Incident Response Checklist for Suspected Former Employee Theft of a Neonatal Eye Image Archive

A suspected theft of neonatal eye images calls for a coordinated response that protects patient care, preserves reliable evidence, and supports a careful privacy assessment. Treat the report as a security incident to investigate—not as proof that images were taken or that a reportable breach occurred.

How should the incident response team be activated and coordinated?

Activate your organization’s security incident response procedures promptly. HIPAA requires covered entities and business associates to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes. See 45 C.F.R. § 164.308(a)(6).

• Name an incident lead who coordinates decisions, assigns tasks, maintains a timeline, and records key actions and approvals.
• Bring together the right functions: information security, IT, privacy, legal, human resources, clinical leadership for neonatal and ophthalmology services, and records or imaging-system administrators. Include relevant vendors or business associates through established contacts.
• Set a controlled reporting channel for staff and responders. Limit incident details and patient information to people who need them for response.
• Establish what is known and unknown: when the concern arose, which archive and accounts may be involved, whether the former employee had access after separation, and whether care or system availability is at risk.
• Keep an incident record of reports, decisions, containment steps, evidence sources, and open questions. Separate confirmed facts from hypotheses.

Ask legal and privacy leadership to coordinate any law-enforcement contact or employment-related inquiry. Use established organizational procedures and avoid speculative statements about the former employee or the scope of exposure.

What evidence should be preserved and how should chain of custody be documented?

Preserve evidence as early as practicable, while coordinating with clinical and technical teams so preservation does not interrupt necessary care. HIPAA requires security incident documentation and audit controls for systems containing electronic protected health information (ePHI); it does not prescribe a single forensic chain-of-custody format. A consistent, documented process helps show what was collected, by whom, and whether it changed.

• Preserve relevant records: archive and PACS audit logs, identity and access management records, authentication events, remote-access and VPN logs, email and cloud-storage activity, endpoint alerts, export and download records, and relevant badge-access records.
• Protect logs from routine deletion or alteration. Record the system, time range, time zone, collection method, and person who collected each item. Preserve original records where feasible and work from verified copies.
• Document evidence handling: assign each item a unique identifier; record who collected, accessed, transferred, or stored it and when; use secure, access-restricted storage; and document any gaps or changes.
• Use forensic safeguards where appropriate. Trained personnel can create forensic copies, calculate cryptographic hashes to help verify that copies have not changed, and record tools and procedures used.
• Preserve potentially relevant devices or accounts through authorized processes, taking care not to wipe, reimage, or alter them before necessary evidence has been secured.

Keep evidence containing PHI limited to authorized responders and handle it through approved secure systems. The HIPAA Security Rule requires mechanisms to record and examine activity in information systems that contain or use ePHI; see 45 C.F.R. § 164.312(b).

How can access be contained without disrupting neonatal care?

Contain access in a targeted way, coordinating security changes with clinical leaders and system owners. HIPAA’s workforce-security provisions address terminating ePHI access when employment ends, while the Security Rule also includes emergency-access and contingency-planning provisions. See 45 C.F.R. § 164.308(a)(3)(ii)(C), (a)(7) and 45 C.F.R. § 164.312(a)(2)(ii).

• Revoke the former employee’s access: disable accounts and sessions, revoke active tokens and credentials, and check remote access, email, cloud services, mobile access, archive accounts, and other connected systems. Coordinate with vendors where access is managed externally.
• Preserve evidence while containing risk. Where it is safe to do so, capture relevant logs and document account and session details before changes. If access is ongoing or patient information is at immediate risk, prioritize containment while recording the steps taken.
• Use role-based alternatives for current staff. Confirm authorized clinicians and imaging staff retain the access they need, and grant emergency access only through approved, documented procedures.
• Follow clinical downtime procedures if the archive or a related system becomes unavailable. Identify approved clinical alternatives and escalation contacts before disabling shared systems or devices.
• Monitor for continued access or unexpected account activity after containment, and verify that credentials, integrations, and sessions linked to the former employee are no longer active.

Do not disable an entire archive or shared service by default if doing so could delay care. Coordinate each change with the responsible clinical and technical leads, and document any temporary access granted to maintain services.

How can investigators determine which images and records were accessed or copied?

Build a timeline from multiple sources rather than relying on a single log. The HIPAA Security Rule requires regular review of information-system activity, including audit logs, access reports, and security incident tracking reports. See 45 C.F.R. § 164.308(a)(1)(ii)(D).

• Identify the possible access window. Compare the employee’s separation date and account status with login, session, badge, remote-access, and archive records.
• Review archive activity for image searches, record opens, previews, exports, downloads, printing, sharing, bulk queries, and changes to files or permissions. Determine which actions each system’s logs actually record.
• Check for copies or transfers by reviewing authorized endpoint, email, removable-media, cloud, network, and data-loss-prevention records where available.
• Correlate timestamps and identities across systems, noting time-zone differences, shared workstations, service accounts, incomplete logs, and retention limits.
• Map affected records carefully. Match image identifiers to patient records in an access-controlled environment, then document the number of distinct individuals and the information involved.

A log showing that a record was opened does not, by itself, prove that an image was copied or viewed in detail. Conversely, missing or incomplete logs do not prove that no access occurred. State what the evidence establishes, what it cannot establish, and any uncertainty that remains.

How should potential PHI exposure and patient privacy impact be assessed?

Determine whether the images or accompanying records are identifiable health information held or transmitted by a HIPAA covered entity or business associate. Health information is PHI when it relates to a person’s health, care, or payment and identifies the person—or there is a reasonable basis to believe it could identify them. See HHS’s Summary of the HIPAA Privacy Rule.

