Incident Response Guide for a Misdirected Email at a Clinical Boarding School Program

What to do immediately after a misdirected email

Report the mistake as soon as you discover it. Contact the school or program’s privacy officer and information security lead through the approved incident-reporting channel; follow any internal escalation policy, and involve the clinical director when student care or safety may be affected.

Share the facts needed to start an investigation: when the message was sent, the intended and actual recipients, the subject line, whether it contained an attachment, and what types of student information may be involved. Avoid copying student health details into a new message or forwarding the original broadly.

If policy allows, ask the unintended recipient not to open, save, forward, or otherwise use the message, and to delete it and confirm deletion. Have the privacy or security team manage that contact where possible. A recall request does not establish that the message was removed from every inbox or device, so do not treat recall as proof of containment.

If the email may put a student at immediate risk—for example, because it reveals a sensitive location or safety plan—escalate promptly to the designated safeguarding or clinical lead. Share only the information needed to address the immediate risk.

How to contain the email and preserve evidence

Work with IT and the privacy officer to limit further access. Depending on the email system and incident, the response may include recalling or quarantining the message, disabling a sharing link, restricting access to a mailbox or attachment, or asking the recipient to remove local copies. Record what was attempted and what the recipient or system confirmed.

Preserve the original message in its original format, such as an .eml file, with full headers where available. Also retain relevant delivery, access, and audit logs; the message and attachment names; the recipient list; timestamps; recall or quarantine results; and communications about deletion or further disclosure. Keep evidence in an approved, access-controlled location and avoid altering the original.

Document a concise timeline of discovery, reporting, containment actions, people involved, and decisions. Limit access to staff who need it to investigate or respond. If student education records are involved, check whether a disclosure record is required under FERPA’s recordkeeping regulation, 34 CFR § 99.32.

How to assess exposed student health information

Conduct an unauthorized disclosure assessment based on the evidence, rather than assuming that every misdirected email has the same level of risk. Identify each affected student and the information exposed, such as diagnoses, medications, therapy notes, treatment plans, insurance details, contact information, or identifiers that could connect a student with a clinical program.

Determine who received the email, whether the address belonged to the intended person, whether the message or attachment was opened, downloaded, saved, or forwarded, and whether the recipient can be reached and confirms deletion. Consider the recipient’s relationship to the school, any confidentiality obligations, the likelihood of further use or disclosure, and whether the data was effectively encrypted or otherwise inaccessible.

For a HIPAA-regulated organization, an impermissible use or disclosure of unsecured protected health information is generally presumed to be a breach unless the covered entity or business associate documents a low probability that the information was compromised using the required risk assessment. HHS identifies the nature and extent of the information, the unauthorized recipient, whether the information was actually acquired or viewed, and mitigation as factors in that assessment. See HHS guidance on the HIPAA Breach Notification Rule.

Record the assessment, supporting facts, uncertainties, mitigation steps, and rationale for the decision. Escalate questions about sensitive clinical details, a student’s age, or the possibility of harm to the privacy officer and qualified legal counsel.

When FERPA or HIPAA may apply

Do not assume that a boarding school’s clinical program is governed by HIPAA simply because it provides health services, or that FERPA applies to every private school. FERPA generally applies to educational agencies and institutions that receive funds under a program administered by the U.S. Department of Education; private elementary and secondary schools generally do not receive those funds and are usually not subject to FERPA. Confirm the school’s funding and any public-agency placement or service arrangements. The Department of Education explains FERPA’s coverage in its guidance on which educational agencies and institutions FERPA applies to.

Where FERPA applies, health records directly related to a student and maintained by the school, or by a party acting for the school, may be FERPA education records. Those records generally are excluded from HIPAA’s definition of protected health information. The details of who maintains the records and on whose behalf matter; use the joint HHS and Department of Education guidance on FERPA and HIPAA to assess the arrangement.

HIPAA may apply to a separate health care provider that is not acting on behalf of a FERPA-covered school if the provider is a HIPAA covered entity—for example, if it conducts certain covered electronic health care transactions. A provider acting on behalf of the school may instead maintain FERPA education records, even when it is an outside contractor. See HHS guidance on HIPAA and school health records.

