Stop the incident from continuing: disconnect an affected computer, disable compromised accounts, block malicious network traffic, remove an affected device from the network, or contact your IT and security provider.

Do not destroy potentially useful evidence.

Establish what system was affected, what information was involved, when the incident occurred, who had unauthorized access, whether information was actually accessed or exfiltrated, and whether the threat is still active.

HHS explains that breach evaluation includes factors such as the nature of the PHI, who accessed it, whether it was actually acquired or viewed, and what mitigation occurred.

Not every cybersecurity incident automatically equals a reportable HIPAA breach.

Determine whether protected health information was involved and whether the information was unsecured.

HHS states that an impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised.

That assessment needs to be documented.

Depending on the circumstances, notification obligations can involve affected individuals, HHS, media outlets in certain large breaches, and the covered entity when the incident occurs at a business associate.

HIPAA requires individual notification without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI, and for large breaches, HHS notification also has a 60-day requirement.

That does not mean a practice should wait 60 days. It is the federal outer limit in the circumstances described by HHS.