Incident Response Guide for a Supply Chain Compromise in a Therapy Scheduling System

How should teams contain the compromise and preserve evidence?

Treat a suspected compromise of a therapy scheduling system or its software supplier as a security incident, even before you know whether patient information was exposed. Activate your incident response plan and bring together security, IT, privacy, legal, clinical operations, and vendor-management leads. Assign one person to coordinate decisions and keep a timestamped record of actions and findings.

Contain the risk without unnecessarily destroying evidence. Depending on the facts, your responders may disable the affected integration, restrict access to the vendor’s support channel, block suspicious connections, or isolate affected systems. Coordinate containment with qualified incident responders; avoid wiping, reinstalling, or making other changes to potentially compromised systems before evidence has been preserved. NIST recommends safeguarding incident records and preserving the integrity and provenance of collected data in its incident response guidance.

Preserve audit log preservation records and related evidence, including authentication and administrator logs, scheduling and access events, vendor notices, support tickets, update files, and relevant network records. Record where each item came from, when it was collected, who handled it, and how it was stored. Restrict access to the investigation materials and follow your organization’s evidence-handling procedures.

Preserve copies of important records in a secure location that is separate from systems or accounts that may be affected. Coordinate with the vendor before its logs expire or are overwritten, and document any retention limits or gaps. HHS recommends documenting security incidents, affected systems and data, response actions, recovery outcomes, and forensic information in its cybersecurity guidance.

How can therapy scheduling continue during vendor downtime?

Use your organization’s downtime procedures to continue essential scheduling while protecting patient information. HIPAA’s Security Rule requires contingency planning for emergencies affecting systems that contain electronic protected health information (ePHI), including procedures for data backup, recovery, and continuing critical business processes in emergency mode. See HHS’s Summary of the HIPAA Security Rule.

Use an approved backup calendar, downtime forms, or another system that your organization has assessed and authorized. Give staff a clear process to check appointments, document changes, route urgent requests, and reconcile the temporary records once service is restored. Limit access to staff who need it, keep paper records secured, and track who creates or changes each entry.

When contacting patients, use approved communication channels and share only the details needed to manage the appointment. HIPAA permits electronic communications when reasonable safeguards are applied; HHS advises checking recipients and limiting information where appropriate in its guidance on email communications with patients. Avoid putting sensitive details in unsecured messages or voicemail unless your organization’s procedures and safeguards allow it.

If appointments must be rescheduled, prioritize time-sensitive care and provide staff with an escalation path for clinical concerns. Do not restore normal scheduling through an unverified workaround or reconnect an affected integration simply to reduce the backlog.

What information should you request from the vendor?

Ask the vendor for a written incident update and a named contact for technical, privacy, and operational coordination. Request specific, time-stamped facts rather than general assurances. Your business associate agreement (BAA) may set reporting, cooperation, and documentation requirements; review it with privacy and legal leads.

• Incident scope and timeline: When was the compromise first detected, what components or software versions were involved, and when were affected customers notified?
• Supply chain details: Which vendor, subcontractor, build system, distribution channel, or software component was affected? Ask for relevant component and dependency information, such as a software bill of materials if available.
• Potential access to data: Could the compromised component access appointment details, patient identifiers, account credentials, or other electronic protected health information (ePHI)? Ask what evidence exists of access, acquisition, alteration, or export.
• Indicators and logs: Request relevant indicators of compromise, affected accounts, access records, audit trails, and the period for which logs are available. Ask the vendor to preserve the records and explain any collection gaps.
• Containment and remediation: Ask what the vendor has disabled, isolated, or changed; what versions are affected; and what steps it recommends customers take before reconnecting.
• Validation and recovery: Request details about independent investigation or testing, the source and verification method for any update, and known limitations or residual risks.
• Ongoing coordination: Confirm how the vendor will report new findings, support your investigation, coordinate with affected subcontractors, and provide updates about service availability.

HHS explains that business associates must report security incidents to covered entities, while the BAA may specify the report’s detail, format, and frequency. Ask the vendor to confirm its reporting obligations under your agreement and applicable HIPAA requirements; see HHS’s guidance on business associate security incident reporting.

How do you assess whether ePHI was affected?

Determine what information the system or compromised software could access, not just what the vendor’s initial notice says was accessed. Therapy scheduling systems may contain patient names, contact details, appointment dates, provider information, and other data. Whether particular information is PHI depends on the facts and its connection to a person’s health care.

