Lost Hospice Backup Tape: Incident Response Checklist for Bereavement Records

A missing hospice backup tape calls for two parallel responses: protect or restore the information, and determine whether the loss involved unsecured protected health information (PHI) that triggers HIPAA notification. Treat the tape as a security incident immediately, preserve evidence, and document decisions as you investigate.

What should hospice staff do immediately after discovering a missing backup tape?

Notify your privacy officer, security lead, records manager, and incident-response team promptly, following the hospice’s written procedures. Limit discussion to people who need to know, and record when the tape was last confirmed present, when it was discovered missing, who discovered the loss, and what steps have already been taken.

• Open an incident record. Preserve relevant inventory logs, sign-out sheets, shipping records, access logs, surveillance footage, and communications. Do not alter or discard potential evidence.
• Search systematically. Check the tape library, transport containers, storage locations, vendor records, and any documented handoffs. Record where and when each search took place and its result.
• Contain related risks. If the tape or its encryption key could still be accessed, take appropriate steps to protect the key and restrict access. Ask the storage or transport vendor to investigate and preserve relevant records.
• Protect care operations. Confirm whether other usable backups exist and follow the hospice’s recovery procedures so that critical records remain available to authorized staff.
• Keep a decision log. Document findings, mitigation steps, responsible decision-makers, and the rationale for any conclusion about notification.

HIPAA requires covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects when practicable, and document the incident and its outcome. A U.S. Department of Health and Human Services (HHS) explanation of the Security Incident Procedures standard describes these duties.

How should the tape and affected bereavement records be identified?

Determine exactly which tape is missing and what it contains before estimating the number of people affected. Use the backup catalog, labeling and rotation schedule, encryption records, job logs, retention schedule, and any available manifests or restore indexes to identify the tape’s date range and contents.

Identify whether it holds hospice clinical records, bereavement records, or both. Establish the affected individuals and the categories of information, such as names, contact details, dates of service or death, diagnoses, clinical notes, or bereavement-program documentation. If the tape contains information about surviving family members as well as patients, assess that information separately where appropriate.

Keep a controlled, documented list of affected individuals and records. Reconcile it against the tape inventory and backup system rather than relying on an unverified estimate. Mark uncertain findings as provisional and update the list as evidence becomes available.

How can hospice assess encryption, access, and the risk of PHI compromise?

Confirm whether the tape was encrypted when it was created and whether the encryption method meets the applicable HHS guidance for data at rest. Verify where the decryption key was stored, who could access it, and whether the key or another copy of the tape could also be exposed. Encryption does not provide the applicable breach-notification protection if the key was compromised or the PHI can otherwise be read by an unauthorized person. See HHS guidance on rendering PHI unusable, unreadable, or indecipherable.

For unsecured protected health information, an impermissible use or disclosure is generally presumed to be a breach unless the hospice can demonstrate a low probability that the PHI was compromised. A documented HIPAA breach risk assessment must consider at least:

• The nature and extent of the PHI, including identifiers and the likelihood of re-identification.
• Who may have received or accessed the information.
• Whether the PHI was actually acquired or viewed.
• The extent to which the hospice mitigated the risk.

Examine shipping and custody records, access controls, return or recovery efforts, and any available evidence of viewing or copying. A lack of evidence that anyone viewed the tape is relevant, but should be considered alongside all four factors. The hospice should retain the analysis and supporting evidence; HHS explains the breach presumption, assessment factors, and documentation burden.

When is a lost backup tape considered a reportable HIPAA breach?

A missing tape is not automatically a reportable breach solely because staff cannot locate it. The hospice must determine whether unsecured PHI was impermissibly acquired, accessed, used, or disclosed, and whether an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. If the PHI was secured using a method specified in HHS guidance and the decryption key was not compromised, the HIPAA Breach Notification Rule generally does not require notice for that secured PHI.

If the tape held unsecured PHI and the hospice cannot establish a low probability of compromise, treat the incident as a breach of unsecured protected health information and follow the notification requirements. Separate HIPAA obligations from any additional state-law, contractual, or other reporting duties; those may also apply.

Who must be notified and by what deadlines?

