Behavioral Health Vendor Incident Response Checklist for Shared Password Breaches

Confirm Shared Password Exposure

Start by confirming what happened, when the shared password may have been exposed, and which vendor systems or accounts it could access. Ask the vendor to identify the affected credentials, users, services, and time period, and to distinguish confirmed activity from suspected exposure.

Look for credential stuffing indicators, such as repeated failed sign-in attempts followed by a successful login, unusual locations or devices, unexpected access times, and attempts to access multiple accounts. Record the evidence and timestamps, but avoid delaying containment while waiting for a complete investigation.

• Identify the shared account, password, and systems involved.
• Determine who knew or used the credential and whether it was reused elsewhere.
• Note suspicious sign-ins, account changes, and activity outside normal patterns.
• Assign an incident lead and record the time the organization discovered the exposure.

Contain Vendor Account Access

Work with the vendor to disable or rotate the exposed password and revoke active sessions, tokens, API keys, and other credentials associated with the account. If the account supports essential care operations, coordinate a safe transition to named accounts rather than leaving shared access active.

Review identity and access management settings and limit access to the minimum necessary while the investigation proceeds. Require multi-factor authentication enforcement for vendor access where supported, and verify that recovery methods and administrator accounts have not been changed by an unauthorized user.

• Disable the exposed credential and terminate active sessions.
• Review related accounts for password reuse or unauthorized changes.
• Restrict access by role, system, and approved connection method.
• Maintain an access revocation audit trail showing what was revoked, by whom, and when.

Preserve Authentication Logs

Before routine retention or system changes erase relevant evidence, ask the vendor to preserve authentication and access records for the affected accounts and systems. Keep original log exports where possible, record who collected them, and document the collection time and time zone.

Request identity and access management logs that show sign-in successes and failures, source IP addresses, devices, session creation and termination, privilege changes, password resets, and access to connected applications. Preserve relevant alerts, support tickets, configuration changes, and communications as well.

Limit access to preserved evidence and store it securely. Document any gaps in log coverage, retention limits, or vendor systems that could not provide records, since those limitations may affect the assessment.

Assess Behavioral Health Data Impact

Determine whether the compromised account could access, use, change, or disclose behavioral health records or systems containing protected health information (PHI). Map the account’s permissions to the data and applications it could reach, then compare those permissions with available authentication, application, and audit logs.

Assess whether records were viewed, searched, exported, altered, or transmitted, and identify the types of information and individuals potentially involved. A lack of evidence that data was accessed is not the same as evidence that it was not accessed; document the limits of the available logs and other evidence.

Use the organization’s HIPAA Security Rule risk analysis and applicable incident procedures to evaluate the event. The protected health information exposure assessment should consider the nature and extent of the information, who may have received or accessed it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated. Route decisions about breach status and required notifications to the organization’s privacy, security, and legal leads.

Coordinate Vendor and Provider Response

Establish a secure communication channel with the vendor and agree on a point of contact, update cadence, evidence-sharing process, and immediate containment responsibilities. Review the business associate agreement and incident procedures for reporting requirements, contacts, and any agreed deadlines.

Request a written incident summary that separates confirmed facts from ongoing investigation, describes the affected systems and data, and identifies containment steps taken. The organization should coordinate the business associate incident notification process with its privacy and security leads and determine who is responsible for any required notices.

Coordinate response steps with clinical and operational leaders when vendor access supports care delivery. Use approved contingency procedures to maintain safe, authorized access to essential services while avoiding restoration of the compromised shared credential.

Track Remediation Tasks and Status

Maintain a single remediation record that assigns an owner and due date to each action. Track the vendor’s work alongside the provider organization’s actions so that open risks, dependencies, and decisions remain visible until verified.

• Credential rotation, session termination, and access revocation.
• Review of related accounts, permissions, and multi-factor authentication enforcement.
• Log preservation, evidence review, and resolution of monitoring gaps.
• Data-impact assessment and privacy or legal review.
• Vendor security improvements, testing, and confirmation that corrective actions work.

Record each task’s status, completion evidence, reviewer, and any reason for delay. Close an action only after someone verifies the result, rather than relying solely on a vendor’s verbal assurance.

Document Incident Communications and Outcomes

Keep a chronological incident record containing discovery details, decisions, evidence references, vendor updates, containment actions, risk assessment findings, and remediation results. Preserve meeting notes and copies of relevant notifications in an approved, access-controlled location.

Document who was informed, when they were informed, what information was shared, and any follow-up commitments. Record the reasoning behind decisions about whether PHI may have been exposed and whether notifications are required, along with the evidence and assumptions considered.

In short, a strong response confirms the exposure, contains access, preserves evidence, assesses potential PHI impact, coordinates responsibilities, tracks verified remediation, and records the decisions and outcomes.

FAQs

What should a behavioral health organization do first after discovering a vendor shared-password breach?

Confirm which credential and systems may be affected, then coordinate immediate containment with the vendor. Disable or rotate the exposed password, revoke active sessions and related tokens, and preserve relevant evidence. Record the discovery time and promptly involve the organization’s security and privacy leads.

Which vendor logs should be preserved during incident response?

Preserve authentication and identity and access management logs, including successful and failed sign-ins, source IP addresses, device details, session activity, password resets, privilege changes, and access to connected applications. Also request relevant application audit logs, security alerts, configuration-change records, and support communications.

How can the organization determine whether protected health information was accessed?

Compare the compromised account’s permissions with application and audit logs to identify which records or systems it could reach and whether they were viewed, searched, exported, changed, or transmitted. Consider the scope and reliability of available evidence, document logging gaps, and have privacy, security, and legal leads assess the potential exposure and applicable obligations.

What incident details should be tracked through vendor remediation?

Track each action’s description, owner, due date, status, dependencies, completion evidence, and reviewer. Include credential rotation, session and access revocation, log preservation, data-impact assessment, security improvements, testing, vendor communications, and any decisions or notifications related to the incident.