Collect and compare system and vendor records to establish which accounts, features, records, and time periods were potentially affected. Investigate whether data was viewed, acquired, altered, or sent outside authorized systems. Document what is known, what remains uncertain, and the evidence supporting each conclusion. Lack of logs is a gap to assess, not proof that no access occurred.

If an impermissible use or disclosure of PHI is identified, the Breach Notification Rule presumes it is a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented risk assessment. HHS identifies four required factors: the nature and extent of the PHI, including identifiers and re-identification risk; who used or received it; whether it was actually acquired or viewed; and the extent to which risk was mitigated. Review the HHS guidance on breach risk assessment.

Also determine whether the information was unsecured protected health information. Encryption may affect whether information is considered unsecured under the applicable rule, but do not assume that encryption alone resolves the incident: assess the encryption method, whether it remained effective, and whether the relevant keys or credentials were exposed. Record the analysis and involve privacy and legal leads when deciding whether notification is required.

What HIPAA breach notification deadlines apply?

HIPAA’s breach-notification deadlines apply to breaches of unsecured protected health information, not automatically to every security incident. A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. A BAA may require a shorter reporting window, and teams should follow any applicable contractual deadline. See HHS’s Breach Notification Rule overview.

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach. For a breach affecting 500 or more individuals, the covered entity must also notify the HHS Secretary without unreasonable delay and within 60 calendar days. If fewer than 500 individuals are affected, the covered entity may report to the Secretary annually, no later than 60 days after the end of the calendar year in which the breach was discovered.

If a breach affects more than 500 residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that area. That notice is subject to the same outer limit of 60 calendar days after discovery, and it must be provided without unreasonable delay. The covered entity remains responsible for ensuring required notifications are made, although it may delegate notice tasks to a business associate by agreement.

Start assessing the incident promptly; 60 days is an outer deadline, not a recommended waiting period. Keep records supporting your breach decision and the timing and content of any required notices. If law enforcement requests a delay, follow the specific requirements in the rule and consult legal counsel.

How should you restore service and verify software updates?

Restore service only after responders have assessed the affected environment and established a safe recovery plan. Confirm that compromised access paths have been addressed, affected systems are monitored, and required data and configurations can be recovered from trusted sources. Test the restored scheduling workflow before staff rely on it, including access controls, appointment accuracy, and any interfaces to other systems.

For an update, obtain the package and release details through a trusted vendor channel. Verify the update’s digital signature or cryptographic hash against a value provided through an authenticated, separate channel. Confirm the product version and affected components, and do not install an update if verification fails or the vendor cannot explain its provenance. CISA recommends integrity checks using hashes, signatures, or certificates in its software supply chain guidance for customers.

Test the update in an isolated environment where feasible, review the vendor’s remediation information, and retain the package, verification results, and approval records. Before deployment, confirm that you have a tested rollback or recovery approach. Monitor the system after installation for unexpected access, errors, or other indicators of compromise.

Consider credential and cryptographic key rotation when credentials, tokens, signing keys, or encryption keys may have been exposed or otherwise placed at risk. Coordinate changes with the vendor and your security team so that old access is revoked, active sessions are addressed, and dependent integrations continue to work securely. Document the basis for the rotation and verify that the replacement secrets are stored and distributed through approved channels.

In short, contain the suspected compromise, preserve evidence, keep essential appointments moving through secure downtime procedures, and work with the vendor to determine what data and software were affected. Assess any potential breach carefully, meet applicable notification deadlines, and restore service only after updates and systems have been verified.

FAQs.

What should a therapy provider do first after a scheduling-system supply chain compromise?

Activate your incident response plan, notify your security and privacy leads, and coordinate with the vendor. Contain affected connections or access as appropriate while preserving relevant logs, evidence, and incident records. Avoid wiping or reinstalling potentially affected systems before responders have assessed evidence-preservation needs.

How can appointments be managed while the scheduling system is unavailable?

Use your organization’s approved downtime process, such as a secured backup calendar or downtime forms. Limit access to authorized staff, record changes and follow-up tasks, use approved channels to contact patients, and reconcile temporary records after the system is verified and restored.

When must a business associate report a security incident to a covered entity?

A business associate must report security incidents as required by its BAA, and HIPAA requires the agreement to provide for reporting security incidents of which the business associate becomes aware. For a breach of unsecured PHI, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require earlier reporting.

How can teams verify that a software update is authentic and safe to install?

Obtain the update through a trusted vendor channel and verify its signature or hash against an authenticated value supplied through a separate channel. Confirm the version and release details, review vendor remediation information, test in an isolated environment where feasible, and do not install the update if verification fails or its provenance is unclear.