Do not assume that every neonatal eye image is automatically identifiable, or that an image is anonymous because it lacks a visible name. Review the image and associated data—including filenames, medical record numbers, dates, metadata, linked records, and surrounding context—to determine whether an individual could reasonably be identified. HHS’s de-identification guidance lists full-face photographic images and comparable images among Safe Harbor identifiers; whether a particular eye image meets that description depends on the image and facts. See HHS guidance on de-identification of PHI.

For an impermissible use or disclosure of unsecured PHI, a breach is generally presumed unless an applicable exception applies or the organization demonstrates a low probability that the PHI was compromised through a documented breach risk assessment. Consider the four required factors:

• Nature and extent of the information: what identifiers and clinical details were involved, and how readily could the infant or family be identified?
• Who received or accessed it: what was the former employee’s access and likely ability to retain, use, or disclose the information?
• Whether it was actually acquired or viewed: what do access, export, device, and transfer records establish—and what evidence is missing?
• How risk was mitigated: were access and sharing stopped, copies recovered or deleted where verifiable, and further exposure reduced?

Document the evidence, analysis, assumptions, and conclusion. Properly encrypted information may not be “unsecured PHI” if it meets HHS’s applicable guidance and the encryption key was not compromised; assess the actual encryption and key circumstances rather than assuming encryption settles the question. See HHS’s Breach Notification Rule guidance and its guidance on securing PHI.

What breach notification duties and deadlines may apply?

Notification duties depend on whether the investigation establishes a breach of unsecured PHI and which entity is responsible. Under HIPAA, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. See 45 C.F.R. § 164.404.

• Individuals: a covered entity’s notice must be sent without unreasonable delay and within 60 calendar days after discovery. The notice must describe the breach and information involved, steps individuals can take, the organization’s response, and contact details.
• HHS: for a breach affecting 500 or more individuals, notify the HHS Secretary without unreasonable delay and within 60 calendar days. For fewer than 500 individuals, report to HHS no later than 60 days after the end of the calendar year in which the breach was discovered. See 45 C.F.R. § 164.408.
• Media: a covered entity must notify prominent media outlets serving a state or jurisdiction when a breach affects more than 500 residents of that state or jurisdiction. The deadline is without unreasonable delay and no later than 60 calendar days after discovery. See 45 C.F.R. § 164.406.
• Business associates: a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery; the business associate agreement may require earlier notice. See 45 C.F.R. § 164.410.

A report of suspected theft is not by itself a final breach determination. At the same time, do not wait for every forensic question to be resolved before involving privacy and legal leadership in deadline tracking and notification planning. HIPAA is not the only possible source of obligations; ask counsel to assess any applicable state law, contracts, and other requirements. HHS summarizes the HIPAA deadlines and responsibilities in its Breach Notification Rule guidance.

How should affected systems be recovered and response gaps reviewed?

Restore services in a controlled way after the team has contained unauthorized access and verified that systems, data, and permissions are safe to use. HIPAA contingency-planning provisions address retrievable copies of ePHI, data restoration, and continuation of critical business processes during emergency operations. See 45 C.F.R. § 164.308(a)(7).

• Verify archive integrity and compare restored data with trusted records or backups before returning systems to normal operation.
• Restore necessary access using named accounts and appropriate permissions. Confirm the former employee’s access remains revoked and review other accounts with similar access.
• Continue clinical safeguards until clinical leaders confirm the archive and related workflows are safe and available for neonatal care.
• Review the response to identify gaps in access deprovisioning, logging, monitoring, retention, evidence collection, vendor coordination, and clinical downtime procedures.
• Assign corrective actions with owners and completion dates, then update procedures and brief relevant teams as appropriate.

In summary, coordinate security, privacy, legal, IT, and clinical response; preserve evidence with a documented forensic chain of custody; contain access without interrupting neonatal care; assess the affected records and breach notification deadlines; and restore systems only after integrity and access have been reviewed.

FAQs

What evidence should be preserved when a former employee may have taken neonatal eye images?

Preserve archive and PACS audit logs, account and authentication records, export and download activity, relevant endpoint and cloud records, and any other evidence tied to the suspected access window. Document where each item came from, when and how it was collected, who handled it, and how it was stored. Use qualified forensic personnel where needed, and keep evidence containing PHI in approved secure systems.

How can investigators determine whether the archive contained protected health information?

Review whether the images or related information connect an infant to health, care, or payment information and whether the infant could reasonably be identified. Check image content, filenames, metadata, medical record numbers, dates, and linked records. An image without a visible name may still be identifiable through its metadata or context; an image does not automatically qualify as PHI solely because it depicts an eye.

When must affected individuals or regulators be notified of a potential breach?

HIPAA notification duties generally apply after a breach of unsecured PHI is determined, subject to the rule’s exceptions and risk assessment. Covered entities generally notify affected individuals without unreasonable delay and within 60 calendar days of discovery; HHS reporting deadlines vary by the number affected, and media notice may apply when more than 500 residents of a state or jurisdiction are affected. Involve privacy and legal leadership promptly to assess the facts and track deadlines.

How can access be contained while keeping neonatal clinical services available?

Revoke the former employee’s accounts, sessions, tokens, and remote access while coordinating changes with clinical leaders and system owners. Preserve relevant evidence where practicable, maintain access for authorized clinicians, and use approved emergency-access and clinical downtime procedures if a system must be restricted. Monitor for continued access and document any temporary measures.