Misdirected Email Incident Response Guide for Focused Ultrasound Centers

What to do immediately after a misdirected email

Act promptly when you discover that an email from your focused ultrasound center went to the wrong person or address. Notify your privacy or compliance officer and IT/security lead through your incident-reporting process. Preserve the original message, headers, attachments, and relevant system logs; don’t forward the email or its PHI to additional people while reporting it.

If the message is still in your organization’s email system, ask IT to determine whether it can be recalled or access can be revoked. A recall may not remove a message already delivered, downloaded, or copied, so treat it as one containment measure—not proof that exposure has ended. If an account or system may be compromised, follow your security incident procedures to contain the access and investigate its scope. HHS describes incident-response processes as including identification, response, mitigation, and documentation of incidents and outcomes in its OCR cybersecurity guidance.

Keep clinical operations and patient safety in view. For example, if the email involved treatment scheduling or other time-sensitive care information, involve the appropriate clinical lead while limiting any further disclosure.

How to investigate the recipient and information disclosed

Establish what was sent, who could access it, and when the center learned of the incident. Check the recipient address, whether it belonged to an individual or group, any forwarding rules, and available delivery or access logs. Confirm whether the message or attachments were opened, downloaded, forwarded, or otherwise shared, and preserve the evidence supporting those findings.

Identify each affected patient and the specific information in the email or attachments. This may include names, contact details, appointment information, treatment-related information, imaging references, diagnoses, or other identifiable health information. Count affected individuals based on the people whose information was involved—not the number of messages or files.

Record the breach discovery date as well as the date the email was sent. Under the rule, a breach is treated as discovered when the covered entity first knows of it, or would have known through reasonable diligence; knowledge by a workforce member or agent generally counts, except for the person who committed the breach. The current regulation on individual notification sets out this discovery standard.

How to contain exposure and request deletion

Contact the unintended recipient promptly using a verified channel. Ask them not to read further, use, copy, forward, print, or share the message or attachments; to delete them from their inbox, trash, downloads, and other locations they control; and to confirm in writing what they did. Request that they tell you if they already accessed or shared the information.

Record the request, the recipient’s response, and any steps taken to limit further access. A recipient deletion confirmation can help document mitigation, but it does not by itself establish that the information was never accessed or that notification is unnecessary. The center must assess the full circumstances.

If the recipient is a business associate, notify the covered entity and follow the applicable business associate agreement and incident-reporting process. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; an agreement may set a shorter reporting period. See HHS guidance on the Breach Notification Rule.

How to assess whether the email caused a reportable breach

A misdirected email containing identifiable PHI is not automatically a reportable breach. First determine whether there was a protected health information impermissible disclosure and whether the information was unsecured under HIPAA. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the center can demonstrate a low probability that the PHI was compromised through a documented HIPAA breach risk assessment.

Unless an exception applies, assess at least these four factors:

• The nature and extent of the PHI, including identifiers and the likelihood that the information could identify a patient.
• Who received the information and their relationship to the center and its patients.
• Whether the recipient actually acquired or viewed the information.
• The extent to which the risk was mitigated, including the recipient’s actions and any limits on further access or disclosure.

These factors are specified in 45 CFR § 164.402 and summarized by HHS. The regulation also describes exceptions, including certain disclosures to another person authorized to access PHI at the same covered entity when the information is not further used or disclosed improperly. Document the facts and reasoning rather than relying on a recipient’s assurances alone.

HIPAA breach notification applies to unsecured PHI. Assess whether any encryption or other safeguard meets the Secretary’s applicable guidance and whether it actually rendered the information unusable, unreadable, or indecipherable to the unintended recipient. Don’t assume that a secure connection or a “confidential” email label alone resolves the breach analysis.

What to include in individual notification

If the assessment finds a reportable breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice must be written in plain language and include, to the extent possible:

• A brief description of what happened, including the breach and discovery dates if known.
• The types of unsecured PHI involved.
• Steps individuals can take to protect themselves from potential harm.
• A brief description of the center’s investigation, mitigation, and measures to prevent further breaches.
• Contact procedures for questions or more information, such as a toll-free telephone number, email address, website, or postal address.

HIPAA generally requires written notice by first-class mail to the individual’s last known address, or by email if the individual has agreed to electronic notice. The individual notification regulation specifies the content, timing, and methods. If the center lacks current contact information for affected individuals, follow the rule’s substitute-notice requirements and document the method used.

HIPAA reporting deadlines for breaches affecting fewer than 500 or 500 or more individuals

For reportable breaches, the number of affected individuals determines the deadline for reporting to HHS. It does not extend the individual-notice deadline: affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, whether the breach affects fewer than 500 people or 500 or more.

• 500 or more individuals: Notify HHS without unreasonable delay and no later than 60 calendar days after discovery. Provide individual notices within the same outer time limit. If more than 500 residents of a single state or jurisdiction are affected, the center must also notify prominent media outlets serving that area.
• Fewer than 500 individuals: Notify affected individuals within the individual-notice deadline. Report the breach to HHS no later than 60 days after the end of the calendar year in which it was discovered. The center may submit the HHS report earlier rather than waiting for year-end.

These deadlines are explained in HHS instructions for submitting breach reports and its Breach Notification Rule guidance. Don’t wait for a lengthy investigation to establish the discovery date; HHS notes that the reporting period begins when the incident is first known, even if it is not yet clear whether it meets the breach definition.

How focused ultrasound centers should document incident response

Maintain a breach mitigation documentation file that allows the center to show what happened, how it investigated, and why it chose a particular response. Include the original email and relevant headers; incident and discovery dates; affected-person and information inventories; recipient details; evidence of access or forwarding; deletion requests and responses; containment steps; and communications among the privacy, security, legal, and clinical teams.

Also retain the breach assessment and its reasoning, including each required risk factor, any applicable exception, and the basis for determining whether notification was required. If the center determines a breach is reportable, retain copies of notices, submission records, affected-person counts, and any media notice. HHS says covered entities and business associates must be able to demonstrate that required notices were made or that the incident did not constitute a breach; see its administrative requirements and burden-of-proof guidance.

In short, respond promptly, preserve the evidence, contain further disclosure, assess the facts under HIPAA’s breach standard, meet applicable notification deadlines, and document each decision.

FAQs

Is a misdirected email containing PHI automatically a reportable breach?

No. An impermissible disclosure of unsecured PHI is generally presumed to be a breach, but an exception may apply or a documented risk assessment may demonstrate a low probability that the PHI was compromised. Evaluate the recipient, information, access, and mitigation rather than assuming either that every misdirected email is reportable or that deletion resolves the issue.

What should a focused ultrasound center ask an unintended recipient to do?

Ask the recipient not to use, copy, forward, print, or share the email or attachments; to delete them from locations they control; and to confirm deletion in writing. Also ask whether they opened or shared the information. Preserve the response as part of the incident record, but assess the facts independently.

How soon must affected individuals be notified after a breach is discovered?

Without unreasonable delay and no later than 60 calendar days after discovery of a reportable breach of unsecured PHI. The deadline applies whether the breach affects fewer than 500 individuals or 500 or more.

When must a breach affecting fewer than 500 individuals be reported to HHS?

No later than 60 days after the end of the calendar year in which the breach was discovered. The covered entity may report earlier and does not have to wait until year-end.