A deletion confirmation can matter, but it does not automatically end the analysis. Preserve the evidence supporting the conclusion the practice reaches.
Preserve the technical record before anyone cleans up the inbox
Keep the evidence needed to understand what happened
The page specifically calls out message content, sender and recipient details, timestamps, security status, delivery information, recipient replies, and mitigation records.
MessageOriginal Email + Attachments
Keep the original message and the exact attachments that were sent.
RoutingAddresses + Headers + Timestamps
Preserve sender and recipient addresses, message headers, delivery information, and timestamps.
SecurityEncryption + Recall Status
Record secure-message or encryption status along with recall, bounce, or delivery results.
MitigationReplies + Deletion Evidence
Keep recipient replies, deletion confirmations, non-access evidence where available, and incident notes.
The technical record supports the privacy or compliance review. IT can document the facts, but it should not make the legal breach determination by itself.
PHI sent to the wrong inbox? We help contain the disclosure, preserve evidence, and work through the HIPAA breach assessment.
Use the incident to fix the workflow that allowed the misdirection
Wrong-recipient email is often a process problem as much as a human mistake
The page names autocomplete, stale referral contacts, unmanaged mailboxes, broad distribution lists, and attachments added before the destination is verified as common causes.
ContactsVerified Recipient Directories
Keep referral and external-recipient information current instead of relying on stale autocomplete history.
SendingConfirm External Recipients
Use procedures or prompts that make staff verify the destination before sending PHI outside the practice.
AccessManaged Shared Mailboxes
Use role-based shared mailboxes and accountable access instead of unmanaged or personal accounts.
ControlsSecure Messaging + DLP
Use secure-message tools, data-loss-prevention controls where appropriate, and workflows that reduce avoidable disclosure risk.
The goal is a measurable control improvement so the next PHI transfer depends less on memory and luck.
Build the Incident Evidence Chain
A wrong-recipient PHI email should leave a defensible record behind. Add each response action to the incident log and watch the technical record build as the response progresses.
Contain, preserve, assess, decide, improve
Tap each action as it is completed. The log is a teaching model for the response sequence, not a legal breach determination.
Incident Record0 of 6 logged
No response actions logged yet.
Frequently Asked Questions
Sending PHI to an unauthorized email recipient is generally an impermissible disclosure and is presumed to be a breach unless an exception applies or the practice demonstrates a low probability that the PHI was compromised. The HIPAA Breach Notification Rule requires the risk assessment to consider at least the nature and extent of the PHI involved, the unauthorized person who received it, whether the PHI was actually acquired or viewed, and the extent to which the risk was mitigated.
No. HIPAA does not impose a general 72-hour individual-notification deadline for this type of incident. When individual breach notification is required, the covered entity must provide it without unreasonable delay and no later than 60 calendar days after discovery of the breach. Other federal, state, contractual, or sector-specific requirements may impose different or shorter deadlines, so the practice should evaluate all applicable obligations.
A credible confirmation that the unintended recipient deleted the message without further use or disclosure can be important mitigation evidence, but it does not automatically end the HIPAA analysis. The practice should document what happened, who received the information, whether it was opened or otherwise accessed if that can be determined, what PHI was involved, the deletion or other mitigation steps taken, and the remaining breach risk factors before deciding whether notification is required.
IT should help establish and preserve the technical facts of the incident, but it should not make the reportability decision by itself. IT can document message routing, recipients, access logs, account activity, security controls, containment, and other technical evidence. The determination of whether an incident constitutes a reportable breach should follow the practice’s privacy and compliance process, with qualified legal or compliance counsel involved when appropriate.
Sent PHI to the wrong email and not sure what to do in the first hour?
Ekim IT Solutions works exclusively with dental practices, supporting offices across all 50 states remotely. We help you contain the disclosure, preserve the technical record, and document the breach assessment so nothing gets made worse by panic or deletion.
Calm, correct steps after a misdirected PHI email.
Ezra Angelo