Because a clinical boarding school program can involve more than one organization, identify who controls each record, who sent the email, and whose system or workforce was involved. State privacy and breach-notification laws, contracts, school policies, and other requirements may also apply.

What notification and documentation steps are required

Have the privacy officer determine which rules apply before deciding whom to notify. Under FERPA, there is no general federal requirement to notify a parent or eligible student solely because an unauthorized disclosure occurred, although the school may have other obligations under state law, contract, policy, or the circumstances of the incident. FERPA’s recordkeeping requirements and any applicable exceptions should be reviewed separately.

For a HIPAA covered entity or business associate, assess whether the incident is a breach of unsecured protected health information under the Breach Notification Rule. If notification is required, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery. A covered entity must also notify HHS; for breaches affecting fewer than 500 individuals, HHS reporting may be made annually, no later than 60 days after the end of the calendar year in which the breach was discovered. Additional media notice may be required for breaches affecting 500 or more residents of a state or jurisdiction. See HHS’s breach notification requirements.

A business associate must notify the covered entity of a breach in accordance with HIPAA and the parties’ agreement. Coordinate responsibilities and deadlines with the covered entity; do not assume that an email to the school alone satisfies all required notices.

Keep a record of the incident, assessment, legal and policy analysis, containment and mitigation, notification decisions, and any notices sent. If notification is required, prepare a clear account of what happened, the categories of information involved, steps taken to reduce harm, actions affected people can take if relevant, and a contact for questions. Check the applicable state law and contractual deadlines as well as federal requirements.

How to prevent future email misdirection

Build recipient checks into routine work. Staff can pause to verify each address—especially autocomplete suggestions, similar names, and external domains—before sending messages that include student health information. For recurring communications, use approved recipient lists and confirm that they are current.

Use approved secure messaging or portals when appropriate, minimize the student information included in email, and apply access controls to attachments and links. Consider email-security controls such as external-recipient warnings, delayed delivery, data-loss prevention rules, and restrictions on bulk recipient fields. Select safeguards based on the information, workflow, and organizational risk rather than assuming one tool prevents every misdirection.

HHS notes that covered providers should use reasonable safeguards for email, including checking addresses and limiting the amount or type of information sent where appropriate. HIPAA does not categorically prohibit email or make encryption mandatory in every circumstance; covered entities must assess and document reasonable and appropriate safeguards under the Security Rule. See HHS guidance on email communications and HHS guidance on Security Rule encryption.

Train staff on the school’s own reporting and communication procedures, including how to report a student privacy incident quickly and where to send sensitive information securely. Review misdirection events for process improvements, update safeguards as needed, and make sure staff know that prompt reporting is more useful than attempting to quietly fix a mistake.

In short, report the error promptly, contain further access, preserve evidence, assess the information and applicable law, and document notification decisions. Clear procedures and practical email security controls help protect student privacy while enabling a timely response.

FAQs

Should staff forward a misdirected email to the privacy officer?

Report the incident to the privacy officer promptly, but do not forward the message through ordinary email if doing so would create another copy of sensitive student information. Use the approved secure reporting method. If the original message is needed for investigation, ask the privacy officer or IT team how to preserve or transfer it securely with its headers and attachments intact.

What evidence should be preserved after a misdirected email?

Preserve the original message and full headers, attachment details, intended and actual recipients, timestamps, delivery and access logs, and records of recall, quarantine, deletion requests, or recipient responses. Document the discovery, containment actions, assessment, and notification decisions, and store evidence in an approved restricted-access location.

Does FERPA or HIPAA govern student health records at a boarding school?

It depends on the school’s status, who maintains the records, and whether a provider acts on behalf of the school or independently. FERPA may cover records maintained by a school subject to FERPA or by a party acting for that school. HIPAA may cover an independent health care provider that qualifies as a covered entity. Some private K–12 boarding schools are not subject to FERPA, so verify the particular arrangement and consider state law and contracts as well.

When must affected students or families be notified?

There is no single deadline for every misdirected email. FERPA does not generally require notice solely because of an unauthorized disclosure, but other applicable laws or agreements may. If the incident is a reportable breach of unsecured protected health information under HIPAA, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. The privacy officer should confirm which rules apply and whether additional state or contractual deadlines govern.