Business Associate Breach Response Checklist for Donor Eligibility Databases

A donor eligibility database may contain sensitive health information, but it is not automatically subject to HIPAA just because it contains health-related data. HIPAA applies when the information is protected health information (PHI) handled by a covered entity or business associate in a regulated relationship. Confirm the database’s role, the data involved, and the applicable agreements before using this checklist. HHS guidance on business associates

How should a business associate notify the covered entity of a donor database breach?

Notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information. The 60-day limit is a federal maximum, not a recommended waiting period: check the business associate agreement (BAA), which may set a shorter reporting deadline or require an initial alert before the investigation is complete. HHS Breach Notification Rule guidance

For HIPAA purposes, discovery generally begins on the first day the breach is known—or would have been known through reasonable diligence—to the business associate. Do not wait until your team has identified every affected person or confirmed every technical detail before alerting the covered entity. Send an initial report with verified facts, label unknowns clearly, and provide updates as information becomes available. HHS audit protocol for the discovery standard

Include the affected individual identification available at the time of the report, along with the incident’s known nature, scope, dates, systems, and containment actions. HIPAA requires the business associate to provide the covered entity with other available information needed for individual notices at the time of the initial notification or promptly afterward as it becomes available. HHS audit protocol for business associate notification

• Use the incident contact and secure reporting channel specified in the BAA.
• Record when the business associate first knew, or reasonably should have known, of the incident.
• Identify which details are confirmed, estimated, or still under investigation.
• Set a schedule and owner for supplemental reports.

What steps contain the incident and preserve evidence?

Contain the threat while preserving information needed to understand what happened. HIPAA’s Security Rule requires business associates to identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and their outcomes. It does not prescribe one forensic procedure for every event, so coordinate technical actions with your security team and the covered entity. HHS guidance on security incident response

1. Assign an incident lead. Open a case record, confirm the response team, and use a secure channel for incident communications.
2. Limit further exposure. As appropriate, disable compromised accounts, revoke exposed credentials or tokens, restrict access, and isolate affected systems. Coordinate changes that could affect the covered entity’s services or evidence.
3. Preserve evidence. Secure relevant access and audit logs, alerts, database exports, system images, messages, and vendor records. Record collection times, sources, handlers, and any changes made during response.
4. Establish the incident timeline. Track when the activity began, when it was detected, when access was disabled, and when the organization first knew or reasonably should have known about the event.
5. Investigate the data involved. Determine which database tables, records, backups, or connected services may have been accessed, acquired, used, disclosed, altered, or made unavailable.
6. Mitigate and verify. Address the cause, monitor for continued access, and document actions taken to reduce the risk to the information and to affected people.

For a donor eligibility database, trace data flows beyond the main application: include exports, backups, support tools, subcontractors, and connected systems where relevant. Avoid deleting or overwriting potentially useful logs during cleanup unless necessary to contain an active threat; document emergency actions and why they were taken.

How do you assess breach risk and document the notification decision?

First determine whether the information involved is PHI and whether it was unsecured PHI under HIPAA. An impermissible use or disclosure of PHI is generally presumed to be a breach unless an applicable exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented breach risk assessment. HHS explanation of the breach presumption and exceptions

Assess and document at least these four factors:

1. Nature and extent of the PHI: Note the data elements involved, identifiers, and the likelihood that the information could be linked to an individual.
2. Who received or used the information: Identify the unauthorized person or recipient and, where possible, their relationship to the organization and ability to use or further disclose the data.
3. Whether the PHI was acquired or viewed: Examine relevant logs and other evidence, documenting what is known and what cannot be confirmed.
4. How the risk was mitigated: Record actions such as stopping access, retrieving or securing exposed information, or changing compromised credentials.

Consider the factors together and explain the reasoning behind the conclusion. If the assessment does not support a low probability of compromise, or the organization does not perform a risk assessment to establish that conclusion, proceed with the applicable breach notification process. HHS states that regulated entities must retain documentation sufficient to support the assessment and any decision about notification. HHS documentation guidance for breach assessments

Keep the assessment separate from the technical incident report: a confirmed security incident does not automatically resolve whether a HIPAA breach occurred, and the absence of proof that a person viewed data does not by itself answer every factor. Share the documented analysis with the covered entity so the parties can coordinate their determinations and notices.

What information should individual breach notifications include?

