How to Respond to a Shared Password Breach in a Thoracic Tumor Board Database

How do you contain a shared password breach immediately?

Treat a shared password that may expose a thoracic tumor board database as a security incident. Act promptly to stop further access while preserving the records and system availability needed for patient care.

• Notify your organization’s security incident response team, privacy officer, and designated security official. Follow your incident response plan and applicable internal escalation procedures.
• Disable or change the shared password, revoke active sessions and tokens associated with it, and review whether the same credential was reused for other accounts or systems. Avoid making changes that could destroy evidence.
• Preserve relevant authentication, audit, database, and network logs. Record when the credential was disabled and what containment steps were taken.
• Restrict access to the database to authorized users with individual accounts. Restore access through an approved secure method so containment does not unnecessarily interrupt clinical operations.
• Tell staff not to delete messages, files, or other evidence related to the incident, and not to investigate by accessing patient records outside their authorized role.

HIPAA’s Security Rule requires covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects when practicable, and document incidents and their outcomes. See the HHS guidance on security incident procedures.

What should the incident response team investigate and document?

Establish a clear timeline, beginning with when the shared password was created or changed and when the organization first knew—or, through reasonable diligence, should have known—about the possible exposure. The discovery date can affect notification deadlines, so document the basis for it.

Investigate how the password was exposed, who could use it, and whether anyone actually accessed the database. Review available records for sign-ins, failed attempts, session duration, searches, downloads, exports, edits, and access from unfamiliar devices or locations. Because users shared a credential, logs may not reliably identify the individual who used it; record that limitation rather than treating an account label as proof of a person’s identity.

Determine which patients’ information could have been viewed or obtained and what types of information were present. Thoracic tumor board records may include names and other identifiers along with diagnoses, imaging, pathology, treatment plans, or other clinical details. Document the database, records and date range involved, the information’s security protections, and whether copies or exports may exist.

Keep a contemporaneous incident file with the reports received, investigation steps, relevant log references, interviews, containment actions, mitigation, decisions, and supporting reasons. Limit the file to information needed for the response and handle it according to organizational policy. HIPAA requires regulated entities to respond to and document security incidents; see the HHS Security Rule guidance.

How do you determine whether the incident is a reportable HIPAA breach?

A shared password creates a security risk, but the password-sharing fact alone does not establish that a reportable breach of unsecured protected health information occurred. Determine whether there was an impermissible use or disclosure of PHI and whether the information was unsecured under the HIPAA Breach Notification Rule. Apply the organization’s incident procedures and involve its privacy officer or counsel as appropriate.

Generally, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment. The assessment must consider at least four factors:

• The nature and extent of the PHI, including identifiers and the likelihood of re-identification.
• The unauthorized person who used or received the PHI.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk to the PHI was mitigated.

The rule also contains limited exceptions, including certain good-faith, within-authority workforce access that does not result in further impermissible use or disclosure. Do not assume an exception applies merely because the password belonged to a staff member or because investigators have not yet confirmed which person used it. Consult the HHS Breach Notification Rule guidance and the definition of breach in 45 CFR § 164.402.

What notification deadlines apply to affected individuals and HHS?

If the incident is a breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notice must describe the breach and the types of information involved, explain steps individuals can take to protect themselves, summarize the organization’s response, and provide contact information. See HHS guidance on individual breach notification.

For breaches affecting 500 or more individuals, the covered entity must notify the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery. If a breach affects fewer than 500 individuals, the covered entity must keep the required record and notify the Secretary no later than 60 days after the end of the calendar year in which it discovered the breach. It may report sooner. The HHS breach-reporting instructions explain the reporting process.

A covered entity must also provide notice to prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. That notice is subject to the same outside 60-day deadline. These are federal HIPAA requirements; state law, contracts, or organizational policy may impose additional or earlier obligations. Keep the incident’s discovery date and affected-person count under review as the investigation develops.

What must a business associate report to the covered entity?

If a business associate discovers a breach of unsecured PHI at or by the business associate, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The business associate should identify affected individuals, to the extent possible, and provide the information the covered entity needs to make required notices. The HHS Breach Notification Rule guidance describes this business associate breach notification requirement.

Do not treat 60 days as an appropriate internal target or assume it overrides a faster contractual deadline. Review the business associate agreement for the required reporting process, information to provide, and any shorter deadline. The Security Rule’s business associate contract provisions also address reporting security incidents, which can require reporting under the agreement even when the incident has not yet been determined to be a reportable breach. See HHS guidance on business associates.

What are the limits of a breach risk assessment?

A HIPAA breach risk assessment is a documented way to evaluate whether an impermissible use or disclosure of unsecured PHI presents a low probability that the PHI was compromised. It is not a substitute for containment, security incident documentation, or required notices, and it cannot make uncertain facts certain.

For example, shared credentials may make it difficult to identify the person who accessed the database. Missing or incomplete logs may also prevent investigators from establishing whether records were viewed or downloaded. Describe those uncertainties, explain how they affect each required factor, and avoid treating “no evidence of access” as proof that access did not occur.

The assessment must consider all four regulatory factors, not just whether investigators found evidence of viewing or whether the password was promptly changed. Record the evidence, mitigation, conclusions, and reasons. If the organization cannot demonstrate a low probability of compromise and no exception applies, the impermissible use or disclosure is presumed to be a breach under the rule. The HHS guidance on breach determinations explains this presumption and assessment.

In short, contain access, preserve evidence, investigate and document what happened, and make a supported breach determination. If notification is required, track the discovery date, affected-person count, and applicable contractual and legal deadlines.

FAQs.

When does the 60-day notification period begin?

For covered-entity notice to affected individuals and the HHS Secretary, the outside 60-calendar-day period generally begins when the breach is discovered—not necessarily when the unauthorized access began. Discovery occurs when the organization knows, or by exercising reasonable diligence would have known, of the breach. Document the discovery date and the facts supporting it. See the HHS Breach Notification Rule guidance.

Must every impermissible disclosure of PHI be reported as a breach?

No. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach, but the covered entity or business associate may demonstrate a low probability that the PHI was compromised based on the required risk assessment. The rule also provides limited exceptions. A documented determination is important; do not assume an incident is exempt simply because the information was not found to have been misused.

How quickly must a business associate notify a covered entity?

A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. The business associate agreement may require faster reporting, and the business associate should follow that contractual deadline. See the HHS guidance on business associate breach notification.

When are breaches affecting fewer than 500 people reported to HHS?

The covered entity must report each breach to HHS no later than 60 days after the end of the calendar year in which it discovered the breach. It may submit the report earlier and must maintain a log or other required documentation. See HHS instructions for reporting breaches affecting fewer than 500 individuals.