How to Respond to a Business Associate Breach in an Online Dermatology Service

A breach involving an online dermatology service can expose sensitive information such as patient names, contact details, diagnoses, prescriptions, appointment records, or clinical photographs. If your organization is a business associate, respond quickly: protect the information, preserve evidence, and notify the covered entity so the parties can meet their obligations under the HIPAA Breach Notification Rule.

Assess and Document the Breach

Start by activating your incident-response process and identifying a lead to coordinate security, privacy, legal, and operational work. Treat a suspected exposure seriously while you determine whether it involved protected health information (PHI) and whether that information was unsecured.

Unsecured protected health information is PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized people using a method recognized by HHS. For an online dermatology service, the affected data could include patient portal messages, skin images, intake forms, payment-related records, or prescription information.

Establish the breach discovery date promptly. Under HIPAA, discovery generally begins when the incident is known—or would have been known through reasonable diligence—to the organization. Do not wait for a full investigation to finish before notifying the covered entity or calculating applicable deadlines.

Maintain a factual incident record, including:

• When the incident occurred, when it was detected, and when it was escalated.
• Which systems, accounts, devices, or vendors were involved.
• The types of PHI at risk and the people who may be affected.
• Who accessed, received, or could have accessed the information.
• Actions taken to contain the incident and preserve evidence.

Assess whether the event meets the definition of a breach and document the reasoning. HIPAA generally presumes an impermissible use or disclosure of unsecured PHI is a breach unless an exception applies or a risk assessment shows a low probability that the PHI was compromised.

Contain Access and Mitigate Harm

Take immediate steps to stop ongoing exposure without destroying evidence. Depending on the incident, this may mean disabling compromised accounts, revoking exposed credentials or access tokens, isolating an affected system, correcting a misconfigured storage location, or suspending a risky data transfer.

Preserve relevant audit logs, system images, access records, messages, and vendor documentation. Record what was changed and when. Coordinate with the covered entity before taking steps that could interrupt patient care, remove needed records, or complicate a shared investigation.

Work with the covered entity to understand potential risks to patients and reduce further harm. For example, if portal accounts or contact details were exposed, review whether unauthorized access is continuing and whether patients may need practical protective steps. Keep the response focused on the specific data and threat; do not make promises about the outcome before the facts are established.

Meet Business Associate Notification Duties

If a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after the breach discovery date. The business associate agreement (BAA) may require a shorter deadline or additional details, so follow the stricter applicable requirement.

Send the initial covered entity notification as soon as you have enough information to alert the organization and support its response. Do not postpone notice until every affected person or data element has been identified. Provide available facts, clearly label what remains unconfirmed, and send updates as the investigation develops.

To support the covered entity notification, provide, to the extent available:

• A description of what happened, including the incident date and discovery date.
• The types of unsecured PHI involved and the systems or services affected.
• The individuals known or reasonably believed to be affected.
• Steps already taken to contain the incident and mitigate harm.
• Information the covered entity may need for individual notices and regulatory reporting.

Check the BAA for required reporting channels, contacts, cooperation duties, and whether the business associate has been assigned any notice or reporting tasks. The covered entity generally retains responsibility for required notices, but the agreement may delegate specific work to the business associate.

Notify Affected Individuals

The covered entity is generally responsible for notifying affected individuals, though it may delegate delivery to the business associate through the BAA. Confirm who will prepare, approve, and send notices before contacting patients. Use the covered entity’s instructions and coordinate communications so people receive clear and consistent information.

Individual notices must be provided without unreasonable delay and no later than 60 calendar days after discovery. They should explain, to the extent possible, what happened; the types of information involved; steps individuals can take to protect themselves; what the organization is doing to investigate, mitigate harm, and prevent further breaches; and how individuals can ask questions or obtain more information.

For an online dermatology service, explain affected information in plain language. If clinical images, treatment details, or prescription records were involved, describe those categories accurately without revealing additional patient information in the notice itself. Follow the required delivery method and the covered entity’s process for handling outdated or incomplete contact information.

Report to Government and Media

The covered entity must submit HHS breach reporting for breaches of unsecured PHI. A business associate may submit a report on the covered entity’s behalf when authorized, but the parties should confirm who is responsible and retain evidence that the report was submitted.

For a breach affecting 500 or more individuals, the covered entity must notify HHS without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, the covered entity may report on an annual basis, no later than 60 days after the end of the calendar year in which the breach was discovered.

The 500-person media notification threshold is different: media notice is generally required when a breach affects more than 500 residents of a single state or jurisdiction. The covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 calendar days after discovery. Coordinate with the covered entity to confirm the count, affected locations, and which organization will handle any delegated reporting tasks.

Prevent Recurrence in Online Dermatology Services

After immediate response and notification work is underway, identify the technical or operational weakness that allowed the incident. Review access logs, permissions, authentication controls, vendor processes, data flows, and system configuration. Document corrective actions, assign owners, and track each item through completion.

Strengthen safeguards appropriate to the service and the PHI it handles. Measures may include limiting workforce access to the minimum necessary, using strong authentication, encrypting information, reviewing audit logs, patching systems, testing backups, and securing image uploads and patient messaging. Train staff to recognize suspicious activity and report suspected incidents promptly.

Review the business associate agreement with the covered entity and relevant subcontractors. Make sure it sets clear incident contacts, notification timelines, required investigation details, cooperation expectations, and responsibilities for individual, HHS, and media notices. Test the response plan with realistic scenarios, such as a compromised teledermatology account or an exposed collection of patient images.

In summary: document the incident and discovery date, contain access, promptly notify the covered entity, and coordinate any individual, HHS, or media notices required by HIPAA. Use the investigation to strengthen safeguards and clarify responsibilities across the online dermatology service’s vendor relationships.

FAQs

When must a business associate notify a covered entity of a breach?

A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. The business associate agreement may set a shorter deadline, so follow that requirement when it applies.

What information should an individual breach notification include?

To the extent possible, the notice should describe what happened, the types of information involved, steps individuals can take to protect themselves, what the organization is doing to investigate and mitigate harm and prevent further breaches, and contact information for questions or additional information.

When must a breach be reported to HHS?

The covered entity must report a breach affecting 500 or more individuals without unreasonable delay and no later than 60 calendar days after discovery. For fewer than 500 individuals, the covered entity may report annually, no later than 60 days after the end of the calendar year in which the breach was discovered. A business associate may submit the report on the covered entity’s behalf when authorized.

When is media notification required for a breach?

Media notification is generally required when a breach affects more than 500 residents of a single state or jurisdiction. The covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 calendar days after discovery.