For a reportable breach, the hospice, as the covered entity, must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice must describe the incident and types of information involved, explain steps individuals can take to protect themselves, summarize the hospice’s response, and provide contact information. The governing rule is 45 CFR 164.404.

If the hospice knows an affected individual is deceased and has the address of that person’s next of kin or personal representative, the rule calls for written notice by first-class mail to either. Do not assume that a deceased patient’s records are outside the breach process; evaluate the affected PHI and applicable notice requirements.

The hospice must also notify the HHS Secretary under 45 CFR 164.408. For a breach affecting 500 or more individuals, submit notice without unreasonable delay and no later than 60 calendar days after discovery. For fewer than 500 individuals, the hospice may report annually, no later than 60 days after the end of the calendar year in which the breach was discovered.

If more than 500 residents of a single state or jurisdiction are affected, the hospice must also notify prominent media outlets serving that area, without unreasonable delay and no later than 60 calendar days after discovery. The media threshold is based on residents of a state or jurisdiction, while the HHS reporting threshold is based on the number of affected individuals.

If a business associate holds or handles the tape and discovers a breach at or by its organization, it must notify the hospice under 45 CFR 164.410, without unreasonable delay and no later than 60 calendar days after discovery. The business associate agreement may require faster notice. The hospice remains responsible for ensuring required individual notices are provided, although it may delegate delivery. HHS summarizes the notification deadlines and thresholds.

How long are deceased patients’ records protected and hospice records retained?

HIPAA Privacy Rule protections for deceased individual protected health information continue for 50 years after the individual’s death. That protection period is not a requirement to keep the records for 50 years: HHS explains that the Privacy Rule does not set medical-record retention periods, which are governed by state or other applicable law.

For Medicare-certified hospice providers, 42 CFR 418.104 requires patient clinical records to be retained for six years after the patient’s death or discharge, unless state law requires a longer period. Check the applicable state requirements and any other relevant obligations before disposing of records. The hospice’s hospice clinical record retention duties and HIPAA’s 50-year protection for decedent health information are separate requirements.

How can hospice recover data and prevent another backup tape loss?

Restore records from a verified alternative backup, using authorized staff and documented recovery procedures. Confirm the recovered data is complete and usable before relying on it, and maintain access controls during restoration. HIPAA’s Security Rule requires contingency planning that includes procedures for backing up electronic PHI and restoring lost data; HHS describes these elements in its Summary of the HIPAA Security Rule.

After the immediate response, review why the tape went missing and update the controls that failed or proved inadequate. Consider measures such as:

• Encrypting backup media and storing decryption keys separately.
• Maintaining an accurate inventory and documenting each transfer, storage location, and return.
• Using tracked, secure transport and limiting access to authorized staff.
• Testing restoration from independent backups and confirming that recovery procedures work.
• Training staff on backup handling, incident reporting, and the hospice’s written policies.

Document the root cause, recovery results, risk assessment, mitigation, and any required notifications. For a lost hospice backup tape, prompt containment, reliable identification of affected records, a documented risk assessment, and timely notices when required help protect both bereavement records and the people connected to them.

FAQs

Does HIPAA protect a deceased patient’s health information?

Yes. HIPAA Privacy Rule protections generally cover a deceased individual’s identifiable health information for 50 years after death. That protection period does not itself require the hospice to retain the records for 50 years. See HHS guidance on health information of deceased individuals.

How quickly must hospice notify individuals about a reportable breach?

Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. The 60-day limit is a maximum, not permission to delay notice when it can reasonably be sent sooner. See 45 CFR 164.404.

When must hospice notify the media about a lost tape?

Media notice is required when a reportable breach of unsecured PHI affects more than 500 residents of one state or jurisdiction. Notice to prominent media outlets serving that area is due without unreasonable delay and no later than 60 calendar days after discovery. A lost tape does not trigger media notice unless the incident meets the breach and threshold requirements. See 45 CFR 164.406.

How long must hospice retain clinical records after death or discharge?

For Medicare-certified hospice providers, patient clinical records generally must be retained for six years after death or discharge, unless state law sets a longer period. HIPAA’s 50-year protection for deceased individuals’ PHI is a privacy-protection period, not a 50-year record-retention rule. See 42 CFR 418.104 and HHS guidance on decedent record retention.