Business Associate Breach Response Checklist for Family Resource Portals

A family resource portal may handle names, contact details, appointment information, or other sensitive data. HIPAA breach-notification requirements apply when the information is protected health information (PHI) and the portal operator is acting as a business associate for a covered entity—not merely because a portal contains sensitive information. Check your role and responsibilities in the HHS guidance on business associates and your business associate agreement (BAA).

What should a business associate do immediately after discovering a breach?

Act promptly to contain the incident, protect PHI from further access or disclosure, preserve evidence, and notify the covered entity under the BAA. HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require a shorter deadline. Do not wait for a complete forensic investigation before giving an initial notice. You can provide additional details as they become available. See 45 CFR § 164.410 and HHS guidance on reporting security incidents.

• Activate your incident-response plan and assign an incident lead.
• Disable compromised accounts or access paths, contain affected systems, and take reasonable steps to prevent additional disclosure.
• Preserve relevant system, access, and audit logs, along with copies of alerts, messages, and other evidence. Avoid changes that could overwrite evidence.
• Notify the covered entity through the contact and process specified in the BAA. Report other security incidents as required by the agreement, even if they have not yet been determined to be a breach of unsecured PHI.
• Track what is known, what remains under investigation, and when each response action occurs.

How should a family resource portal assess whether PHI was compromised?

First establish what information was involved, whether it was PHI, and whether the portal was acting on behalf of a covered entity. If an impermissible use or disclosure of unsecured protected health information occurred, it is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a HIPAA breach risk assessment. HHS identifies four factors to consider:

• The nature and extent of the PHI, including the types of identifiers and the likelihood that the information could identify a person.
• The person who used the PHI or received the disclosure, including whether that person had an obligation to protect it.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk to the PHI was mitigated.

Document the evidence and reasoning for each factor. Consider the portal’s access records, the information displayed or downloaded, the recipient’s assurances and actions, and whether effective mitigation occurred. The HHS Breach Notification Rule guidance also describes limited exceptions to the definition of breach; assess whether an exception applies rather than assuming that an incident is exempt.

What information must the business associate provide to the covered entity?

To the extent possible, identify each person whose unsecured PHI was or is reasonably believed to have been accessed, acquired, used, or disclosed. Provide other available information the covered entity needs for its individual notification at the time of the initial notice or promptly as it becomes available. These requirements are in 45 CFR § 164.410(c).

To help the covered entity assess the incident and prepare any required covered entity breach notification, send a clear incident summary that includes, where available:

• When the incident happened, when it was discovered, and how it was detected.
• The types of unsecured PHI involved, such as names, contact information, account details, or health-related information.
• The affected individuals and the basis for identifying them, noting any uncertainty or ongoing review.
• What happened, which systems or portal functions were involved, and whether information was accessed, acquired, viewed, or disclosed.
• Actions taken to contain the incident, mitigate harm, and prevent recurrence.
• A contact for follow-up and a schedule for providing additional findings.

The covered entity’s individual notice has required content, including a description of what happened, the types of information involved, steps individuals can take, mitigation actions, and contact procedures. Use the requirements in 45 CFR § 164.404 to help coordinate accurate information.

What are the notification deadlines and reporting thresholds?

The business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. That is an outside limit, not a target; the BAA may set a shorter reporting period. The 60-day deadline for the business associate’s notice is separate from the covered entity’s deadlines for notices to individuals, HHS, and, when applicable, the media. See 45 CFR § 164.410.

For HHS Office for Civil Rights reporting, the covered entity generally must report breaches affecting 500 or more individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, the covered entity may report on an annual basis, no later than 60 days after the end of the calendar year in which the breaches were discovered. A business associate may submit an HHS report on a covered entity’s behalf if the parties arrange for that responsibility. See 45 CFR § 164.408 and HHS instructions for reporting breaches to the Secretary.

When are individual and media notifications required?

For a breach of unsecured PHI, the covered entity is responsible for notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The covered entity remains ultimately responsible when a breach occurs at or through its business associate, but it may delegate notice tasks to the business associate. Confirm the assignment, approval process, and timing in the BAA before contacting individuals. The required individual-notice content is described in 45 CFR § 164.404.

A covered entity must also provide notice to prominent media outlets serving a state or jurisdiction when a breach affects more than 500 residents of that state or jurisdiction. This media threshold is based on residents in a particular state or jurisdiction; the HHS reporting threshold is based on the total number of individuals affected. See 45 CFR § 164.406. If a covered entity has insufficient or out-of-date contact information for affected people, substitute-notice rules may apply as described in the HHS Breach Notification Rule guidance.

How can encryption or destruction affect breach notification duties?

The Breach Notification Rule applies to unsecured PHI. PHI encrypted in accordance with HHS guidance may be considered unusable, unreadable, or indecipherable to unauthorized people, provided the confidential process or key needed to decrypt it has not also been compromised. Likewise, PHI properly destroyed under the applicable guidance may not be unsecured PHI. In those circumstances, breach notification under HIPAA may not be required for that information, but document how you reached that conclusion and check whether other exposed data or keys change the assessment. Review the HHS guidance on encryption and destruction.

Encryption alone does not settle every incident. Confirm that the encryption method meets HHS guidance, determine whether the key or credentials were exposed, and assess whether any unencrypted copies, exports, or backups were involved. If the data does not qualify as secured under the guidance, assess the incident as a possible breach of unsecured protected health information.

What records should be retained to document the response?

Keep a breach response file that supports the investigation, the decisions made, and the information reported to the covered entity. Include the incident timeline, system and access evidence, the PHI and individuals involved, the HIPAA breach risk assessment, containment and mitigation actions, communications with the covered entity, and copies of any notices or the documented basis for concluding that notice was not required.

HIPAA places the burden on the covered entity or business associate, as applicable, to demonstrate that required notifications were made or that the use or disclosure did not constitute a breach. Required Security Rule documentation must be retained for six years from its creation or the date it was last in effect, whichever is later. Apply the retention rules that govern each record, and also check the BAA, organizational policy, and other applicable legal requirements. See 45 CFR § 164.414 and 45 CFR § 164.316.

A sound response links prompt containment and covered-entity notice with a documented assessment, accurate reporting information, and retained evidence. Use your BAA to clarify who handles each notice and the deadlines that apply to your portal.

FAQs.

When does the 60-day breach notification clock begin?

For a business associate, the clock begins on the first day the breach is known or would have been known through reasonable diligence. Knowledge held by an employee, officer, or other agent generally counts, except for the person committing the breach. Notify the covered entity without unreasonable delay; do not wait until day 60 or until the investigation is complete. See 45 CFR § 164.410.

What details should a business associate send to the covered entity?

Send the identities of affected or reasonably believed-to-be-affected individuals to the extent possible, plus available information the covered entity needs for individual notice. Include known dates, types of unsecured PHI, what happened, the systems involved, whether the information was accessed or viewed, mitigation steps, and a contact for follow-up. Provide remaining required details promptly as they become available.

Who notifies affected individuals after a family resource portal breach?

The covered entity is ultimately responsible for ensuring affected individuals are notified. It may delegate the notice task to the business associate, so check the BAA and coordinate the content, timing, and delivery method with the covered entity before notices are sent. The HHS Breach Notification Rule guidance explains this allocation.

When must a breach be reported to HHS?

The covered entity must report a breach of unsecured PHI affecting 500 or more individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, the covered entity reports them no later than 60 days after the end of the calendar year in which they were discovered. A business associate may submit the report on the covered entity’s behalf if that responsibility has been arranged. See HHS reporting instructions.