The covered entity is ultimately responsible for ensuring that required individual notices are provided, although it may delegate notice delivery to the business associate. Follow the BAA and the covered entity’s direction on who drafts, approves, and sends notices. HHS guidance on individual notification responsibility

To the extent possible, an individual notice should include:

• A brief description of what happened, including the breach date and discovery date when known.
• A description of the types of information involved.
• Steps the individual can take to protect themselves from potential harm.
• A brief description of the organization’s investigation, mitigation, and steps to prevent further breaches.
• Contact information for the covered entity or, as applicable, the business associate handling questions.

HIPAA requires individual notices without unreasonable delay and no later than 60 days after discovery of the breach. The required delivery method and any substitute notice depend on the circumstances, so coordinate with the covered entity and check the applicable rule requirements before sending. HHS requirements for individual notices

How should teams coordinate response roles and deadlines?

Set up a shared response plan that identifies a decision-maker, a point of contact for the covered entity, and owners for technical investigation, privacy review, legal review, affected individual identification, and communications. The BAA may specify reporting contacts and procedures; ensure the response team can reach them outside normal business hours if the agreement or incident plan requires it.

Use a notification deadline tracking log with the discovery date, applicable contractual deadline, federal deadline, responsible owner, status, and evidence of delivery. Track supplemental reports separately so unresolved affected individual identification or other missing details do not disappear from view.

• Business associate: Contain and investigate the incident, notify the covered entity as required, provide available affected individual identification, and send additional required information promptly as it becomes available.
• Covered entity: Coordinate the breach determination and handle required notices to individuals and regulators, unless notice delivery has been delegated.
• Both parties: Align on confirmed facts, response deadlines, communications, and how updates will be recorded.

HIPAA’s deadline for a business associate to notify the covered entity is no later than 60 calendar days after discovery, but a BAA may require earlier notice. The covered entity’s individual notice deadline is also generally no later than 60 days after discovery. Track the two obligations separately and apply any shorter contractual timeframe. HHS breach notification timelines

Which business associate agreement and legal requirements apply?

Confirm that the organization is acting as a business associate for the relevant database and that the records qualify as PHI in that relationship. A vendor does not become a HIPAA business associate merely by handling information described as health-related; its role and the services it performs for a covered entity matter. HHS business associate guidance

Review the BAA for permitted uses and disclosures, safeguards, reporting of impermissible uses or disclosures and security incidents, subcontractor requirements, and the parties’ breach-response responsibilities. HIPAA requires specified terms in business associate agreements, including appropriate safeguards and reporting obligations. The agreement can also establish operational details such as the reporting channel, format, contacts, and a deadline shorter than HIPAA’s 60-day maximum. HHS business associate agreement provisions

Check applicable federal and state requirements with qualified counsel, particularly if the database includes information or individuals subject to additional privacy or breach-notification rules. Do not assume HIPAA is the only applicable framework or that the BAA replaces other legal obligations.

Retain the incident timeline, investigation materials, risk assessment, decision rationale, mitigation records, notices, and proof of delivery. HIPAA requires documentation sufficient to support the breach determination and whether required notifications were made. For documentation required under the Security Rule, HHS describes a six-year retention period from creation or the date the document was last in effect, whichever is later; confirm which retention provisions apply to each record type. HHS Security Rule documentation requirements HHS breach documentation guidance

Summary: Confirm whether the donor database contains HIPAA-protected information, promptly alert the covered entity, contain the incident while preserving evidence, document the breach risk assessment, and track contractual and regulatory notice deadlines. Use the BAA to coordinate responsibilities, and retain records supporting both the response and the notification decision.

FAQs

How soon must a business associate notify the covered entity?

As soon as practicable, without unreasonable delay, and no later than 60 calendar days after discovery of a breach of unsecured PHI. The BAA may set a shorter deadline, so follow that deadline where applicable. HHS business associate notification requirements

What information should the initial breach report include?

Provide the known incident facts, the affected individual identification available so far, the types of information involved, relevant dates, the scope of suspected access or disclosure, and containment steps. Clearly label unknowns and send the other available information needed for individual notices at the time of the report or promptly as it becomes available. HHS audit protocol for business associate reports

When is notification to affected individuals required?

When a breach of unsecured PHI requires notification under the HIPAA Breach Notification Rule, the covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovery. The covered entity may delegate notice delivery to the business associate, but remains ultimately responsible for ensuring required notices are provided. HHS individual notification requirements

What breach records should the business associate retain?

Keep the discovery and response timeline, incident and forensic evidence, affected individual identification, communications with the covered entity, containment and mitigation records, the breach risk assessment and decision, copies of notices or delivery evidence when applicable, and relevant BAA terms. Retain documentation required under the applicable HIPAA rules for the required period; Security Rule documentation is generally subject to a six-year retention period. HHS Security Rule documentation requirements HHS breach documentation guidance